Bonvoy personal information printed on Confirmations

[DRH90277]

I note Bonvoy "account numbers (last 4 digits), number of points, and Bonvoy status" is included on the MVC confirmations. I'm not sure why this needs to appear in print at all.

I raise this issue because Redweek wants a copy of the reservation to forward to a renter and is balking at acceptance of a pdf file. The reason I choose to send a pdf file is because I can black out the confidential Bonvoy information.

Does anyone have any insight into this issue or an appropriate remedy.

 

[vol_90]

I note Bonvoy "account numbers (last 4 digits), number of points, and Bonvoy status" is included on the MVC confirmations. I'm not sure why this needs to appear in print at all.

I raise this issue because Redweek wants a copy of the reservation to forward to a renter and is balking at acceptance of a pdf file. The reason I choose to send a pdf file is because I can black out the confidential Bonvoy information.

Does anyone have any insight into this issue or an appropriate remedy.

Never had an issue forwarding a Marriott e-mail reservation (200+) in all our dealings with Redweek over the last 6 years.

 

[DRH90277]

Never had an issue forwarding a Marriott e-mail reservation (200+) in all our dealings with Redweek over the last 6 years.

Are you saying you have no objection to providing your Bonvoy information, partial number and points balance, or do you have a way of removing this from the confirmation?

 

[DanCali]

I note Bonvoy "account numbers (last 4 digits), number of points, and Bonvoy status" is included on the MVC confirmations. I'm not sure why this needs to appear in print at all.

I raise this issue because Redweek wants a copy of the reservation to forward to a renter and is balking at acceptance of a pdf file. The reason I choose to send a pdf file is because I can black out the confidential Bonvoy information.

Does anyone have any insight into this issue or an appropriate remedy.

Is Redweek balking at the pdf file or the renter?

I send Redweek pdf files all the time for "verified" listings (but I don't do the "protected" part, so it doesn't get to a renter - I forward to the renter myself). For the pdf, I just "print to pdf" pages 1-2 which is all they really need to confirm it, and it stops before it gets to the Bonvoy information.

Alternatively, you can also forward them an email with the Marriott confirmation and after you click "forward" you can scroll down, highlight and "cut/delete" the section/part you would like to omit - it will just leave the two brown horizontal lines. Then you can send it to them. I hope that makes sense.

 

[vol_90]

Are you saying you have no objection to providing your Bonvoy information, partial number and points balance, or do you have a way of removing this from the confirmation?

I have no objection or reservation in providing the partial Bonvoy number and status / points balance when forwarding updated reservation with the renters name on it. I have rented from Redweek a few times and the owners Bonvoy information meant nothing to me. I would have to get very lucky to guess the 1st 5 digits and not sure if one did how it could be used. I don't have their Marriott Bonvoy password. Extremely low risk not worth worrying about IMO.

 

[echino]

This is a problem.

The guest just needs to go to marriott.com, look up the reservation, and will see the owner's full Bonvoy number, mailing address, phone number and email.

I rent out a lot of Marriott and Vistana weeks, and had I provided confirmations many times so that the guest and/or Redweek could verify them before paying. This resulted in my personal information being leaked to scammers and suspicious activity with my timeshare week reservations. Examples:

1. Guest name on the reservation was changed by someone a few days before my guest's check in. It was not the guest who did it. I only caught it a couple of days before check in because I checked the reservation.

2. When checking another (unrented, still in my name) reservation on marriott.com, I saw someone's email address instead of mine in the guest info. Then I saw the same email address in another future reservation. So someone (a scammer?) looked it up on marriott.com and emailed a confirmation to themselves, possibly to defraud someone else.

 

[vol_90]

Within the Marriott, Buy, Sell & Renting or any other TUG forum do we have any threads indicating where an individual was defrauded by e-mailing a guest name changed Marriott reservation to Redweek as part of the Verified or Verified & Protected renting process? Just curious as I have only been here a little over 4 years and never come across one.

 

[DRH90277]

Is Redweek balking at the pdf file or the renter?

I send Redweek pdf files all the time for "verified" listings (but I don't do the "protected" part, so it doesn't get to a renter - I forward to the renter myself). For the pdf, I just "print to pdf" pages 1-2 which is all they really need to confirm it, and it stops before it gets to the Bonvoy information.

