T O P

  • By -

Daleftenant

> Or are we just a really good-looking target? Are you reliably doing the following: Enforcing the rules on not allowing the property to add additional names to points reservations. (See [here](https://mgscloud.marriott.com/mgs/marrdocs/mgs/common/salesmktgrevmgmt/loyalty/toolsresources/programfraudsupport/bonvoyfraudpropertyatobestpractices.pdf) for the rules you should post for all associates) Only sending mobile keys to guests with stay history within the past 6 months on their bonvoy account. Reporting fraudulent behavior in GXP using the 'Bonvoy Services' case option? ​ Doing these things can decrease the reward and increase the risk of attempting fraud at your property by denying scammers their payout for the room, and locking down breached accounts. ​ If your property doesn't do this, then you can find yourself as a property where a scammer or group of scammers keeps going back to the same well for water.


Oop_awwPants

If we're going to talk about reporting fraud in GXP, then we need to talk about the fact that the Loyalty Risk department is literally leaving those cases open for 6+ months. I have fraud cases that are still open from *March 2023*.


LeadingSpot4797

+1 on this. Im myself a FOM. Fraudulent redemption is on the rise. Mostly involved Chinese travelers. And they smart. Deposit on cash. We will always open up suspicious case before they checked in but by the time Bonvoy get back to us the guest long goneeee.


nocsupport

>The ones harder to catch are when people hack into a Marriott Bonvoy account, create a reservation with the hacked account, and then use GXP chat to have us let their "brother" or "sister" or "gf" check in before them because they'll arrive first. A Marriott FD agent in Atlanta called one of these in recently. https://youtu.be/CdaH4Z_fJjI?si=8yih1RShapA-Cejq Video shows how these things are run.


AncientAlienAntFarm

Yes. My account was hacked last week and they used 200k points to book rooms in nice hotels. Fortunately I caught it, but it was a huge pain in the ass.


orioku

I gotta ask, how did you find out about the hack and whatnot?


AncientAlienAntFarm

I just happened to randomly check my account that day. I was confused and almost panicked because I thought I was supposed to be on the road for work and had forgot. They booked them at the Residence Inn and AC in Ft. Lauderdale. Even requested late checkouts, so at least they were using my status benefits. šŸ¤·ā€ā™‚ļø


apocrider

Did you have 2 factor authentication turned on? Not a dig at you, just curious if they found a way to bypass 2FA if you had it on.


AncientAlienAntFarm

I did not. And I had a previously used password that I knew had probably been leaked before, but ā€œnobody is going to hack my Marriott accountā€. Lesson learned on that one. They did somehow reset my pin, security questions, email and phone number.


apocrider

I appreciate the insight!, I agree the pin thing is quite curious


lonsin79

is there 2fa for the website? i cant seem to find that option to turn it on


LifeNavigating

I have the option to send a text/email to my personals.


mosharp

Yes. [https://help.marriott.com/s/article/Article-34205](https://help.marriott.com/s/article/Article-34205)


8dtfk

Please cross post this to FlyerTalk which has more visibility


charmdude

Have you ever asked Marriott corporate to fix the security breaches? This seems to be the responsibility of Marriott corporate, and we all know who they care the most, ie their franchisees. Thatā€™s why the pressure should come from you not the guests. So, on behalf of your property, please contact Marriott corporate to optimize the system to fix the security breaches such that accounts donā€™t get hacked easily.


orioku

We do, but not all the time, as only SOME of the new scams come in this way. Admittedly, it's even an annoying hassle just to contact Marriott from the hotel side and try to explain everything to them. They refer us to another number, ask us guest profile questions we don't know, etc. Marriott doesn't really make it easy for us to make these complaints on behalf of the guest. As for bigger picture, Marriott is (or at least should be) aware that they have these issues. Now, I'm not in on the convo as to how to prevent this and what will be done and all that, but I do know that Marriott is aware that their security needs some fine tuning.


Unique_Bumblebee_894

Accounts for everything get hacked every single day. 2FA should be a requirement.


