Hotel and B&Bs Safety, Security
and Common Scams To Avoid

How to Serve Guests Without Jeopardizing Security!

By Nathan Gawlik
Nathan Gawlik's experience includes being a General Manager of a Hampton Inn and other front line roles such as a Banquet Captain, Front Desk Agent, Housekeeper, Catering Event Manager, and Director of Sales.

Hotel and B&Bs Safety, Security
& Common Scams To Avoid

How to Serve Guests Without Jeopardizing Security!

By Nathan Gawlik

In early 2016, Erin Andrews was becoming a household name but not for her career achievements as a sportscaster for ESPN or her success on Dancing with the Stars. Erin Andrews filed a 75 million dollar lawsuit against Marriott, of which she was awarded 55 million dollars.

Several years earlier, Andrews had been filmed nude in her hotel room by a stalker, Michael David Barrett. Barrett was able to pry off the peephole on the entry door and film Erin in her hotel room from at least two separate hotels. This incident sent shockwaves through the hospitality industry leading many to ask, How did the stalker know which room she was in? Could I just as easily be a victim under current procedures? And what can be done to ensure the safety and security of our valuable guests going forward?

If You Have Guests, This is For You

Throughout this article, there are valuable insights and general guidelines to help ensure guests are safe and Innkeepers are protecting themselves from liability. Whether you run campsites, hotels, or B&Bs - safety and security should be your number one priority.

Likely, the most visible change you have seen as a reaction to the Erin Andrews case is the addition of peephole covers in hotel rooms. These peepholes are often screwed into the door itself rather than using an adhesive. But the covers alone can't help keep your guests safe.

Policies and procedures were added across brands to ensure line staff wasn't providing too much secure information. Read on and take notes so you can apply these tips to your property-specific needs

Here's the Secret

In the hotel industry, Front Desk Agents are instructed to not even say the guest room number out loud during check-in. The guest may choose to read their room number aloud from the key jacket but the staff is only to point to it when handing over the key cards. This industry-standard is the best practice because you never know if the person waiting next in line has malintent.

It is entirely plausible that the Front Desk Agent who checked in Erin Andrews stated her room number out loud, unknowingly informing the deviant lurking in the lobby exactly where she would be staying that evening. The thought alone gives me chills.

Granting Access - Be the Gatekeeper

The above isn't the only procedure that has changed at check-in. Front Desk staff have also been trained to be extra scrupulous with who they grant room access to. This might seem rather obvious, but the person on the reservation has to be present at check-in - not their spouse, relative, or other individual. This is important for the property because in doing so they can potentially avoid putting themselves in hot water with a cheating spouse scenario or granting access to the wrong party. You may think it doesn't happen but...it does.

Just think of the calamity that could ensue when you have two common last names checking in on the same day, like Smith or Johnson. Special attention should be taken to verify all the details on the reservation with the guest identification they provided.

It is important to reiterate the obvious. Far too often, it is easy to get complacent and fall into a routine during check-in; a glance at the ID, pull up the reservation and hand over the keys. Not only is check-in a great opportunity to build rapport with your guests, but it is imperative to verify their information with them for their safety. I like to have at least a couple of qualifying questions to ensure the person in front of you is who they say they are.

Key Tips for Great Service and Security

You can still meet your security priorities without being intrusive. As is always the case in hospitality, we want to be...well, hospitable - that means being guest-centric.

Remember, don't volunteer information or at least not all the information. Here are some examples that you can integrate into your check-in process:
"Can we have a good phone number for you in case you leave something behind?"
Compare this with what is already on file.

Stated another way, "Is the best phone number for you still ending in 5309?"

This can be applied to their email as well:

"What's the best email to email over the receipt?"
"Is your yahoo email the best one to send the folio to?"
Remember to be guest-centric. What's in it for them? Personally, I'm not motivated to get their phone number in case they leave something behind - I want to be able to get ahold of them if their credit card declines. But of course, you would never imply that during the check-in process.

