On the Road: Data Security Begins With the Traveler

“You’re going to Bogotá?” she asked.

“Not that I know of,” I replied.

“So I’m guessing you also didn’t buy a $10 cup of coffee yesterday in Antelope, California?” she asked.

No. The charge of $740.04, for a one-way ticket on Delta Air Lines to Bogotá, Colombia, and the charge for $10.20 at a coffee shop were fraudulent.

We are vigilant in our house about monitoring credit card activity, especially after traveling, and this was not the first time that unauthorized charges had appeared after recent trips. So I immediately got on the phone and reported the problem to the American Express Platinum Card office. The card was invalidated, a fraud investigation was begun, the charges were removed, and a few days later a new card arrived via FedEx.

Then I called my friend the security expert, Anthony C. Roman, and said, problem solved, right? Not exactly. “Red alert! Red alert! Red alert!” he responded.

What’s the big deal? Aside from the inconvenience of having to enter the new credit card information on recurring accounts, the cost to me was zero.

“Well, hopefully it was,” said Mr. Roman, president of Roman & Associates, which specializes in investigations and risk management consulting. He explained, however, that isolated unauthorized charges on your credit card statement most likely indicate that sophisticated cybercriminals are waiting to see if you will notice.

“What credit card fraudsters do is test your vigilance, how carefully you’re watching your account, and how carefully the credit card providers are watching your account. They do this by making relatively small purchases first, to see if it sets off any bells and whistles,” he said. Many frequent travelers are lax about checking activity statements in a timely manner, which flashes a green light to criminal hackers. Then, he said, “Hell or high water, the big charges are coming.”

Worse, he said, a hacked card could indicate that more serious identity theft might have occurred.

In its 2013 Global Security Report, Trustwave, a data security management firm, says that the top three industries targeted for data breach attacks in 2012, measured by the number of its investigations, were retailing (45 percent), food and beverage (24 percent) and hotels (9 percent). Three years ago, the hotel industry was at the top, but hotels have since made “significant strides” in improving credit card security measures, the report says.

Still, criminal hackers gravitate to some hotels because, like retail stores and restaurants, hotels do many credit card transactions at a local level, where centralized and highly sophisticated data security safeguards may be lacking. Last year, for example, the Federal Trade Commission sued Wyndham Worldwide, the hotel chain, for what it said was inadequate safeguarding of credit card information that led to three data breaches at hotels in under two years, with “millions of dollars in fraud loss, and the export of hundreds of thousands of consumers’ payment card account information to an Internet domain address registered in Russia.”

Wyndham responded that it had done all it could to report the crimes and carry out “significant remedial measures.” The company also charged that the commission had overstepped both its authority and its expertise in hotel data security enforcement.

Most hotels are locally owned, though managed by big hotel chain companies. For hotel owners, it is expensive to come into full compliance with the tough global data security criteria set by the credit card companies. And, Trustwave says, “Cybersecurity threats are increasing as quickly as businesses can implement measures against them.”

The threat is constant, Mr. Roman said. “The best protection is vigilance, and that takes work,” he said. That includes using complex passwords, being wary of public Wi-Fi, updating antivirus software — and checking credit card statements carefully.

Speaking of work, I hate to memorize passwords and PINs, but that appears to lie ahead. In the United States, credit cards use magnetic strips that are more vulnerable to hacking than the electronic chips embedded in credit cards in Europe and elsewhere. Such cards also require entry of a PIN.

These so-called chip-and-PIN cards are headed our way, said Kathy Orner, vice president for information security at Carlson Rezidor, a worldwide hotel company that is among the industry leaders in data security.

All of the major credit card issuers plan to start introducing these cards in the United States within two or three years. Ms. Orner had some advice for when that happens. “Do not use the same PIN on your credit card that you use on your debit card” or anywhere else, she said.

Right: more numbers to remember, coming soon.

Frequent Flier: A World Traveler Is Harmless, Yet Suspect

As worldwide creative director for the Brand Union, I travel to pitch new clients, make sure all our offices are running smoothly, and meet with existing clients. Work doesn’t stop because I’m on a plane, so I’m not the guy who has a lot of time to chat. I may be missing out on meeting some interesting people, but I want to avoid the nightmare scene of someone talking to me about their children, their pets or their work during an eight-hour flight.

Early in my career I would talk to seatmates, but I’ve learned the hard way that once you start talking, there’s often no good way to stop. The most anyone will get out of me now is a polite nod, which is plenty.

I’m very disciplined about travel. That’s the only way I can get through it. Once I’m done working on international flights, I’ll have a glass of red wine and take some melatonin. I’m out like a light and it’s nothing but sweet dreams for me until we land.

Part of my low-key approach to business travel is the fact that I have been stopped and searched so many times.

