The fake front desk call: how the room phone scam works and how to stop it

A front desk scam is a call to a guest's room by someone claiming to be the front desk and asking for card details. The hotel already holds the card from check-in, so the request is always false. The defense is a connect rule at the switchboard and one sentence every guest reads and hears.

It is 04:00. The room phone rings and a calm voice says it is the front desk: the card on file is showing as invalid and the hotel is closing its books for the night. Nothing about the call is real except the phone in the guest's hand. After reading this you will know how the script works, the one rule that stops the caller at the switchboard, the sentence every guest should hear, and what to do in the first ten minutes after a guest reports a call.

How does the fake front desk call work?#

A caller reaches the guest's room phone, claims to be the front desk, and asks the guest to repeat card details the hotel would never need by phone. It works because the room phone is trusted and the request sounds like routine night work.

The call is timed for the night, when a card problem sounds plausible and the guest cannot easily walk down to check. The script has three moves: a problem, a small errand, then a favour. The guest is half asleep and the request is small, which is why this beats a cold call to a mobile.

The consumer blog of the Washington State Office of the Attorney General (opens in a new tab) (1 July 2011) described calls at 4 a.m. that woke 15 guests at a hotel in downtown Seattle, with the caller saying "This is the front desk" and claiming the card was coming up as invalid while the hotel closed out its books. The same post says the Hilton Garden Inn in Dallas was targeted around the same time, prompting a Better Business Bureau alert to businesses there. Treat this as a mechanism to prepare for, not a measured trend: no public data shows how often it happens in Türkiye, and this article claims none.

The tell is always the same: a real desk has the card from check-in or from the booking, so it never needs the number spoken aloud.

Why is connecting a call by room number alone a risk?#

Because a room number is not an identity. Anyone who can dial an extension can reach a stranger's bedside and claim to be staff, so the switchboard, not the guest, is where the front desk scam is stopped.

In the 2011 case the caller got in by dialling a direct extension and, when the call forwarded to voicemail, pressing the * (transfer) key and entering a random room number. The weakness sat in the phone system, not in the guest. The hotel reprogrammed its system, and the Washington Lodging Association, quoted in the post, recommended that hotels work with their phone service provider to protect against this type of scam.

The rule: connect an outside caller to a room only when they give the guest's full name and that name matches the room in your system. A room number on its own is never enough. Never confirm to an outside caller that a person is staying, which room they are in, or when they leave. Take a message instead: the caller's name and number, then the desk rings the room to say a message is waiting. The same rule covers the soft versions: "I am their driver", "I am calling from their office", "I am their tour guide". Give the receptionist one clear authority: they may refuse a connection without waking a manager to ask permission. This fits into a call standard for in-house guests, wake-up calls and messages.

What sentence should every guest read and hear?#

One line, said at check-in and printed in the room directory: the hotel will never ask for your card details by phone, and if someone does, hang up and call the desk.

Say it at check-in as part of the welcome talk, not as a warning about the neighbourhood but as a fact about how the hotel works. Print it in the in-room directory and, if you have one, on the key-card sleeve or in the guest app. Give the action, not only the prohibition: hang up, dial the desk from the room phone, and ask whether there is a problem with the card. The advice the Washington State Office of the Attorney General gave guests in its 1 July 2011 post was exactly this: do not give a credit card number over the phone, go to the front desk and ask whether there was a problem.

Translate it into the languages you actually serve, and keep the wording identical across them so staff can point at it. Keep it to one visible sentence: buried in a page of house rules, it is not read. The reason it holds is simple: the card is already on file from check-in, so a genuine desk has no reason to ask for the number again. For the wider picture of what to put in the in-room guest directory and in which languages, keep this line near the front.

A guest reports a call. What are the first steps?#

Take it seriously, write it down, send the guest to their own bank, and check whether the same caller reached other rooms.

Record the time, the room number, the caller's exact words and what the guest disclosed. Exact words matter later, in the incident log and in any report to the phone provider. If card details were given, the guest calls the number printed on the back of their own card, never a number the caller left. The hotel does not give banking advice beyond that. Ask the guest to check recent transactions and to follow whatever the bank instructs about blocking or replacing the card.

Tell the duty manager and log the report with the hotel's other security incidents, so a pattern can be seen across nights. Check the phone records: which extension was dialled, whether the transfer key was used, and whether the call came from outside or from another room. Offer to unplug the room phone for the rest of the night if the guest prefers, and make sure any wake-up call is delivered in person instead. The same verification habit should cover payment and bank-detail requests that arrive by any channel, not just the phone, as with verifying payment and bank-detail requests before acting on them.

When should the hotel warn every guest?#

When a call reaches more than one room, or when a guest has given details away. Warn the house the same night, in plain words, without describing the loss.

One call to one room where nothing was disclosed: handle it quietly, log it, and brief the desk for the rest of the shift. Two or more rooms, or one guest who gave card details: warn every occupied room and brief every station. Do not name the guest, the amount or the room; the warning is about the caller, not about a victim. Deliver it by the channel the guest will actually see at that hour: a note under the door, the room phone, or the guest app if it is in use.

If the calls continue, involve the phone provider and consider blocking outside direct-dial to rooms for the night, keeping named transfers open. Leave a written note for the morning shift and for the manager, so the decision is reviewed in daylight rather than repeated or reversed by accident.

How do you make the rule hold at 03:00?#

By putting the rule into the phone system and the shift routine, not into a memo the night team reads once and forgets.

Ask your phone service provider what stops an outside caller from dialling a room directly, and what the transfer key does on your system when a call forwards to voicemail. Then test it: have a colleague call from outside and try to reach a room by number alone. Whatever happens is your real policy, whatever the memo says. Print the connect rule on the desk card at every station, including the night desk and any back office phone that can transfer calls. Rehearse once a month: five minutes, one person plays the caller, the receptionist has to refuse the connection and take a message. Make the rule part of the night handover, next to keys, floats and pending arrivals, so it is spoken aloud every evening, and fit it into the wider night security routine rather than treating it as a separate subject. If you want the background, see what the hotel phone system still does and what to check.

What to do tonight#

Before the shift changes, write the connect rule on the desk card and say the guest sentence out loud at the handover. The scam needs three things to work: a caller who can reach a room, a guest who has never been told the hotel will not ask, and a desk with no rule to follow. Close any one of them and the call ends with a dial tone instead of a card number.