UNMASKING Hotel Fraud

Internal Auditor, April, 2001 by Michael Barrier

WHEN FACED WITH FRAUD, HOTELS often must walk a fine line between exercising the necessary controls and meeting the strong imperatives of customer service. Take, for example, a guest who forgot to pick up a copy of his folio -- the record of the guest's charges and payments -- and calls the hotel's accounting department to ask that it be faxed to him. The hotel is happy to oblige and faxes the folio, which includes the guest's name, address, signature, and credit card number, to the number the guest provides. But what if the person who called wasn't the guest? If that's the case, the hotel has just given some stranger every piece of information needed to commit a crime.

One hotel suffered this type of fraud twice before initiating new controls. Now its computers don't print the entire credit card number on the folio, and the hotel no longer faxes folios to anyone, for any reason. Instead, the hotel will, upon request, mail a folio to the address on a reservation. Guests who want a fax may complain initially, but once a hotel employee explains the policy, the guests understand that they're being protected rather than inconvenienced. Customer service and controls against fraud are back in balance.

As this case demonstrates, certain kinds of fraud present special problems for hotels, and effective controls may have to be reconciled with customer service.

CREDIT CARD FRAUD

Counterfeit and stolen credit cards are a headache for businesses of all kinds, but hotels, like other businesses, can protect themselves by following the credit card companies' mandated procedures. However, hotels have another problem that John E. Nichols, vice president of internal audit for Starwood Hotels & Resorts Worldwide Inc. in Phoenix, describes as "the biggest issue I see in the hotel industry."

When a customer successfully challenges a credit card charge, the hotel -- frequently through an accounts-receivable clerk, or maybe through someone at the front desk -- issues a credit to the customer's card. However, sometimes the customer in whose name a credit is issued hasn't requested a refund, and the credit is actually going to the clerk's own credit card, rather than the customer's. "This has been going on quite a while," Nichols says. "Some of my peers have been stung for as much as $50,000 at their properties."

William R. Smith, vice president of internal audit at Wyndham International, a 300-hotel chain based in Dallas, agrees that credit card refunds have "a high potential for fraud" and outlines the basic procedure many hotels follow to prevent such crimes. "When it's decided to give a refund to a credit card, the transaction should be set up so that the voucher wherein the credit is given will reflect the credit card number to which that charge was applied," Smith explains. "We require that the credit voucher be supported by a copy of the original charge voucher. When the two documents are stapled together, obviously the credit card numbers must match. In this manner, you ensure that the credit is going back against the same credit card that was used to charge."

In addition, Smith says, "there has to be a review process. A transaction might take place at the front desk, but then, on a daily basis, all those transactions have to be reviewed by management. We require that any of those types of adjustments be routed to the executive staff of the hotel -- the general manager, the controller, the director of sales, and the front-office manager.

Nichols cautions that sometimes the person who transmits the credit is part of the problem. "You may have legitimate offset credits," he says, "and the controller signs off on them, but then this individual substitutes his own credit card when he transmits the credit." At Starwood, Nichols says, when an individual hotel submits credits to the credit card company, the company sends a fax-back confirmation. "That confirmation goes to the controller or the assistant controller, who then verifies that that credit matches the guest credit card number that they originally authorized the rebate against, and not to some strange new account," Nichols explains. "We require that credits be checked when they're going out and when they're coming back."

Hyatt Corporation, a IIO-hotel chain based in Chicago, also relies on daily fax reports of credit card transactions. "On a daily basis, the income auditor reviews that report against the actual settlement reports we get from the property-management system to be sure that the net total of each credit card deposit balances against the settlement summaries from the previous day," explains Brad Corson, director of accounting. "To the extent that somebody manipulates those by inserting a credit, we would see that in the total."

Additionally, "the fraud department of our credit-card processing company monitors all credit-type transactions," Corson says. "When there's anything of a significant nature, they will personally call the hotel controllers and alert them that there's been a submission on a particular credit card so that the hotel can evaluate and determine its appropriateness. They will also flag even minor credit transactions if they are repetitive on a particular card. They're looking for anomalies."