Courtyard front desk gave my name and credit card to a scammer who called the hotel
I stay at Marriott properties around five nights a month for work. Wanted to share something that happened at a Courtyard last month, partly as a warning and partly because I'm curious how others would have played the aftermath.
It was a one night stay that I booked online an hour before I arrived. About an hour after check-in, I got a call on the room phone from someone claiming to be the GM. Friendly, asks how my stay is going, then says there's an issue with my payment and he needs to confirm my card details. I declined to do it over the phone and went down to the front desk to sort it out in person. The only reason I thought there might actually be a problem is that the hotel usually verifies my card at check-in, but this time the clerk just asked "is it the card on file?"
When I got there, the clerk was on the phone and told me yes, there was an issue with my card. He seemed to be having trouble, so I didn't think much of it when he went over my info with the person on the line. I assumed he was talking to his own GM. He read my card number out loud, then asked me for my zip code, which is when I started to get uneasy. He hung up and said "looks like we were just one number off." That card had been on my Bonvoy account for years. It's not one number off.
So I asked who he'd been talking to. He said "reservations." I told him I booked online and never gave my card to reservations, and that the guy who called my room identified himself as the GM. He said that wasn't the GM. I asked who he'd just read my card to. He said he didn't know, the caller was friendly so he didn't think anything of it. Turns out the caller had phoned the front desk cold and asked if anyone had recently checked in with "a last name like [mine]." The clerk gave them my full name and transferred him straight to my room.
So in one incident the front desk:
- Confirmed to an anonymous caller that I was a guest
- Transferred that caller to my room
- Confirmed to me there was a real problem with my payment
- Read my card number and zip aloud to a caller they couldn't identify
I cancelled the card and had it reissued that night. The property refunded the stay without ever contacting me, which does nothing for me since it was a work trip. They gave me 10,000 points, which I don't think is enough. Corporate got involved after I escalated, and said the property has to be the one to issue compensation. I got an email last week that another 15,000 points was deposited to my account.
I know the phone scam itself is common and not unique to Marriott. What bothers me is how easily the staff handed everything over, and that the local property never once picked up the phone to talk to me or even send an email after the event. Corporate was the only side that engaged.
Am I being unreasonable if I feel like 25,000 points isn't enough to make up for this level of security breach that put me at financial risk?
Mainly posting so the next person knows: if you get a call in your room asking to "confirm" your card, hang up and resolve it at checkout if there's really an issue or demand to speak to the manager in person.