Many hotel chains are racing to replace plastic room keys with digital options, including the Apple Wallet and Google Wallet apps. Plastic hotel key cards have had a rough few years. During the pandemic, touch was off-limits, so the touchless trend has accelerated. And cybersecurity concerns about hotel key technology have grown. Earlier this year, researchers found a vulnerability in plastic hotel keys that could have left up to three million keys vulnerable to hackers and taken years to patch.
Cybersecurity and safety concerns have prompted several hotel chains to accelerate their plans to switch to hotel room door locks. While major hotel chains in the United States have had digital key capability for years, Google Wallet and Apple Wallet are stepping in by offering hotels the ability to store guests’ room keys in their wallets, allowing them to access their rooms by simply tapping the back of their phone on a reader near the doorknob.
Hilton Hotels has an Honors app that allows guests to check in and use their room key using their smartphone. The 119-room Harpeth Hotel in Franklin, Tennessee, is a Hilton property, and guests can check in digitally and store keys in their Google or Apple Wallet app.
“The benefit of digital check-in is that your phone is the key,” said Kimberly Elder, director of sales at Harpeth Hotel, adding that many guests still prefer plastic key cards.
Digital technology is the next wave in hotel room door technology, says Eli Fox, regional chief operating officer at Valor Hospitality Partners, which includes Hilton and Holiday Inn Express hotels in its portfolio.
“Traditional hotel room keys are heading toward the end of their lifespan,” says Fox.
However, some security experts warn that even the latest locking methods are not completely secure.
“Keyless systems can introduce entirely new threat vectors for hotel security operations to manage,” said Lee Clark, director of cyber threat intelligence production at the Retail and Hospitality Information Sharing and Analysis Center (RH-ISAC).
While Clark says these threats can be mitigated through security control policies and configurations, such as multi-factor authentication (MFA), these introduce additional steps that unsettled guests may not always want to jump through.
Clark says it's unlikely that all hotels will replace all key cards with digital keys anytime soon because some guests may prefer a key card or may not have a personal device compatible with digital lock systems, plus the cost.
“The switch to digital and keyless locking systems involves significant costs in equipment, installation, maintenance and security,” Clark said.
Hotel Chains Start Demanding Digital Key Systems
Human habits also remain an obstacle.
For example, data from a J.D. Power hotel survey found that only 14% of all guests at branded hotels used digital keys during their stay. Even guests who downloaded the brand’s app on their phones used a plastic key card.
According to JD Power data, among guests who have a hotel company/brand app, 30% use a digital key, and 70% use a plastic card most of the time.
On the other hand, many hotels have not installed locks capable of digital entry.
“Many major hotel chains, whose apps are likely to support digital keys, have begun requiring hotel franchisees to install new door locks as part of updated brand standards,” said Andrea Stokes, head of J.D. Power’s hospitality practice.
Despite slow adoption of digital options by customers, J.D. Power data shows that customers who use keyless cars feel safer than those who use plastic cards.
“Guests who use the digital key give much more positive ratings regarding the safety of the hotel than those who do not use the digital key,” Stokes said.
Chad Spinsky, CEO of Allthenticate, which develops smartphone access and credential management, compares the plastic key card to passwords, which cybersecurity professionals see as low-tech and outdated.
“We all still use passwords, despite glaring security vulnerabilities and an uncomfortable user experience. By the same token, key cards are likely to remain around,” Spinsky said.
The real promise of digital cards, he says, is not so much security as convenience.
“While card implementations aren’t more secure than their plastic counterparts, their user experience is far superior,” Spinsky said. If you have a choice between using a stack of plastic cards or your smartphone, “the phone is the clear winner.”
Consumer convenience is driving hotel chains to embrace digital keys. While digital keys provide an additional attack surface, they also allow for quick course correction.
One of the biggest problems with key cards, says Spinsky, is that when a vulnerability is discovered, there's no easy way to patch it. “On smartphones, patches can be released almost instantly over the air,” he said.
Don't throw away the plastic key card yet.
Mehmet Erdem, professor and chair of the Department of Resort, Gaming and Golf Management at the William F. Harrah School of Hospitality at the University of Las Vegas, warns that no system is foolproof and that people should not let digital access give them a false sense of security.
“Everything can be hacked, everything can be hacked. If someone has the intention to hack, it will happen,” Erdem said.
Plastic key cards shouldn’t be ruled out just yet, Erdem says. There are magnetic key cards that require swiping on a keypad, and newer RFID cards that simply require proximity or can be loaded onto a phone. And RFID technology is improving, making plastic keys more versatile, Erdem says.
RFID technology is not outdated, Erdem said, adding that it allows people who want less interaction to download the app, get the key, activate it and go into the room.
“Because of sustainability and cost, hotels will look to use mobile applications,” Erdem said, but added that some people will always prefer the physical plastic key. The advantage of the digital version of the plastic key is due to human nature, he said. “People forget their wallets, people forget their ID cards, but they don’t forget their phones.”
But in Las Vegas, where people routinely head to their hotel rooms loaded with jackpots from blackjack tables and slot machines, there's an old-fashioned, low-tech option that makes the door discussion pointless.
“There is always a safe in the room, and guests should use it if they have something very valuable,” Erdem said.
