Many hotel chains are racing to replace plastic room keys with digital options, including the Apple Wallet app and Google Wallet. Plastic hotel key cards have had a rough few years. Touching is taboo during the pandemic, so the touchless trend has accelerated. And cybersecurity concerns have been raised around hotel key technology. Earlier this year, researchers found a flaw in the plastic hotel key This could leave three million keys vulnerable to hackers and take years to fix.
Cybersecurity and safety concerns have prompted many hotel chains to accelerate plans to switch to hotel room door locks. While major U.S. chains have had the ability to use digital keys for years, Google Wallet and Apple Wallet are getting in on the act by giving hotels the ability to store guests’ room keys in their wallets, allowing them to enter their rooms simply by tapping the back of their phones against a reader near the door handle.
Hilton Hotels has an Honors app that allows guests to check in and access their room keys using their smartphones. The 119-room Harpeth Hotel in Franklin, Tennessee, is a Hilton property, and guests can check in digitally and store their keys in their Google or Apple wallet app.
“The benefit of digital check-in is that your phone is your key,” says Kimberly Elder, director of sales at Harpeth Hotels, adding that many guests still prefer plastic key cards.
Eli Fuchs, regional managing director at Valor Hospitality Partners, which owns Hilton and Holiday Inn Express hotels, says digital is the next wave in hotel door technology.
“The traditional hotel room key is at risk of being eliminated,” says Fuchs.
However, some security experts warn that even newer locking methods are not a perfect solution.
“Keyless systems can create entirely new threat vectors that hotel security operations need to manage,” said Lee Clark, director of cyber threat intelligence production at the Hospitality and Retail Information Sharing and Analysis Center (RH-ISAC).
While Clark says these threats can be mitigated through security policies and controls, such as multi-factor authentication (MFA), they create extra steps that busy customers don’t always want to take.
Clark said it’s unlikely that all hotels will replace all key cards with digital keys anytime soon, as some guests may prefer key cards or not have personal devices compatible with digital key systems, along with the added cost.
“Converting to digital and keyless locking systems will incur significant costs in terms of equipment, installation, maintenance and security,” says Clark.
Hotel chains begin requiring digital key systems
And human habits constantly get in the way.
For example, data from a JD Power hotel study found that only 14% of all guests staying at branded hotels used digital keys during their stay. Even guests who downloaded the brand’s app to their phones used plastic key cards.
According to JD Power data, among guests with a hotel company/brand app, 30% use digital keys and 70% use Mostly plastic cards.
On the other hand, many hotels have yet to install locks with digital door opening functionality.
“Some large hotel chains, which have apps capable of supporting digital keys, are starting to require hotel franchise owners to install new door locks as part of new brand standards,” said Andrea Stokes, director of the hospitality practice at JD Power.
While customers have been slow to adopt digital options, JD Power data shows that customers who use keyless payment methods feel more secure than those who use plastic cards.
“Guests who used a ‘digital key’ rated the hotel’s security significantly more positively than guests who did not use a digital key,” said Stokes.
Chad Spensky, CEO of Allthenticate, a company that develops smartphone access and credential management, compares plastic key cards to passwords, which cybersecurity experts consider low-tech and outdated.
“We all still use passwords, despite the obvious security flaws and difficult user experience. Likewise, key cards will likely continue to be used,” Spensky said.
The real promise of digital cards, he said, is not about security but about convenience.
“While the cards are no more secure to deploy than their plastic counterparts, the user experience is far superior,” Spensky said. Given the choice between shuffling a bunch of plastic cards or having a smartphone, “the phone is the clear winner.”
Consumer convenience is driving hotel chains to embrace digital keys. While digital keys provide an additional attack surface, they also allow for rapid route adjustments.
One of the biggest problems with keycards, Spensky said, is that when a vulnerability is discovered, there’s no easy way to patch it. “With smartphones, patches can be rolled out almost instantly over the air,” he said.
Don’t Rule Out Plastic Key Cards Just Yet
Mehmet Erdem, Professor and chair of the department of resort, gaming and golf course management at the William F. Harrah College of Hospitality at the University of Las Vegas, cautioned that no system is perfect and people should not let digital entry methods give them a false sense of security.
“Everything can be hacked, everything can be compromised,” Erdem said. “If someone has the intention to hack, it will happen.”
Erdem says plastic key cards shouldn’t be discarded just yet. There are magnetic key cards that need to be swiped, and newer radio frequency identification (RFID) cards that only require proximity or can be loaded onto a phone. Erdem says RFID technology is improving, making plastic keys more versatile.
“RFID is not obsolete,” Erdem said, adding that the technology allows people who want less interaction to download an app, grab a key, activate it, and enter the room.
“Hotels will push for mobile apps because of sustainability and cost,” Erdem said, but he added that some people will always prefer physical plastic keys. He said the advantage of a digital version of a plastic key comes down to human nature. “People forget their wallets, they forget their IDs, but they don’t forget their phones.”
But in Las Vegas, where people regularly head back to their hotel rooms with winnings from blackjack tables and slot machines, there’s an old-fashioned, low-tech option that makes talking about doors pointless.
“There is always a safe in the room, guests should use the safe if they have valuables,” said Erdem.
