The hidden revenue leak at your front desk

Why hospitality leaders need to rethink card tokens, not just their payment stack.

Ask a hotel's finance team why their currency conversion revenue never matches the forecast, and you'll get a shrug. Ask the front desk why check-in feels faster than ever, and you'll get a smile. 

Put those two answers side by side and you've found a problem I keep running into, across almost every hospitality customer I talk to: a huge amount of eligible international volume is quietly slipping through the net, and hardly anyone in the building realises it's happening. 

It isn't a technology problem. The tools to fix it already exist. It's a process problem, one that can often be addressed through better training and operational consistency, and it's causing hotel groups to lose hundreds of thousands of euros a year in potential revenue.

The moment nobody notices

Here's the scenario, and I promise you it plays out thousands of times a day. A guest books a room online; direct, or through an OTA like booking.com or Hotels.com, and chooses to pay on arrival rather than prepay. As part of that booking, their card is tokenised so the hotel has a way to charge them for a no-show. Completely standard. Completely reasonable.

The guest arrives. Card in wallet, ready to check in. And the person at the desk says, in effect: don't worry, we've already got your details on file, shall we just use those? One click, and the guest is checked in without ever presenting their card. It feels like a great, frictionless service.

What's actually happened is that what could have been a fully authenticated transaction has been quietly downgraded to a MOTO transaction, card data passed through without the security data that would normally travel with it. Interchange goes up. The hotel loses any chargeback protection. And because the card was never re-presented, there was never an opportunity to offer that guest the choice to pay in their own currency, one of the more reliable revenue-generating margins a hotel has.

We're also seeing the downstream cost of this rise: guests who know their stay was charged off a token, with no authentication, are increasingly disputing valid charges. Even when the hotel has done nothing wrong, the scheme rules say an unauthenticated transaction has no chargeback liability protection, so the hotel loses the dispute anyway.

What this actually costs: A real, anonymised customer example

Table: Total annual benefit of fixing the front-desk flow: over €800,000, for one property group, from one change in behaviour at check-in. No new customers required. The volume is already walking through the door. 

The fix is genuinely simple

At check-in, ask the guest to present their card; insert, tap, or full authentication at the check in desk, instead of reusing the booking token. Or, for a frictionless option that avoids a queue at the desk entirely, send a secure payment link before hand. Both routes let us check the card's issuing currency and offer Dynamic Currency Conversion (DCC) there and then. Both routes keep the transaction fully authenticated, which means lower interchange and genuine chargeback protection if a dispute is ever raised.

That's it. It doesn't require new infrastructure. It requires the person at the desk to understand why an extra ten seconds is worth it, and, frankly, it requires their finance and operations teams to have that conversation with them, because right now nobody is telling the front desk what a card-on-file shortcut actually costs the business.

Two tokens, one confusing message

I want to be careful here, because this isn't an argument against Tokenization. It's the opposite. Tokens, used properly, are one of the most secure ways to store payment data, and they're central to almost everything good in modern hospitality payments; loyalty recognition, one-click upsells, mobile check-in. The issue is that hotels are, in effect, running two different kinds of token through the same door and treating them as interchangeable.

The first is created during booking, through an OTA or a direct channel, and, if done well with an MIT guarantee, carries proper authentication data with it. That's a genuinely secure token, and can be securely used for no-shows or future incidental charges.  

The second is created at the terminal when staff want to avoid a full sale transaction for the room up front and instead capture a pre-auth token separately, which they can bill later for incidentals. Instead, they either grab the card-on-file token from the booking or quickly create an unauthenticated token, which they can use to charge for the room now and any additional charges as needed along the way. It feels like the easier, more flexible option without having to ask the cardholder for their card twice.  

But it's actually the one that quietly avoids doing the flow that was designed for this very scenario: an authenticated pre-auth that can be topped up as required during the stay, with a completion on departure, which is the version that would have captured both a secure token and the DCC opportunity at the same time.

Get that nuance wrong in your messaging, and you end up telling customers to distrust the very tool you're trying to get them to use more of. Get it right, and the message is simple: keep tokenising, keep the loyalty and upsell value that comes with it, just do it through a properly authenticated flow at the point the guest is standing in front of you, rather than re-using a booking-time token you were never meant to bill against.

Why an easy fix keeps getting stuck

If the benefit is worth €800,000 a year, why hasn't every hotel group already made this change? Because the people who see the cost and the people who control the process are rarely the same people.

A CFO sees chargeback costs and a DCC rebate line on a monthly statement, if that rebate is paid to head office rather than the property, the branch may never even know the revenue exists. A general manager is judged on smooth check-ins and guest satisfaction scores, not on merchant service charges. And the person actually holding the guest's card is often seasonal staff, trained once, somewhere else, on whatever process was quickest, and there's little incentive for them to add ten seconds to a check-in for a benefit that shows up on a spreadsheet they'll never see.

Layer on franchise structures, where payment decisions are made at head office but executed two or three tiers down at property level, and it's easy to see how a genuinely simple fix stalls. The revenue case has to reach the CFO. The training has to reach the front desk. And right now, in most organisations, there's no single conversation connecting the two.

The window to fix this on your own terms is narrowing

This isn't just a revenue argument any more. Card issuers are increasingly declining MOTO transactions outright, and the direction of regulatory travel across Europe continues to push against unauthenticated card-on-file processing. Hotels that keep relying on it aren't just missing out on revenue they are entitled to, they're going to see rising decline rates on transactions they'd previously taken for granted. Better to fix the process on your own timeline than have it forced on you.

This is an implementation problem, not a new idea

None of the solutions here are new. Pre-auth-and-completion flows, secure payment links, staff trained to explain why representing your card at check-in matters, hospitality businesses already have access to all of it. What's missing is the last mile: someone connecting the finance case to the front-desk conversation and giving staff a couple of hours of training or access to our innovative gamification training app, rather than assuming they'll work it out on shift.  

That's the work I'd encourage every hospitality leader to start this quarter: look at how many of your tokens are being created at the terminal rather than at booking, ask your finance team whether your DCC rebate is visible at property level, and give your front-desk teams the two-hour conversation that explains what a shortcut actually costs. It's a small change. For the hoteliers we've worked through this with, it's been worth well over half a million Euros a year, before we've even accounted for the fraud and dispute costs it also removes.

The volume is already there. It's just a question of whether you're capturing it, or quietly training your staff to give it away.