ATLANTA (WXIA) – Putting your valuables and your trust in a hotel safe may leave you with neither, according to a series of tests conducted by the 11Alive Investigators.
We checked into half a dozen hotels in four states across the nation and tested in-room safes from multiple manufacturers. We put a wallet and some cash inside the safes, then locked them with a random code we intentionally failed to write down or remember. We asked hotel staff members to get into the locked safes.
In one case, a housekeeping supervisor volunteered to enter the hotel's master code into the safe while we were in a friend's room with the door open. She never asked for identification and entered the secret code in front of us. We successfully used that master code to override our own code on the safe in the next room.
Master Code
Hotel safes come from the factory will a very simple universal master code. We found the factory codes for two popular hotel safes in several places on the internet, but they also appear in the owner manuals that come with the safe.
The 11Alive Investigators ordered a hotel safe online and it came with a set of master keys and the manual with the universal master code. While the manual strongly urges the owner to change the master code, not all owners do according to security experts.
"Many times the master code is never changed. It's the same master code for all the safes, and that master code is available on the internet believe it or not, and just about anybody can go out there and pick up a master code for a safe," said Andrew Hayter with global software security company G Data.
G Data also ordered a hotel safe online and dissected it. Researchers found several vulnerabilities including the master code, a master key hole hidden behind the removable nameplate, and a credit card slot for a master magnetic card.
That give the hotel staff at least three ways to get into the safe.
A hotel guest can use the magnetic card slot to lock and unlock the safe, but the G Data team demonstrated that a card skimmer could be installed to get into the safe and steal the guest's credit card number. "You're giving away not only access to the valuables in that safe, but you're also giving away your credit card information" if there's a card skimmer, Hayter added.
Master Keys
Mike Moske, a private investigator with On the Watch Investigations, is more concerned by the potential number of master keys floating around a hotel. "If that key gets out or everybody's got a copy of it, why even have the safe?" Moske said.
Moske has worked in hotel security for 26 years, including large resort hotels with more than a thousand rooms. With each safe coming with a pair of master keys, there could be two thousand master keys in a single hotel. He says controlling access to those master keys is paramount, which is harder when there's a master code that can be shared and remembered by current and former hotel staff members.
An Inside Job?
"Probably about 60 percent or 70 percent" of hotel theft is an inside job, Moske said.
The hotel staff needs access to your room for maintenance and cleaning. That's why they have master keys. Some hotel room doors record which staff member used their master card to enter, but not all record that information.
If the staff can get into your locked room and your locked safe – and most hotel theft comes from the staff – what good is the safe?
The 11Alive Investigators set up a simple test by asking staff members to get into our locked safes. Not one hotel staff member asked us for identification before opening the safes. They all assumed we were the guest and not an imposter.
In that first example where the housekeeping supervisor entered the master code for all the room safes right in front us, we could have walked out of the hotel room with the entire safe. It wasn't bolted to the floor or the wall – it was attached to a small bedside table with two tiny wood screws.
In another hotel the safe was attached to a steel frame bolted to the floor, but the nuts and bolts holding the safe were exposed outside the locked safe and could have been removed easily with a single tool.
In that hotel, the front desk sent a maintenance man to help us get into our locked safe. He opened it within 10 seconds of entering the room. He used the hotel's master code, again entering it in front of us. We tested the code and were able to successfully override our own combination several times after he left the room.
Only one hotel we tested sent a uniformed security guard to unlock the safe. It was the most luxurious of the hotels we booked, and the hotel had deactivated the master code function we found on similar safes. The security guard was able to gain access to the safe within seconds, but had to use a special device connected to the control panel with a data cable. G Data said that was an additional vulnerability because hackers could connect to the same data port to override the electronic lock.
The security guard did not ask for my identification before opening the safe, and turned down my offer to show an ID. One explanation is that guests who forget their combinations often lock their wallets or purses inside, preventing them from showing an ID to the staff.
Protect Yourself
In most states the hotel is not liable for theft from your room, even if you lock things in the room safe provided by the hotel. The hotel actually tells you, right on the little card on the back of the hotel room door. Checking your items with the front desk will generally leave the hotel responsible for loss or theft subject to state limits.
There are several methods to make sure your valuables are safe when traveling.
We found a number of security products for sale online including fashion banker's bags with cable locks. Those soft-sided security bags are great for securing valuables and small electronics in hotel rooms, at the pool or on the beach when the cable lock is attached to something bolted down
There are also special locks that go over the safe door preventing someone from opening the safe even if they have a master key, master code, or master magnetic card.
Mike Moske, the private investigator, suggests a low-tech solution. Placing the do-not-disturb sign outside the door when leaving your hotel room for the day tells the staff you're still inside. Leaving the television on with the volume at a moderate level also tells would-be thieves you might be inside. The trade off is that the housekeeping staff will not be able to clean the room if you leave the do-not-disturb sign out all day.
Better yet, Moske said, leave your valuables at home. "If you don't need it, don't bring it. If you don't need that $10,000 ring, leave it home," Moske said.
