🛎️

Front-Desk Red Flags Card

Printable one-pager · Pakistan edition · maahir.io cheat sheets

MAAHIR
CHEAT SHEET

🚩 Red flags at the front desk — stop and verify

Urgency + secrecy: "do it now", "don't tell anyone", "the audit is tomorrow" — real owners and real vendors survive a callback.
Reservation email with a login link or card-request link: OTA confirmations arrive inside the booking site's own message system — a "re-verify your account" link is the published account-takeover lure.
"GM / owner" asking for a transfer: urgent IBAN/payment change, new beneficiary, pressure before morning — classic BEC. Verify on a known number, never the one in the email.
Caller claims to be the owner (vishing): caller-ID can be faked. Verify with a known number or the designated contact method agreed with management.
Anyone asking for a guest's room number, phone or presence: no guest details by phone, ever — take a message, let the guest decide.
Vendor demanding immediate remote access to the PMS: no ticket, no callback, all pressure — the published MGM ransomware case began with social-engineered access like this.

💳 Card rules — non-negotiable

NEVER write down, photograph, email or store a CVV or a full card number — not on paper, not in WhatsApp, not in the PMS notes field.
NEVER read out or accept card numbers by phone for "verification" — the front desk never needs a guest's card details read aloud. Follow your hotel's PCI policy.
Cards belong in the payment terminal (point-to-point encrypted), not in email threads, photos or POS bridges.
If a "guest" insists on sending card details by email or chat: delete, do not forward, and ask for card-present or proper remote payment instead.

🛂 Guest privacy rules

Collect ID (CNIC/passport) only as required by hotel check-in law, store the minimum for the minimum time, under lock/permission.
NEVER photograph a guest's ID or card for personal use; NEVER post guest names, rooms, bills or photos on social media.
Clean desk: ID copies, folios and registration cards face-down or in drawers; screen locked (Win+L) every time you step away — even "just a minute".
Shared terminals: your own login only, no shared passwords on sticky notes, log out at shift handover.

🚨 Breach — first 3 steps

✓	Step	Do this
	1. Isolate	Unplug/disconnect the affected system from the network — do NOT power off, wipe or "clean" it. If ransomware: isolate and never pay.
	2. Call	Escalate to management/IT immediately, then report to NCCIA (cybercrime helpline 1991 — verify on nccia.gov.pk); involve your bank and card schemes if card data may be exposed.
	3. Preserve	Keep everything as-is: ransom notes, strange emails, log files, timestamps. Screenshot before changing anything. Evidence first, cleanup later.

Print for every shift. Keep one card at each terminal and one in the back office. This card's web version lives at maahir.io/sheet/front-desk-red-flags — QR-code that URL for laminated copies and training boards. Follow your hotel's own security and PCI policy wherever it is stricter. Verify all helplines on official websites.