Furthermore, staff shouldn't give out information without the primary guests' explicit permission. The primary guest should be prompted if they would like to add any additional approved names to their reservation. This is often convenient for a guest to add their children if they are granting them keys. This way, the adult doesn't have to be present for a replacement key to be issued.

I'll draw on my experience while working at a spa resort.

Mr. McAfee came to check-in after dropping off his wife to get a 90-minute massage. He had planned to check-in and relax, maybe take a quick nap before he went to pick her up. This expectation was already assured in his mind as he approached the desk.

After he provided the last name and he informed me it was under his wife, I asked if Mrs. McAfee was available. After a polite exchange you can assume, he stomped into the lobby to see if he could reach her on her cell phone, to no avail. He likely thought twice about driving up to the spa and interrupting her tranquil experience.

After another moment, I was able to get away from the desk to find Mr. McAfee pouting as he slumped in a chair staring out the window. I brought a bottle of water as a peace offering and eagerly tried to be of service. After better understanding his aspirations of catching a nap, I explained that lounge chairs around the pool were available and a bathroom room at the pool would make it easy for him to change. The exchange went something like this.

Hello Mr. McAfee, I was hoping to offer you a bottle of water while you wait.

I understand just how big of an inconvenience this can be but I want to assure you that you and your family's security is our top priority. I couldn't, in good conscience, give you her room number without her explicit permission. A rule, I'm sure you can appreciate. But this is a resort after all and you are here to relax. What were you hoping to do today?

Of course, it's been a long drive and it would be nice to lay down. Might I suggest an alternative to your accommodations for the moment? It's a hot summer day and our pool is just across the parking lot. There you will find a changing room and I can see from here there are several lounge chairs available. Maybe I can get you a drink credit to the swim-up bar. How does that sound?

Mr. McAfee was elated - so much so, he forgot all about his wife and his room.

The same rule applies to business travelers. Commonly, I'll leave guests waiting until they can get a hold of their boss they claim holds the reservation. I see this frequently with branded hotels because since the company is paying for it, the boss wants to earn the rewards points for the stay.

Never give out keys to a guest room without the primary guests' explicit permission.

With that being said, does this happen in New York, LA or Chicago? Absolutely! It's important to be on your toes and follow strict guidelines. If you run a small property and are a good judge of character, you might be alright but it's up to you to weigh just how much risk you want to take on and weigh that with guest satisfaction.

I will say, there have been many occasions where I refuse hotel room access to the young woman in front of me and she says with a frustrated sigh, "Well I guess it's good they won't let just anyone into my room."

Dealing with the general public, your policies often live in a gray area. I'll give you an example. Our property, like most, required that you provide a credit card at check-in. Guests cannot pay with cash prior to their stay for fear of theft. There must be a credit or debit card on file. Likewise, most hotels also require that the card be authorized for more than the cost of the room. Some require a ten dollar authorization hold per night for incidentals and this amount can vary from property to property.

On one occasion, I took a call as the manager from a woman fleaing a domestic violence situation. She had traveled a fair amount and was aware of this general rule. Her abuser controlled all her finances and she didn't have access to any credit cards. Our property was located in Oregon and was the midway point from her to her mother as she traveled from Seattle to San Francisco.

This woman indicated that she had enough cash to pay for the room and an additional $100 cash to place in reserve for incidentals. Against my better judgement I made this exception weighing the liability to the hotel and this woman's story. This was the only exception to this rule I can recall that I made that didn't come back to bite me. When the woman came to checkout, we had her $100 deposit waiting in a safety deposit box. I inspected the room to ensure there wasn't any damage and that the TV was still there before proceeding to give her the deposit back and wishing her safe travels.