Alternatively, you can also forward them an email with the Marriott confirmation and after you click "forward" you can scroll down, highlight and "cut/delete" the section/part you would like to omit - it will just leave the two brown horizontal lines. Then you can send it to them. I hope that makes sense.

Thank you so much, I'll try this. I knew I could get some help on Tug.

 

[DanCali]

Within the Marriott, Buy, Sell & Renting or any other TUG forum do we have any threads indicating where an individual was defrauded by e-mailing a guest name changed Marriott reservation to Redweek as part of the Verified or Verified & Protected renting process? Just curious as I have only been here a little over 4 years and never come across one.

I haven't seen that either. But it should be pointed out that the "official way" to make a name change (what you will be told if you ask an owner services agent) is to call and to never use the website directly.

They actually have a new process where you need to call and provide all the guest info like name, address, email, and even Bonvoy number and within 24 hours a separate department will make the name change on their end. It's pretty annoying to have to provide all that and then wait, but usually it's just a few hours. If you don't change the email address, then you will still get the confirmation, otherwise you will know it's done when it's gone from your reservation list (and you can then look it up). If you don't provide a new Bonvoy number, yours will get removed anyway presumably for concerns cited by the OP.

Similarly, with Westin/Sheraton the Vistana "official" way to do it is via the Vistana website rather than the Marriott hotel site. Lots of VSN owners have been bypassing that because they used to charge a $69 guest name change fee and going to the hotel website is free. Now, with the new Abound Club Fee, the guest fees are allegedly a thing of the past. Changing the guest's name on the Vistana website requires providing that same information and it will update on the Marriott website within 1-2 days. I suspect this is a manual process, but I might be wrong. I have found that the owners Bonvoy number always gets removed, but the guest's does not always get added.

Whether due to the Bonvoy info or other reasons, such as ones mentioned by echino, it's definitely a security concern. Neither MVC nor Vistana promote/support/mention that ability to modify a guest's name on the hotel website. AFAIK, this is just a hack (I first heard about it from Redweek) to get a confirmation faster and/or cheaper.

 

[vol_90]

I haven't seen that either. But it should be pointed out that the "official way" to make a name change (what you will be told if you ask an owner services agent) is to call and to never use the website directly.

They actually have a new process where you need to call and provide all the guest info like name, address, email, and even Bonvoy number and within 24 hours a separate department will make the name change on their end. It's pretty annoying to have to provide all that and then wait, but usually it's just a few hours. If you don't change the email address, then you will still get the confirmation, otherwise you will know it's done when it's gone from your reservation list (and you can then look it up). If you don't provide a new Bonvoy number, yours will get removed anyway presumably for concerns cited by the OP.

Similarly, with Westin/Sheraton the Vistana "official" way to do it is via the Vistana website rather than the Marriott hotel site. Lots of VSN owners have been bypassing that because they used to charge a $69 guest name change fee and going to the hotel website is free. Now, with the new Abound Club Fee, the guest fees are allegedly a thing of the past. Changing the guest's name on the Vistana website requires providing that same information and it will update on the Marriott website within 1-2 days. I suspect this is a manual process, but I might be wrong. I have found that the owners Bonvoy number always gets removed, but the guest's does not always get added.

Whether due to the Bonvoy info or other reasons, such as ones mentioned by echino, it's definitely a security concern. Neither MVC nor Vistana promote/support/mention that ability to modify a guest's name on the hotel website. AFAIK, this is just a hack (I first heard about it from Redweek) to get a confirmation faster and/or cheaper.

Please present "official" procedural documentation to teach us all. My time to update on the website is 2 minutes vs. calling and waiting to speak with a Marriott MVCI representative during office hours. What's your time worth vs a potential scam? For each individual to determine. Hope nobody gets scammed.

 

[jwalk03]

Please present "official" procedural documentation to teach us all. My time to update on the website is 2 minutes vs. calling and waiting to speak with a Marriott MVCI representative during office hours. What's your time worth vs a potential scam? For each individual to determine. Hope nobody gets scammed.

I always just change it on the website. Never called once, and so far have never had a problem.