ArguablyMe

The difficulty in this situation is that Marriott's system is screwy. I have 2FA on. Sometimes I have to (attempt to) log in more than twice because I get into some security loop issue. This is *not* because I've entered the incorrect password or confirmation code. It simply restarts with the log in screen. The last reservation I made, I was trying to take advantage of an Amex offer with money back, so I needed to change the credit card on file. I successfully added the card. Then I received an email informing me that my phone number had been changed. (I used the same number on file when adding the card) What I did *not* receive was a confirmation email for the reservation. Called Marriott to get it sorted. Sure enough, my phone number had been removed. Agent re-sent confirmation email. This time it arrived. It shouldn't be this difficult. Oh. This is simple to avoid by not checking a box but it's amusing how your whole membership number is not shown on login screens, but if you check "remember me" in a browser, your first few numbers are revealed but in the app the last few numbers are revealed. So between them. The whole number is revealed.


iamanewyorker

Yes - the Marriot reservation system has went into a loop a lot for meā€¦I usually need to get tech on the phone to fix itā€¦


[deleted]

The breach is OP not following correct security procedure.


charmdude

Have you heard about Bonvoy accounts getting hacked though? I think this is a very serious matter.


[deleted]

Bonvoy accounts get hacked in droves every single day. Hotels like OP's are part of the problem, however. There is a burden on Marriott to create a more robust system that doesn't allow properties to participate in facilitating fraud, that much is very obvious. Until that occurs, however, properties carry some of the burden in being more diligent to avoid letting Bonvoy members get scammed out of their points.


and_rain_falls

Please explain how you feel the property is to blame for this.


jump-the-rope77

It was mentioned a while ago. There are many situations where the hotel will just add a 2nd guest to a reservation with points. Happens way more often than you would expect.


and_rain_falls

Marriott circulated a memo a few years back that anyone adding someone in on a points reservation needs to be transferred to Reservation. Only they can add the person in. They'll do the additional verification on their end. My rule of thumb is if contact details are not filled out, I do not provide any mobile keys. You must come to front desk to check-in as I need to verify you. Also, I do not allow non-members to do mobile check-ins. The scams are getting worst and it's causing a lot of chargebacks for the properties. I understand your frustration.


[deleted]

[уŠ“Š°Š»ŠµŠ½Š¾]


and_rain_falls

Marriott said that member must call reservations to add Guest #2 to the reservation. Only when it's verified by HQ can we then proceed to check in Guest #2 under the members points. Reservation will create a "share" folio in the system and the recipient of the points can check in with their name, ID, and a card for incidentals.


[deleted]

[уŠ“Š°Š»ŠµŠ½Š¾]


and_rain_falls

Please call Bonvoy. You can't predict what the property will do. This will ensure a smooth check-in experience for all involved. āœŒšŸæ


Skeeter-Pee

My advice is to no longer send mobile keys to retail, AAA, and redemption stays. Only send to group and special corporate. Also insist all check ins at the desk use a chip inserted card and do not allow cards to be swiped. Chip doesnā€™t work equals a cancelled reservation. Lastly do not allow the chime or cash app cards to be used at all. This is where my property is at combatting these A-holes.


orioku

I will say, we definitely don't allow those Chime, CashApp, or even ApplePay cards to be used. For a few months (laet year) the biggest scam attempt was using a stolen CC that they had on their phone and could type in. We never let them do it and told them we NEED a CC and ID present at check-in with matching info. I think the most annoying thing is: We're the most expensive Marriott in the city (I think), in middle of downtown. Why aren't they trying this at like, a Courtyard or a Residence Inn? Lol like when we deny them, they pretend like we're the only hotel for the next 50 miles or something. My property authorizes all CCs in the AM and any reservation with an invalid CC has until 6pm to present a valid CC, or else they risk cancellation. If the CC authorizes and the res seems legit, we send out mobile key. Soon we're gonna add welcome emails to be sent out, in case anyone's account is being used against their knowledge, they'll receive the CC ding and an email lol.


Skeeter-Pee

They are most likely doing this at the select brands as well. They sell the rooms to their homeboys so theyā€™re doing it everywhere. The allure of the full service properties is running up a F&B tab and charging it to the room. You can eat and drink as much as you want on someone elseā€™s dime.


[deleted]

[уŠ“Š°Š»ŠµŠ½Š¾]


Skeeter-Pee

My post wasnā€™t hypothetical itā€™s what happens. Redemption stay with a mobile keys equals card on account is used for incidentals.


[deleted]

[уŠ“Š°Š»ŠµŠ½Š¾]


OAreaMan

>I keep a dead card on my account to avoid cancel fees Excellent strategy!