Without a doubt, my profile is a mixed bag and must set off all kinds of alarms.

First, I was born in Zambia to Welsh parents. Most people have no idea where Zambia is, including passport officials. Second, I travel on a British passport with a Welsh name, Dyfed Wynn Richards. I live in the United States and have a green card.

Anyone looking through my passport stamps and the frequency of my international travel probably assumes something is up. I can’t blame them. If I was in charge of passport control, I would stop someone with my profile, too.

One of the strangest experiences I have ever had was back when I was a young, broke designer. I was living in London at the time and dating a young woman who lived in France. Back then, the ferry between Dover and Calais was the cheapest option.

I made the trip several times with no problem, but finally customs and immigration officials stopped me when I was returning to Dover.

I was asked to step into a room and I was grilled by three big guys and our conversation was being taped. It was awful. Plus they asked me to remove my clothes and they even took a urine sample. I’m a big guy myself and don’t scare that easy, but I was petrified.

I was let go because I didn’t do anything wrong and when I got home I did tell my father about the situation. He contacted our local parliament member, and we did receive a document detailing the interview. Apparently, the officials thought I was very defensive because of my body language and gestures. They also put in the report that I cried. I remember my dad saying, “Really, you cried?”

Last year I was stopped in Singapore for about six hours. I flew in from Bangkok. Everyone was extremely polite, but I had my baggage searched.

Nothing was out of the ordinary, but I do think the sheer number of stamps on my passport, my real name, and my residency status probably prompted the search.

I take it in stride. Who knows? Maybe they thought I was a bald James Bond. And for the record, I didn’t cry.

By Fred Richards, as told to Joan Raymond. E-mail: joan.raymond

@nytimes.com

The Boss: Stephen Kaufer of TripAdvisor is an Average Traveler

My father was a trial lawyer. He taught me the power of articulate persuasion. We’d sit at the dining room table and take sides of a debate. He would argue me into a corner, then at some point say, “Switch,” and I’d have to defend the opposite position. He would then deftly argue himself out of the corner he had just painted me into.

My mother had multiple sclerosis. By the time I was 13 she was in a wheelchair, and she was bedridden when I went to college. She passed away in 1986. A huge responsibility fell to me at an early age as the oldest of three kids. I balanced the household checkbook at 13. I had a special driver’s license at the age of 15 to take my siblings around.

I picked up fencing in high school partly because it attracted the craziest bunch of people. I helped start my high school team, recruiting students with the pitch, “Wouldn’t it be fun if you learned how to stab your friends?” I went to the Junior Olympics when I was 16 or so and lost every one of my bouts. But I got better. When I went to Harvard I made the varsity team, was later elected captain, and in 1983 won a slot on the collegiate All-American team. In fencing, you have to think three moves ahead. It turned out to be good training for corporate life.

I went to Harvard thinking I would major in physics. I liked the pulleys-and-levers part but not the extensive math. Computer science was a bit of a backwater of academia then, but I liked the game of solving programming problems. I’d be pumped at 3 in the morning when I found bugs in programs.

In 1985, after I had graduated from college, I was co-founder of a company called CenterLine Software, which made programming and testing tools that we sold to software developers. In 1998 the other owners and I sold half the assets, and the other half became CenterLine Development Systems, which was headed by my wife, Caroline.

That same year, Caroline and I were planning a vacation in Mexico, and I started looking online for unbiased opinions about a particular hotel. What I got was a thousand sites showcasing exactly the same gorgeous picture and the very same descriptive paragraphs.

It took a lot of time, and some advanced Boolean logic in my search queries, but eventually I found a write-up from a couple who’d stayed at the hotel I had in mind, with pictures that showed rusted chairs and a beach not up to our expectations. I had dodged a bullet.

Later Caroline suggested I build a Web site to help other travelers in similar situations. “Just keep it easy to use and honest,” she said. TripAdvisor and its other Web sites now attract more than 75 million monthly visitors.

Unfortunately, Caroline did not live to see how large we would grow. She passed away from pancreatic neuroendocrine cancer in 2005 at the age of 42. I was left to raise our four children — ages 5, 7, 12 and 13 at the time. It was difficult, to say the least, but today we are a happy and healthy family. In 2012, I married a wonderful friend and an amazing mom with four kids of her own. With eight kids, a dog and a turtle, we take “full house” literally. Through the Stephen and Caroline Kaufer Fund for Neuroendocrine Research, we’ve supported medical research at several leading scientific institutions, as well as through our efforts with a great cancer charity called the Caring for Carcinoid Foundation.

Most people assume I am an avid traveler who would like nothing more than to roam the world for three months. Not true. The company was born of an average traveler’s desire to plan a great trip for a precious week or two of vacation time.