 

[DanCali]

Please present "official" procedural documentation to teach us all. My time to update on the website is 2 minutes vs. calling and waiting to speak with a Marriott MVCI representative during office hours. What's your time worth vs a potential scam? For each individual to determine. Hope nobody gets scammed.

All I was saying is that if you call MVC how to change the name if you are renting the unit, they will tell you it works the way I describe. They will not tell you to do it on the hotel website. Neither will Vistana Owner services. And if you ask about it, they will tell you they are not sure it can be done and/or that it's not supposed to be done that way. That's as much "documentation" I can give you. I'm also pretty sure you will not find any guidance that you should change the name on the hotel website other than email instructions from Redweek and an "it works" argument.

I understand the 2 min vs 30 min argument. I also understand that allowing anyone to search for any reservation using just a name and checkin date, and then have the ability to change the guest name to whatever they want can be easily abused. Many of the Redweek "rentals" are actually individuals who will subsequently re-rent the weeks for a higher price, and if you rent via "verified and protected, you probably wouldn't even know it because they will subsequently change the guest name themselves. And these are not just reputable brokers, but literally some characters who you'd have no idea where to find (I have to interact with them because I don't use "verified and protected"). I'm not sure how you feel about them messing around with your reservations, changing names, and potentially having access to your personal info, but I don't like it. Those individuals are already violating the Redweek contract terms, which prohibit subletting without the owner's permission, so that should already say something about their scruples. My time is valuable, but I do what I can to mitigate potential risk.

 

[vol_90]

All I was saying is that if you call MVC how to change the name if you are renting the unit, they will tell you it works the way I describe. They will not tell you to do it on the hotel website. Neither will Vistana Owner services. And if you ask about it, they will tell you they are not sure it can be done and/or that it's not supposed to be done that way. That's as much "documentation" I can give you. I'm also pretty sure you will not find any guidance that you should change the name on the hotel website other than email instructions from Redweek and an "it works" argument.

I understand the 2 min vs 30 min argument. I also understand that allowing anyone to search for any reservation using just a name and checkin date, and then have the ability to change the guest name to whatever they want can be easily abused. Many of the Redweek "rentals" are actually individuals who will subsequently re-rent the weeks for a higher price, and if you rent via "verified and protected, you probably wouldn't even know it because they will subsequently change the guest name themselves. And these are not just reputable brokers, but literally some characters who you'd have no idea where to find (I have to interact with them because I don't use "verified and protected"). I'm not sure how you feel about them messing around with your reservations, changing names, and potentially having access to your personal info, but I don't like it. Those individuals are already violating the Redweek contract terms, which prohibit subletting without the owner's permission, so that should already say something about their scruples. My time is valuable, but I do what I can to mitigate potential risk.

My only challenge if it's "easily abused" then why aren't we hearing about it on TUG? There are many TUG members who would post an issue related to Marriott reservation manipulation and Redweek Rentals that resulted in a negative consequence for someone. Everything has risk.

 

[DanCali]

My only challenge if it's "easily abused" then why aren't we hearing about it on TUG?

Maybe we just did to some extent?

I rent out a lot of Marriott and Vistana weeks, and had I provided confirmations many times so that the guest and/or Redweek could verify them before paying. This resulted in my personal information being leaked to scammers and suspicious activity with my timeshare week reservations. Examples:

1. Guest name on the reservation was changed by someone a few days before my guest's check in. It was not the guest who did it. I only caught it a couple of days before check in because I checked the reservation.

2. When checking another (unrented, still in my name) reservation on marriott.com, I saw someone's email address instead of mine in the guest info. Then I saw the same email address in another future reservation. So someone (a scammer?) looked it up on marriott.com and emailed a confirmation to themselves, possibly to defraud someone else.

 

[DRH90277]

I talked to Redweek today about the process with respect to the confirmation submissions. They definitely want us to just forward the confirmation as received from MVC. They do not want a pdf file copy. I expressed my dismay with having the Bonvoy information left on the confirmation. I was advised that when they forward the reservation to the renter, they only send the first couple of pages and cut off the pages showing any Bonvoy information. I do not like this process but may need to concede.