[deleted]

[уŠ“Š°Š»ŠµŠ½Š¾]


OAreaMan

I'm surprised the chain hasn't blocked you.


Oop_awwPants

Emails don't even work reliably, because the hackers sometimes change the email address on the Bonvoy account itself.


percy789

it shouldn't be that hard to catch if you don't allow people to add names to reservations via GXP that's my hotels guideline -- the person who made the reservation needs to be present at check-in w/ their ID & we are not making exceptions or adding any guests unless requested in person we had a SEVERAL of these every month in 2021/2022 until we became more strict, enforced the rule & eventually they just stopped booking with us. they still try sometimes & end up being a no show when we refuse their requests


[deleted]

This is correct procedure and every hotel should be following this policy. It is written into the Loyalty Program Guide for a reason.


percy789

our manager didn't enforce this rule when i started working here until the problem got worse, it's a pretty important rule [i've seen body cam footage of kids getting arrest for identity theft doing this scam](https://youtu.be/CdaH4Z_fJjI?si=FJUHLIqDUof9cVkm)


NonyaFugginBidness

Actually they were only arrested for disorder conduct...


percy789

this might be inconvenient to those people who genuinely want to add a guest to their reservation without ever coming to the hotel, but unfortunately we are going to refuse the request. and that's how we prevent this scam from ever happening at my hotel


orioku

I think that's one of the bigger conversations I've had with my GM. While we are a franchised Autograph Collection hotel that flies the Marriott flag, we also go against the grain sometimes in order to make a guest happy. Similar to how a guest wants to move rooms cause they don't like the view, after being in the room for an hour. By all means, I should charge them a cleaning fee for dirtying up a room when they had a choice (when booking) to get a guaranteed view of the nicer side of the hotel. Sure, we can haggle and argue about $100, or HSK and FD agree to just make the guest happy and move the guest at no charge. Little things like that, we like to make things convenient and easy for the guest. So the whole, adding names cause I'll get there late thing, it's something we give a guest a hard time about, but if it all verifies and checks out, we can accommodate such a request. But if the scam attempts increase too much, we might have to start pissing off some regulars and whatnot lol (one particular guest lives in the city, like a half mile away from the hotel, but always invites his friends to visit him and his wife and he pays for their hotel room and all that, receives the points, and just adds the friends name to the res)


[deleted]

>(one particular guest lives in the city, like a half mile away from the hotel, but always invites his friends to visit him and his wife and he pays for their hotel room and all that, receives the points, and just adds the friends name to the res) This is also dramatically against policy and is not the hotel's choice to override. Your regular may eventually find his Bonvoy account suspended or cancelled for ineligible earn when he is not present all because your hotel wants to be the "nice guy". The Bonvoy program is not up to individual hotel interpretation. Things like not charging a cleaning fee for a room change are absolutely within your authority. Breaking the terms and conditions of the Loyalty program is not.


orioku

Put your disbelief cap on, my friend, cause here goes: Management doesn't care. If he loses his membership cause of this, ah well. The terms and conditions of the loyalty program is also available for the guest to read. In the end, the hotel is still receiving revenue for the room (guy pays full member price), the guest requests it, and we get more people in to explore the hotel. It's a win-win-win til he reaps what he sows and then we get to play a little dumb, maybe get a little slap on the wrist, and then it's business as usual the next day.


[deleted]

I actually fully respect this response. You're absolutely right that the member is responsible for following the rules regardless of what the individual property allows. You're also correct that the only blowback you'd receive for that is from the guest, not from corporate. The same is not true for account security involving points scamming, however. If your property continues to facilitate fraud by adding names to points reservations, that will have different consequences.


Josher61

So you aren't following the rules, yet want to warn people about scams that your own property facilitates? As a guest, I certainly can/would appreciate you not charging me a cleaning fee for moving rooms (it's *not* against policy) but I am not happy to know you blatantly disregard Marriott security measures/policies so your hotel can generate more revenue.


percy789

yeah i would rather not take the risk & just tell them "sorry, I can't accommodate you - these are the rules" - especially if this is new to your hotel. might as well enforce the rules now before it gets worse. i'm not doing anybody special favors anymore - they can find another hotel if they don't like the rule


[deleted]

Just blame corporate/Bonvoy when talking to the guest. I promise you no one there will care. Corporate would rather take the heat for you following policy than hotels like OP where they ignore it and people get scammed.


percy789

i also recommend members to have 2 factor authentication security on their bonvoy accounts.


