New key cards and locked room safes: checking who is asking

A new key card or an opened room safe is an authorization decision, not a service task: check the requester's identity against the reservation and an original ID document before anything is printed, and open a safe only with the guest present, two staff and a log line. Many hotels provide in-room safes as a standard amenity, especially in higher-category rooms.

At 23:40 a well-dressed person tells the front desk they lost their card and gives room 214. Nothing in that sentence proves anything, yet the next action opens a stranger's door. This article gives you the check that runs before any hotel key card replacement, the two-person rule for opening a room safe, and the log that protects the hotel months later. It is written for front desk agents, duty managers and technical staff, and it can be lifted almost word for word into your procedures.

Why is "I lost my card, room 214" the riskiest sentence at the front desk?#

Because the sentence contains no proof, and the answer to it is physical access to a room. A room number is printed on a door, spoken in the lobby and written on a luggage tag.

Reframe the request before you act. The question is not "does this person need a card" but "is this person entitled to enter that room". The first is service, the second is authorization, and only the second one decides what happens next.

Weigh the two errors honestly. A wrong refusal costs a few minutes and an apology. A wrong yes costs a burglary, a police report, a damaged guest relationship and a liability argument that turns on your records. The asymmetry is the whole reason the procedure exists.

Expect pressure and do not let it move the procedure: urgency, irritation, a first name dropped, a phone call claiming to be from the manager. Tone is not evidence. For example, a person may say their partner holds the second card and is asleep inside; that is a plausible story, not a verification. The same test applies to the safe. A guest locked out of the room safe is the same request with the guest's valuables behind the door, so the rule gets stricter, not looser.

Say what you are doing while you do it. "I will check the reservation and your ID" is a complete sentence, and it closes most attempts without confrontation.

The mechanics behind the desk, from key cards and encoders to how the door lock connects to the PMS, decide what you can cancel and reissue; the check decides whether you should.

What do you check before printing a new key card?#

Three things, in this order: the reservation record, an original identity document, and the name on the booking. If any of the three does not match, no card is printed.

The reservation record is the authority, not the requester's confidence. Read the name, the stay dates, the room and the number of guests on the booking before you look up. Ask, do not read out: "Can you give me the name on the reservation and the departure date?" tells you far more than reciting details back to a stranger.

Check an original identity document, not a photograph on a phone. Whether you may copy the document is a personal data question for your adviser, so decide the practice once with them and write it down. If the identity document is inside the room, do not print a card: escort the person with a master key under the two-person rule, or ask for another document. Cancel the old card at the encoder where your system allows it, and check whether the lock needs the new card presented before the old one stops working.

Write the log line at the moment of issue, not at the end of the shift: time, room, requester, document type, staff member, reason. This sits inside the wider flow described in the front desk check-in steps, checks and records.

What about companions, children and visitors who ask for a card?#

One card per registered guest is the default. A companion becomes a companion only when the registered guest has added the name to the reservation, and a visitor never gets a card at all.

Adding a name is an act by the registered guest, not by the person asking. Record who authorized it, when, and which staff member made the change. Hand a child's card to the adult responsible for them and note it on the room; a minor alone at the desk is a conversation for the duty manager.

Visitors wait in the lobby. The guest comes down, or staff escort the visitor and stay in the room for the visit. Group and tour leaders hold cards only for the rooms on their rooming list, and the scope should be written on the group file so the night shift does not have to guess. Corporate bookers and travel agencies can pay for a room and cannot receive a card for it; say this once, plainly, at contract stage. "I only need to pick something up" is handled by staff: staff open the door, staff wait, staff lock it again. The visitor never holds the card.

Who may open a locked room safe, and how?#

Two people, one of them a duty manager, with the guest identified and present, and a log line written before the safe is opened. Any other combination is an exception that someone must justify in writing.

Know why the safe exists. Three-star hotels must have a valuables safe in the rooms under the Tourism Facilities Regulation (Presidential Decision No. 1134, Article 19(4)(ç)), and four- and five-star hotels inherit the three-star requirements (Article 19(5) and (6)), so the in-room safe reaches them too. Article 19 does not list one for one- and two-star hotels. The consolidated text is published by the Presidency's legislation information system (mevzuat.gov.tr, 2026).

Let the guest try first. Many locked safes are a flat battery, a forgotten code or a door pushed shut. Offer only the reset the manufacturer documents, never a workaround. Identify before you open, exactly as for a card: reservation plus original identity document. The safe holds valuables, so the check is not optional.

Two people, two roles: one operates, one witnesses, and both sign the log line. The witness is not the person who fetched the code. The guest watches the door, not the keypad: never let a guest see the master code being entered, and never explain the opening method afterwards. If the guest cannot prove identity because the document is inside the safe, stop. Escalate to the duty manager and agree a documented alternative; do not open on a story.

The safe sits inside the wider world of master keys, store keys and the key log; the same discipline covers both.

Where are the master codes kept, and what goes in the safe log?#

With named holders, under seal, in a manager's safe, and every use is written in a log that a second person reads each month.

Name the holders in writing: usually the general manager, the chief engineer and the duty manager on shift. Review the list the day someone leaves, not at the next audit. Keep the code in a sealed envelope inside a manager's safe, record the seal number, and re-seal and re-sign after each use. A code that lives in a drawer is not controlled.

Change the code when a holder leaves, when a device is replaced, and on a fixed calendar: three triggers, one owner. No code at the front desk, on a note under the keyboard, in a messaging group or in the room folder. If a guest can find it, it is not a master code. Technicians work with a staff member present, and staff enter the code; a service visit is not a reason to hand the code over.

The monthly review#

The monthly review reads the log for patterns: openings without a guest present, openings with one signature, repeat rooms, repeat staff, and card reissues that cluster on one shift. A pattern is not proof of wrongdoing, but it is the earliest signal you will get. This review belongs inside the hotel's general security routine, alongside organizing hotel security from the entrance to the night shift.

Why does the record matter if something is reported missing later?#

Because the law makes the operator liable for guests' items, and the hotel's defence is what it can prove about its own care. The log is that proof.

Under the Turkish Code of Obligations (Law No. 6098, Articles 576 to 580), operators of hotels and similar places are liable for the loss, damage or theft of items guests bring, as set out in the consolidated text published by mevzuat.gov.tr (2026). They escape liability if they prove the damage came from the guest's fault, a visitor's or companion's fault, force majeure, or the nature of the item (Article 576). Unless the operator or its staff are at fault, liability per guest may not exceed three times the daily accommodation price (Article 576).

For valuables, considerable sums or securities not left with the operator for safekeeping, the operator is liable only if it or its staff are at fault; if it took them for safekeeping, or refused to take them, it is liable for their full value (Article 577). A guest who does not notify the operator as soon as they learn of the damage loses the claim (within the same Articles 576 to 580), and an operator cannot escape liability by announcing that it accepts none (Article 578).

Whether an in-room safe counts as leaving valuables with the operator for safekeeping is a legal question for your lawyer. Do not settle it at the desk, and do not promise an outcome to a guest. When something is reported missing, the log answers the first four questions: who asked, what was checked, who acted, who witnessed. Without it, the hotel argues from memory. The background on hotel liability for guests' belongings, safes and the Code of Obligations and the contents of an incident report after a theft or a dispute fill out the rest of that process.

What to do next#

Write two one-page procedures, one for reissuing a card and one for opening a safe, and put the log sheet next to the encoder where the work happens. The parts fit in that order: the sentence at the desk is the risk, identity plus reservation is the check, two people and a signature is the control, and the log is what protects the hotel months later.