It was mentioned that Redweek personnel have seen renters change the guest's name on the confirmation. This is not very comforting. I asked if making sure my name remained on the reservation with the renter showing only as a guest made any difference. The answer was not very clear. In addition, I see gaps in the MVC procedures in that there does not seem to be consistency in the way a guest is shown on the reservation. Sometimes, the guest's name ends up showing as if they owned the reservation and sometimes it shows as a guest further down in the text.

I am not very comfortable with all this. I do not want others to change names, sub-lease, etc.

 

[DanCali]

I am not very comfortable with all this. I do not want others to change names, sub-lease, etc.

While "verified and protected" is much more convenient, and can generate higher rental values, you lose all control. Some "renters" violate the no subleasing term of the Redweek contract all the time. If you don't want others to sublease and/or change the name without your knowledge, don't do "verified and protected" and add a clause in your own contract that subleasing is prohibited and may result in cancellation of the reservation without a refund. I always just do "verified" listings (or "unverified"), so I know who rents from me. Doing this has given me greater visibility into who are some of the "renters" on Redweek, especially when you price attractively for a quick rental like I sometimes do.

There are several (legit) brokerage firms that rent for a client. Some of them have told me directly that they will change the name on the reservation themselves if they need to (say due to a cancellation). Aside from that, more than a handful are just individuals looking for a quick buck. Here's an excerpt from an email I got from an individual who contacted me for a second time, after I told him I wasn't interested in working with him (I'll omit identifying info like name and email):

Since we last talked, I have committed some capital to renting these units early and then holding them to re rent as the prices increase. It is a no risk investment for me, and you and others get the rent you are asking for, when you ask for it.

I wouldn't do this to you, because you have asked me not to. However, once the reservation is in my name, I can through Marriott change any reservation in my name to the name of another tenant. If you could bring yourself to become comfortable with me, I would be happy to rent as many of your units as meet my criteria, as this one does.

If I did "verified and protected" I'd have no idea this type of business was going on. To be fair, based on his email/domain this was probably a totally legit offer, and can definitely be tempting to just be done with the rental, but I just don't want to rent to this type of "renter". If anything, it's probably a clue that I am way underpricing some rentals...

 

[DRH90277]

Thanks for providing insight.

I talked to Bonvoy and they suggested I call Owner Services. I called Owner Services and am advised that only the owner with their Bonvoy number can make a change. And, if a guest on the reservation requested a change, they would refer the guest back to the owner. However, they also mentioned that if I put the reservation in the guest's name with their Bonvoy number, the guest could make changes. I am hopeful this is correct and if so, I don't think we have much risk of someone hijacking a reservation to add another guest, etc.

 

[echino]

Thanks for providing insight.

I talked to Bonvoy and they suggested I call Owner Services. I called Owner Services and am advised that only the owner with their Bonvoy number can make a change. And, if a guest on the reservation requested a change, they would refer the guest back to the owner. However, they also mentioned that if I put the reservation in the guest's name with their Bonvoy number, the guest could make changes. I am hopeful this is correct and if so, I don't think we have much risk of someone hijacking a reservation to add another guest, etc.

Anyone can potentially make a name change on marriott.com without calling anyone, if they know the reservation number, check in date, and current guest name.

 

[DanCali]

Thanks for providing insight.

I talked to Bonvoy and they suggested I call Owner Services. I called Owner Services and am advised that only the owner with their Bonvoy number can make a change. And, if a guest on the reservation requested a change, they would refer the guest back to the owner. However, they also mentioned that if I put the reservation in the guest's name with their Bonvoy number, the guest could make changes. I am hopeful this is correct and if so, I don't think we have much risk of someone hijacking a reservation to add another guest, etc.

Of course if you call owner services to make a change, they will confirm that you are allowed to make the change

BUT, as ridiculous as it might sound...

Anyone who knows a reservation number, guest name, and checkin date can actually change the guest name on that reservation on their own. That's all the information they need. And while they are at it, they can also change the email address on that confirmation, so you don't even know about it (the one thing they cannot change is the Bonvoy number, but it's not like you check the name on the reservation often). They don't have to contact owner services to do it; they can do it online and they don't even need a Marriott account or Bonvoy number of their own. It really doesn't matter whose Bonvoy number is on the reservation - the Marriott website allows all this to happen.