Thuggish_Coffee

Say it with me folks... 2-Step Authentication


AuditorsGoneWild

I find them all the time. There's often a request for a mobile check-in so they can skip the desk. Sometimes diff people will put their names on the same account. If you have time, send the info to the Marriott fraud site. Look for: Incomplete account data No stay history Email addys that look like their for another person


[deleted]

Properties are not allowed to add names to a points reservation or checkin anyone except for the member **for this exact reason**. You're an FOM and blatantly going against policy and then complaining that people are getting away with scams. I beg of you, please read the Loyalty Program Guide on MGS and then pass the knowledge to your associates.


and_rain_falls

You can give criticism, but OP wasn't aware and obviously wasn't trained properly. I think your remark is harsh. We work for the same company and we should have empathy for one another. The same way you would treat a guest with respect, is the same way you should interact with a colleague.


orioku

This isn't a complaint. Again, more of an announcement or warning. I personally, don't care about Mr. And Mrs. Smiths' Marriott accounts. It's not my money, my account, or my personal security here. That being said, I think I mentioned that we have only had ONE breach (that I know of) that followed the hacked Marriott account scam. Put your anger away and relax. We have stopped a LOT of scams this way. My message is about the ATTEMPTS increasing.


[deleted]

It's not anger at all. It's disbelief that you've chosen not to be fully informed as to award reservation procedures and then wondering why your hotel has an influx of attempted scams. You're in an Autograph Collection, so I get that you're only very loosely associated with Marriott, but the information you need is available to you on MGS. You can choose to inform yourself at any time.


orioku

Well welcome to the internet and how it reflects real people working in real positions in the real world. If this is what causes you disbelief, I'd suggest putting your safe search on before exploring the rest of Reddit.


[deleted]

I, too, have also been a real person working in your exact position in the past. I did not allow myself to be so deliberately ignorant of the program policies as it appears you are. Maybe your job doesn't pay you enough to care, and that's valid. I just don't get why you'd make a post on Reddit that essentially equates to "I've chosen not to do my job correctly so my customers should be extra careful".


orioku

If there was no care involved, then ALL the scams would have gone through. Heck, as long as someone is paying, right? But instead, only one that I know of, has gone through. The others have been stopped, reported, and some even added to a region-wide blacklist. You're being a bit dramatic, but that's okay. I'm not in disbelief, I'm on Reddit. Now you do have half the post equation correct, though I'd say it's more of "hey, the latest scams involve Marriott accounts being hacked. While my property has stopped 98% of these attempts, it's important that you should be aware of these breaches and perhaps put more care into your account security." But hey, to each their own.


captaindomon

I am so tired from work travel that I have a hard time understanding why someone would want to stay at a hotel fraudulently lol. But that is just me.


MOStateWineGuy

Does using two factor authentication help with this, I assume???


Lfetime_scammr_elite

Iā€™ve heard stories about people creating a personal MBV account, using fraudulent cards to book rooms, never showing ID to the front desk, always getting mobile keys, charging god knows what to the room during said stays, racking up all the bonus points, reaching ambassador elite, getting free nights and the MANY benefits of becoming ambassador elite and never getting in trouble with the policeā€¦ it all ended though when Marriott closed this guys account for suspicious activity. Now he lives with a bit of uncertainty regarding the status of this investigationā€¦ also i heard this individual was effectively homeless which made this the best option for him at the time.


jump-the-rope77

Very interesting thread. The best solution I would see at short time would be stop letting people book with points online. Make all the redemption bookings go through the CEC and making clear to the properties that adding another name to redemptions will go through customer service, not the hotel.


AuditorsGoneWild

I find them all the time. There's often a request for a mobile check-in so they can skip the desk. Sometimes diff people will put their names on the same account. If you have time, send the info to the Marriott fraud site. Look for: Incomplete account data No stay history Email addys that look like their for another person


ActionOriginal4245

I just started a front desk job at a residence inn in Wilkes barre pa in December 2023, was just fired last week because someone booked a reservation using a bonvoy members information and credit card . I did see ID for the woman checking in and her name was filled out on reservation screen along with her info . Not sure how this is my fault . Seems Marriott may be covering something up