Groups

Likewise, even in group scenarios, other guest information shouldn't be provided for any reason without that guest's permission. Let's say there is a soccer team all staying at the same property. Perhaps one of the parents wants to stay near the same group or wants to know where her children's friends are staying. Sounds innocent enough. Without the permission from all parties involved, you could be putting yourself in hot water. Make sure to mind best practices when people ask for these details. Try something like this:

"For safety and security purposes for you and your family, we aren't able to provide that information. I can certainly see what I can do to accommodate any location requests you may have but I can't tell you where another guest is staying. You are welcome to give them a call and she can tell you where she is staying but technically, I can't even confirm or deny anyone specific is a guest here or not."

Be accommodating and polite but firm. Safety is your number one priority.

Security Eclipsed

Always assume a guest room is occupied. Always knock. Wait for a response and announce yourself as you enter a room. We all remember the Great American Eclipse in the summer of 2017. At the time, I was the Guest Services Manager of a large golf resort in Central Oregon. Central Oregon was sought after for its nearly 300 days of sunshine a year. This meant crowds flocked to get a premier view of this historic event.

There wasn't a Bed and Breakfast or hotel room left in the tri-county area when the eclipse came to town. Our 300 unit property was all rented out by a German group. We made arrangements to provide portage for the group set to come in on several tour buses arriving simultaneously. We thought we were organized. One person's job was to take down the names of each guest and assign them a luggage tag, and that person would tell someone else to transport it to the corresponding guest room.

The Germans file off the bus and we can only understand just about every third name they give us much less trying to match the correct spelling on their reservation, which of course, wasn't one hundred percent accurate.

Chaos ensues: Luggage is getting delivered to the wrong places and guests are being checked-in to the wrong units.

At one point, sweat is beading down my face as I take another trip down the hall. There aren't enough luggage carts so I'm just carrying the bags. In my haste, I barge into a room and I walk in on one of our guests relieving himself in the bathroom.

"Shiza!" He screamed as I dropped the bags, apologized, and ran.

"Shiza is right." I murmured under my breath as I shook my head with a grin and headed back to the front.

Always ALWAYS knock, wait for a response, and announce yourself as you enter.

Secret Service Snafu

Another group example that comes to mind involves the former President Bill Clinton. I was working as the Front Office Manager at a large convention center. In this particular week, we had over 2000 visitors attending a nursing conference that lasted all week. President Clinton was one of their guest speakers and was also staying at the lodge.

All staff were on high alert given the volume and importance this group provided the property. The catering for the group all week was in excess of one-hundred thousand dollars and the accommodations were nearly one-hundred and thirty thousand dollars for the week.

On the first day of the week-long conference, a new Reservation Agent answered the phone. Prompted about the weeks' activities, this staff member confirmed President Clinton would not only be speaking at the conference, which was public knowledge, but would also be staying at the same property later in the week.

The Secret Service became aware that active death threats were being made against the President to be carried out at the location of the conference. The busy stress-filled week went from ordinary to extraordinary immediately. The severity of this albeit minor mistake caused a ripple effect of meetings, negotiations, security checks, and rechecks.

The Secret Service contemplated canceling the speaking engagement held at the end of the week as the capstone of the entire conference. This would be devastating for all of the nearly 700 attendees eagerly awaiting to hear him speak, much less the irrevocable damage to the reputation to the property with such a high profile misstep. The stakeholders agreed that President Clinton would not be staying at our hotel.

Our property voluntarily paid for accommodations elsewhere for the President and their team, they also refunded nearly half the cost of the catering and lost the conference the following year as a result. Nearly $250,000 of repeat business gone because of a single sentence of someone not properly trained. Not to mention weeks of emails back and forth to Washington D.C. and additional work and training procedures in the coming months.

Guest safety doesn't just apply when they are staying with you. It should be at the forefront of every decision you make before, during, and after their stay. Regardless of the medium in which the frontline staff is communicating, they should always be vigilant against security threats that come across email, in person, or over the phone.

