In this guide · 8 sections
Short answer
Put guest Wi-Fi on its own network, separate from the PMS and staff PCs. Give every staff member their own PMS and OTA extranet login with MFA, never a shared front-desk password. Take cards through a terminal or payment link, never by email or on paper, and delete passport copies once you no longer need them.
Why hotels are an easy target
A hotel combines things attackers want: identity documents, card payments, and a trusted channel to guests. The October 2026 police advisory on scams impersonating hotels and booking platforms showed how this is used against guests. Our guide to the hotel booking platform phishing scam covers that advisory and what to tell guests.
This page is about the systems behind it: the network, the logins and the front desk.
| Area | Typical weakness | Main fix |
|---|---|---|
| Guest Wi-Fi | Same network as the PMS and staff PCs | Separate guest network with client isolation |
| PMS | One shared front-desk login | Individual accounts with the right roles |
| OTA extranets | Password only, shared by several staff | MFA and named users |
| Front-desk email | Opens attachments from "guests" | Email filtering, training and a report button |
| Card payments | Card numbers written down or emailed | Terminal or payment link only |
| Guest data | Passport scans kept for years | Retention schedule and deletion |
Guest Wi-Fi: keep it on its own network
The most important network rule for a hotel is that guests never share a network with your business systems. A guest's infected laptop, or a guest trying their luck, should not be able to reach the PMS server, the card terminal or the back-office PC.
Network separation
Our guide to office network and Wi-Fi set-up explains VLANs and guest networks in more detail. If someone else installed your network, ask them to show you the separation working.
OTA extranet accounts and MFA
Booking.com, Agoda, Expedia and similar extranets let you change rates, read guest details and message guests. In the wrong hands, that message channel is exactly what scammers want, because guests trust it.
- Turn on two-factor authentication for every extranet user, using an authenticator app rather than SMS where offered.
- Give each staff member their own extranet login instead of sharing the owner's account.
- Review the user list monthly and remove anyone who has left.
- Only sign in by typing the extranet address or using a bookmark, never from a link in an email.
- Treat any email asking you to "verify" your extranet account or payment details as suspicious and check it in the extranet itself.
Front-desk phishing and malware
Front-desk staff open email from strangers as part of the job: booking requests, complaints, invoices, photos of "damage" or "lost items". Attackers use that. A message with a link to a supposed photo or a complaint document is an easy way to get malware onto a reception PC.
Safe habits at reception
- Ask guests to send details through the booking platform or a known contact
- Report suspicious emails with one click instead of deleting them
- Open shared files only from known services you already use
- Call back on the number in the booking, not the one in the email
Warning signs
- Urgent complaint with a link to "photos" or "evidence"
- Requests to install software or enable macros
- Login pages that open from an email link
- A "guest" asking to change payment details for a refund
Endpoint protection on every reception and back-office PC catches much of what slips through. Our guide to spotting a phishing email is a good short read for front-desk staff.
Card data at reception and guest data retention
The PCI Security Standards Council sets the card industry's data security rules. Its FAQ on requirement 3.3.1 says sensitive authentication data, including card security codes, must not be stored after authorisation, even if encrypted. For a small hotel, the simplest way to stay out of trouble is not to handle card numbers at all.
- Take payments on a card terminal, through your booking engine or by payment link.
- Never accept card numbers by email, WhatsApp or phone notes, and never write them on registration cards.
- Tell guests on your website and in confirmations that you will never ask for card details by message.
Guest data needs the same care under the PDPA. Keep passport copies and registration details only as long as your operations and legal record-keeping require, store them in the PMS rather than shared drives or email, and delete them on a schedule. If you suspect a breach, SingCERT's reporting and resources page is the place to report it, alongside your PDPA assessment.
Do it yourself or get help?
Turning on extranet MFA, creating individual PMS logins and writing a leaver checklist can all be done in an afternoon. Network separation is usually a job for whoever manages your router and access points. If you want a recognised baseline, CSA's Cyber Essentials mark covers many of these controls; our Cyber Essentials checklist maps them.
Our Security Health Check (S$290) gives a written, risk-ranked review of your domain, website, email and Microsoft 365 or Google Workspace settings. Security Awareness Training (S$390) sets up short monthly lessons for front-desk staff, and Antivirus & Endpoint Protection Rollout (S$390) protects up to 10 reception and office PCs on licences you own.
Frequently asked questions
No. Guest Wi-Fi should be a separate network, ideally a VLAN with client isolation and firewall rules that block access to staff PCs, the PMS and card terminals. A shared network lets any infected or malicious guest device reach your business systems.
They can, but they should not. A shared login hides who made which change, makes it hard to remove leavers, and is usually written down somewhere visible. Give each person their own account with the right role, and turn on MFA for managers and anyone with remote access.
Turn on two-factor authentication for every user, give each staff member their own login, review the user list monthly, and only sign in from a bookmark or typed address. Treat emails asking you to verify your account as suspicious and check inside the extranet itself.
Not by writing them down or storing them in email or spreadsheets. PCI DSS prohibits storing card security codes after authorisation. If you need to charge later, use your booking engine or payment gateway's card-on-file feature, which keeps card data with the provider rather than in your systems.
Only as long as your operations and any legal record-keeping require. Under the PDPA you should not keep personal data longer than needed for its purpose. Store copies in the PMS rather than email or shared drives, restrict who can view them, and delete them on a set schedule.