So, anyone who rents from you ("verified and protected", or not) knows the 3 things they need to know to make subsequent name changes online. It's up to you to decide if you care about that, and if you wish to screen your "renters" to figure out if they are the actual tenants.

 

[DRH90277]

Of course if you call owner services to make a change, they will confirm that you are allowed to make the change

BUT, as ridiculous as it might sound...

Anyone who knows a reservation number, guest name, and checkin date can actually change the guest name on that reservation on their own. That's all the information they need. And while they are at it, they can also change the email address on that confirmation, so you don't even know about it (the one thing they cannot change is the Bonvoy number, but it's not like you check the name on the reservation often). They don't have to contact owner services to do it; they can do it online and they don't even need a Marriott account or Bonvoy number of their own. It really doesn't matter whose Bonvoy number is on the reservation - the Marriott website allows all this to happen.

So, anyone who rents from you ("verified and protected", or not) knows the 3 things they need to know to make subsequent name changes online. It's up to you to decide if you care about that, and if you wish to screen your "renters" to figure out if they are the actual tenants.

Thanks to you, we have a better understanding of the risk. Unfortunately, I'm not sure Marriott would be willing to remedy this. Sad and disappointing.

 

[daviator]

I always worry that the original reservation-maker (who is probably the timeshare owner) retains a small but potentially significant bit of liability for the actions of the renter. For example, if the renter were to trash the room (unlikely, but it has happened) or overflow the tub, and the resort was not able to charge the damages to the credit card the renter left at check-in, I'd expect them to come back to the owner who made the reservation and demand reimbursement, which could be five or even six figures.

For that reason, the idea of renters being able to sublease and change the names on their own makes me very nervous. At least with the people I rent to directly, I've had some back and forth and feel comfortable that they're being genuine with me. I could still get burned, of course, but I am usually good at sniffing out the bad eggs. But once somebody sells the stay to someone else and changes the name, I have no idea who is using the room and what they might do.

So I agree that Marriott ought to tighten up their security. At the very least, you should have to log in to the Bonvoy account attached to the reservation to change the name.

 

[hangloose]

I have Marriott send the email to me, then I forward to Redweek after removing my Bonvoy numbers and any other information I don’t want them or a renter to have. Simple as that.

 

[DRH90277]

I have Marriott send the email to me, then I forward to Redweek after removing my Bonvoy numbers and any other information I don’t want them or a renter to have. Simple as that.

Exactly what I did and Redweek won't accept that now. Redweek only accepts forwarded email transmission of confirmation. There is a way to forward only the first three pages which will cut-off the Bonvoy info. Look at DanCali's post #4 above. Apparently, there is a way to forward less than the entire document.

As DanCali mentions, this is still a mess.

 

[eyedude]

All I was saying is that if you call MVC how to change the name if you are renting the unit, they will tell you it works the way I describe. They will not tell you to do it on the hotel website. Neither will Vistana Owner services. And if you ask about it, they will tell you they are not sure it can be done and/or that it's not supposed to be done that way. That's as much "documentation" I can give you. I'm also pretty sure you will not find any guidance that you should change the name on the hotel website other than email instructions from Redweek and an "it works" argument.

I understand the 2 min vs 30 min argument. I also understand that allowing anyone to search for any reservation using just a name and checkin date, and then have the ability to change the guest name to whatever they want can be easily abused. Many of the Redweek "rentals" are actually individuals who will subsequently re-rent the weeks for a higher price, and if you rent via "verified and protected, you probably wouldn't even know it because they will subsequently change the guest name themselves. And these are not just reputable brokers, but literally some characters who you'd have no idea where to find (I have to interact with them because I don't use "verified and protected"). I'm not sure how you feel about them messing around with your reservations, changing names, and potentially having access to your personal info, but I don't like it. Those individuals are already violating the Redweek contract terms, which prohibit subletting without the owner's permission, so that should already say something about their scruples. My time is valuable, but I do what I can to mitigate potential risk.

 

[eyedude]

I had this happen to me. Rented a week on Redweek and the renter changed the name and didn’t tell me.