Phone Security and Common Scams

Let's say, you have a restaurant on the property and you allow your guests to place the bill on their room reservation. What do they need to provide to do this? They will need at least two things: Their name as it appears in the system and their room number.

This is exactly what the Front Desk will ask for to get a duplicate key made up or to transfer a call to a room, right? Not if they are properly trained.

Again, drawing on my experience from the resort, someone called in to the Front Desk asking to be transferred to a room. I asked if they could confirm the name on the reservation and completed the transfer and promptly hung up the phone.

A few minutes later, a guest approached the desk and asked for me by my first name clutching her wallet in hand. She looked around bewildered and said, "I don't see any line."

We were both a little confused. The guest explained that she spoke with someone claiming to be me and that there was trouble with their room charge from the restaurant. The individual on the phone asked for a credit card over the phone indicating there was a long line at the front desk.

My heart sunk. I felt terrible and immediately asked if she had provided the sensitive information to the caller. Thank goodness she hadn't or she would be forced to cancel her credit card. I can only assume that the scammer gained the guest personal information after looking at their receipt left on the recently vacated restaurant table.

The only way to get around this precarious situation is by performing a soft transfer.

How To Perform a Soft Transfer

A soft transfer, also referred to as a warm transfer, allows you to speak with the person you intend on transferring the call before handing it off. The process goes something like this:

Ask the caller their name and get the name of the guest they wish to be transferred to. Don't confirm any information at this point.
Tell the caller there will be a brief hold while you get them connected.
Press transfer and dial the room number; at this point, the caller can't hear anything.
Inform the guest who is calling. If they want to be connected, inform the guest to stay on the line.
Once you hang-up the other two lines will be connected.

This is important to do each time because whether you realize it or not you are a PBX Operator. PBX stands for Private Branch Exchange, which is a private telephone network used within a company or organization. As the operator, your job is to direct and connect.

Furthermore, most hotels only allow the Front Desk to call individual guest rooms - not even the lobby phone can connect with a guest room directly without calling the Front Desk first.

Let's say a malfeasant notices an attractive person heading into room 202. They spring down to the complimentary phone available in the lobby or the elevator bay and are able to ring the room. The individual starts to harass this guest, requesting to go out on a date, to which the guest refuses. When the guest calls to complain about the incident to the Front Desk, they are of little help because the origin of the call isn't associated with another guest room and the caller can't be identified. Now, if the property had a camera on the phone that was used, they might be able to identify the aggressor but the chances are slim.

It's important to have the Gatekeepers at the Front Desk well trained and aware of such situations so they can protect themselves, the guests, and your specific property.

What Happens When Training Isn't Enough

Even when you mind all the best practices, it is still possible for scammers to get through to your guests. This was the case last June at a Seattle Hilton and a Dallas Hilton Garden Inn, according to NBC.

A very similar scenario listed above was carried out but the scammers. In this case, however, they were able to bypass the switchboard system and the Front Desk entirely. "The scammer called a direct extension and then when the extension was forwarded to voicemail, the caller hit the * (transfer) key and input a random room number." The guests waiting on the other line were asked to provide their credit card information under erroneous circumstances.

Scams like this are less of a concern since everyone has cell phones and we rely less on the guest room phone but they are still prevalent enough to be noted. If you don't have multiple phone lines available throughout your Inn, you shouldn't have to worry about some of these examples but it doesn't mean you are free from phone scams that might put the property at risk.

(side bar) *Guests need to be able to call out to 911 from their guest rooms. If doing so isn't abundantly clear, be sure to provide instructions to dial out. Check with your local lodging authorities for details.

When in Doubt, Call Them Back

I fell victim to the rampant and prevalent print toner scam.

These peddlers of office supplies have some tricky tactics to gain your business.

As a manager, I received a call from someone claiming to be our vendor that serviced our large photocopier in the back office. He sounded legitimate since he was able to tell me the printer and model number of the equipment.

