Everybody Hates the Key Card. Will Your Phone Replace It?

https://www.nytimes.com/2019/07/24/travel/hotel-security-mobile-keys.html

Version 0 of 1.

The demonstration using the cellphone as a digital hotel room key didn’t quite go as planned. The hotel manager held his phone up to the room’s door lock and nothing happened. Realizing his Bluetooth was turned off, he tried again. Now the door’s sensor flashed green, while the phone screen informed him that the door was unlocked.

Like the majority of travelers, I had never before used a mobile hotel key, even though the first version of the system was installed nearly a decade ago. Today, about a million hotel rooms worldwide are estimated to have some version of a lock that can accept a cellphone-generated digital key, according to Nicolas Aznar, president of the Americas division of the Swedish-based lock maker Assa Abloy. Hotels are accelerating the installation of these systems to increase revenue, drive customers to their loyalty sites, and offer a better guest experience.

The locks also accept card keys, so many hoteliers are promoting the mobile keys as an optional perk for loyalty members: When combined with online check-in, guests in countries that don’t require a passport to be shown can go directly to their rooms without a stop at the front desk. And, since the keys are downloaded electronically through a hotel app, the host has a presence on the guests’ phones, and can offer other exclusive services, like promotions and a chat feature.

“Had my first hotel stay where human interaction was utterly unnecessary. Online booking, mobile check-in, mobile room key, and mobile check-out. I was a single smile and wave from not seeing a single hotel staff member my entire trip,” Victor Wieczorek wrote on Twitter under the handle @vwieczorek.

The number of hotels in the United States that have digital keys available rose from 6 percent in 2016 to 17 percent last year, according to a survey by the American Hotel & Lodging Association. Marriott International, Hilton, MGM Resorts and Disney hotels are among the brands offering loyalty members the option of using digital keys at some properties.

Some, including Hilton and Marriott, only allow a single phone to receive a key during a stay, and other guests in the room receive card keys. Like the card keys, the digital keys can be used to access elevators, fitness centers, parking garages and other common areas. Some mobile keys require the user to touch a button on their phone screen to unlock the door, while others require that the phone be held up to the lock.

Digital keys are hugely popular with travelers in some areas, like Silicon Valley, but overall, only about 10 percent of all hotel guests use them, Mr. Aznar estimated.

“Every new technology generates a little fear,” he said.

One of those who shied away during a recent trip was Lexi Galantino, 23, a San Francisco-based software engineer who specializes in protecting privacy. Ms. Galantino was set to try a digital key at a hotel in Kauai, Hawaii, in April, but as she was downloading the app, she opted instead for a card key.

“I was a little bit spooked by some of the security things,” she said.

Last year, the Finnish cybersecurity firm F-Secure Corp. revealed that after thousands of hours of work it had found a flaw in an older model RFID-style digital hotel lock that could allow hackers to create a spoof master key. It worked with Assa Abloy to patch the software, which was used in 42,000 properties in 166 countries, said Tomi Tuominen, of Helsinki, one of researchers. “We broke and then it got fixed,” he said.

It will take years to know if other digital locking systems are secure, since there are so many manufacturers using so many different technologies, he said. On top of that, there are potential vulnerabilities in the apps that are used to access the keys, and in guests’ phones themselves, he said.

Mr. Tuominen recommended staying with brand-name hotels because they have the resources to keep their locks up-to-date. He also reminded travelers to keep their own phones secure and to use the security chain when they are in their rooms.

One thing that’s certain, Mr. Tuominen said, is that plastic hotel keys with magnetic stripes are vulnerable.

“It’s a known fact that you can always clone a mag stripe,” he said. “Even if you don’t clone it, there are too many ways to target those type of locking systems.”

Marriott International expects to expand the use of its Mobile Key technology from the 1,800 hotels that currently have it available to its Bonvoy program members to all of its 7,000 properties by the end of 2020, said a spokesman, John Wolf.

Hilton has installed Digital Key for Honors members at more than 4,250 of its 5,700 properties worldwide over the past five years, said Nigel Glennie, a Hilton spokesman. There is no target date for completing the rollout, he said.

“Right now there is no chain that is not at least talking about it and trying to do something about it,” said Mr. Aznar of Assa Abloy.

One of those smaller chains, Pestana Group, was piloting a digital key at its Pestana CR7 hotel in Lisbon, Portugal, and demonstrated it to me on a recent visit. Currently available only for Android, it is downloaded through the hotel app, which also lets guests view on-site services, call an Uber, scroll through restaurant recommendations and purchase merchandise.

Even in countries like Portugal where guests have to show a passport to the front desk upon arrival, digital keys can still streamline the process, since there isn’t a delay while the front desk activates the card key. Hoteliers say the goal isn’t to have staff interact less with guests, but rather to have them focus on customer service. It isn’t all altruistic, however. By encouraging direct bookings through their apps, hotels cut out commissions and increase their profits. And, with the life of the average card key only 2.5 days, the cost of replacing them adds up.

The Lisbon hotel has only 83 rooms but purchased 1,430 card keys last year, the hotel manager, Eduardo Pedroso, said. He was excited about the environmental benefit of reducing plastic and paper waste by using fewer card keys and the folders they’re presented in.

Hilton, for instance, estimated that it has saved 40 tons of plastic through its 7.6 million Digital Key downloads so far, Mr. Glennie said.

For travelers, however, the biggest draw will likely be convenience, especially for weary road warriors and jet-lagged tourists who don’t want to wait in a queue to check in and get their room key.

“What is also great is that I don’t find myself forgetting my key in the room as I always have my phone with me,” said the Republican pollster and strategist Randall Gutermuth, 42, of Fairfax, Va.,

Follow Karen Schwartz on Twitter: @WanderWomanIsMe

52 PLACES AND MUCH, MUCH MORE Follow our 52 Places traveler, Sebastian Modak, on Instagram as he travels the world, and discover more Travel coverage by following us on Twitter and Facebook. And sign up for our Travel Dispatch newsletter: Each week you’ll receive tips on traveling smarter, stories on hot destinations and access to photos from all over the world.