Hotel requesting CVV by email: Is this normal?

Hotel requests CVV by email: The booking you should refuse

A hotel outside Spain replies to a client via email with a seemingly innocent proposal: since the requested dates are not yet open on Booking, the reception offers to handle the reservation directly. The client only needs to send their card number, expiry date, and CVV code by email. The client accepts providing the first two pieces of data, but the third raises alarms. The question posed—Is it normal for an establishment to ask for the CVV by email?—runs through a conversation where the majority answer is a resounding no, with nuances worth separating.

What is the CVV and why shouldn't it be sent by email

The CVV was created precisely for the opposite purpose: so that anyone holding a card number could not operate with it without the physical plastic present. It is not recorded on the magnetic stripe nor appears on payment terminals; it is only printed on the back. Its function is to verify that the cardholder has the card in their possession at the time of purchase. Therefore, its natural place is a secure payment gateway, not an inbox.

Email does not guarantee end-to-end encryption. The message remains stored in the hotel's mailbox and the client's, and can be read by anyone with access to those accounts: from the hotel's IT staff to an employee with a shared password. Card regulations—the PCI-DSS standard and Visa/Mastercard rules—expressly prohibit storing the CVV after the transaction. A hotel that asks for it by email to keep it as security for months is, at best, operating outside this framework.

Payment guarantee: The establishment's argument

The industry's defense is logical: the booker wants to ensure the room upon arrival, and the hotel wants to ensure payment. A guest who doesn't show up or cancels last minute leaves an unsellable empty room. That is why many establishments request a card as a guarantee and apply a partial or full charge if the booking is breached.

The problem isn't the principle, but the method. A hotel can request card details through a secure gateway or ask for a bank transfer for advance bookings. What they shouldn't do is accumulate card numbers and CVVs in an email account. Those defending this practice claim it is common across Europe and that they have never had issues; the argument relies on personal experience, not regulation.

Virtual and prepaid cards: The practical defense

The solution generating most consensus isn't refusing to book, but not exposing your main card. Single-use virtual cards, generated and loaded at the moment of purchase, allow you to provide a number that becomes invalid once the operation ends. Prepaid cards with minimal balance serve a similar function: if someone attempts a later charge, there are no funds to scrape.

Some take this compartmentalization to the extreme: one card for hotels, another for online shopping, another for subscriptions, and a final one with one euro balance for sites that only require the plastic for verification. Managing this is annoying, they admit, but the day an establishment tries to overcharge, the damage is contained. An anecdote circulating in the conversation—a hotel trying to charge €100 for a wine stain on sheets—illustrates why keeping control of the number is advisable.

The confusing detail: A deactivated card still charging

The conversation takes a turn when the person who raised the doubt checks that their card had been deactivated for months and, yet, Booking had successfully charged a recent reservation without issue. The conclusion drawn is uncomfortable: the deactivate button in online banking may not be blocking e-commerce charges, or at least not all of them. This finding reinforces the thesis that security depends not on a switch, but on never handing over the data that allows operations.

What to do if a hotel asks for the CVV by email

The repeated recommendation is simple: do not send the CVV by email, nor the full card number if avoidable. If the establishment does not offer a payment gateway or bank transfer, the alternative is to wait until dates open on the booking platform, even if it costs more. The price difference is cheap insurance compared to the risk of data ending up in wrong hands.

If you still decide to provide a card as a guarantee, the most cited option is a prepaid card with minimal balance or a single-use virtual card. And if an improper charge occurs, the path is to dispute it and, if necessary, report it. The conversation doesn't close the matter: the client has not yet received a response from the hotel regarding whether they accept an alternative method.