Little did I know he had called earlier in the week and spoke with a Front Desk Agent to gain this information and my name. Armed with this information, it was easy for him to appear as though we had done business with them in the past.
I confirmed our address and an order of new toner and paper that was an exorbitant amount higher than our current authorized supplier.

Even more concerning is the Tech Support Scams. These have many forms. This could be a user on your network clicks on a phishing email leading to a virus or what happened to our property.

We received a call from someone claiming to work in our IT department. They needed access to our system for one reason or another. On this occasion, they needed to install new antivirus software on our computers. I was instructed to go to a website so they could gain control of my computer. If I had, they would have had access to all reservation data and likely locked me out of my computer.

I opted instead to call them back. I knew our IT phone number, so I hung up and called the number in our binder provided to me when I started employment. Of course, when I reached them, they had no idea of any such open tickets or installations.

I was also able to search the number the scammer called from. It has been flagged as likely scam related. Oftentimes if you ask the caller if you can call them back, they will simply give in and hang up.

Conclusion

There are a lot of scams out there and they are continuously evolving. The inn, hotel, or bed and breakfast holds an assumption of responsibility to provide a safe place for guests to stay. It is your responsibility to stay up to date with anything that can negatively affect your guests' stay.

If you are accosted by one of these scammers, be sure to report it. The FTC has a site, I've listed below that is a great resource to report scams and keep yourself informed.

As we wrap up, understand that there is room for interpretation. Use your best judgment when it comes to balancing convenience and security. I've had a spouse go out to their vehicle for a wife's ID because she is tending to their children. We have had people try to check-in under their boss's name. In those instances, calling the boss and asking him to verify his identity and grant access is completely appropriate.

Some of these processes may seem overburdensome for the inn or the guest. I've found that many travelers appreciate the extra due diligence. Single women traveling alone find comfort in knowing that their safety is the staff's top priority.

You can't ever be too careful. It's better to be safe than sorry.

Be proactive. Train your staff to ask if someone else should be added to the reservation.

I always recommend having regular trainings so all front line employees know how to handle a situation. This may go without saying, but of course housekeeping staff should be trained to not allow any guests into guest rooms for any reason.

High profile guests enjoy campsites, unique B&Bs, and hotels alike. Some have likely stayed with you and you didn't even know it. If there is a security breach involving someone of interest at your property, it could make national headlines and paint you in a very negative light. A reputation like that is hard to come back from.

Summary

In Summary, feel free to print this page to share with your staff. I often have them initial that they have read and understood the below statements and review as they have questions.

When issuing new keys, always ask for an ID.
Do not state the guest room number out loud. Write it down for them so no one in the lobby will overhear.
Do not allow someone to check-in under another name without the explicit permission of the person whose name is on the reservation. Including spouses.
Do not transfer a phone call to a guest room unless the individual on the line can tell you the name on the reservation at the very least.

Performing a Soft Transfer is the best and the most secure.
Ask the caller their name. Get the name and room number of the guest.
Press transfer, and inform the guest who is calling. Hang-up if they want to be connected.

If you write down someone's credit card number or any other personal information, make sure you shred it once finished.
Always assume a room is occupied. Always knock, wait for a response, and announce yourself as you enter.
If you print folios at night and put them under the guest room door: Make sure the express check out folios are completely under the door. If you print something with someone's personal information on it, be sure it is secure.
Do not place someone next to another guest room without that guest's explicit permission. Even in group reservations.
Ask the guest checking-in if anyone else should be registered on the reservation. If the person states that someone else can have access or directions to their room, be sure to write their name in with specific instructions.
When in doubt about the authority and authenticity of the person calling, ask if you can call them back. Speak with a manager to get clarification.
Guests need to be able to call out to 911 from their guest rooms in case of emergencies.
Comply with law enforcement by telling them if a guest is staying with us and where they are staying. Do not grant access to a room unless a crime is in progress or the identified police officer has presented a warrant.