Hotel mobile keys can be safer than plastic cards: they are encrypted, limited to the stay, tied to a locked phone and can be revoked at any time. They are not risk-free. Researchers have shown replay attacks and weak admin passwords, so security depends on the lock firmware, the key platform and your processes.
The short answer
A mobile key has protections a plastic card lacks: encryption, door and date limits, the phone's own lock and remote revocation. But the key is one part of a system that also includes lock firmware, lock software, admin accounts, the key platform and the people who run them. As one security expert told NerdWallet, "encryption alone" does not deliver security. The documented incidents below show where the gaps have been.
How a hotel mobile key is protected
Each layer limits the damage if another fails.
1. Encryption
FLEXIPASS generates an encrypted digital key and transfers it to the guest's phone over a data connection. For Mobile Keys, the key is stored in a secure vault on the phone, and the app uses Bluetooth to create a mutually authenticated, encrypted channel with a compatible Bluetooth lock. Wallet Keys are stored in the phone's built-in secure element.
2. Time and door limits
A key grants access to assigned doors for a selected time period. It is not a general pass to the building. The hotel decides which areas each guest can open.
3. The phone's own lock
In most cases the phone is protected by a PIN code, Touch ID or Face ID, so a finder cannot easily reach the key. A plastic card has no equivalent.
4. Remote revocation
If a phone is lost, the guest tells the hotel. The hotel can issue a new key or a physical keycard that overrides the earlier digital key, and it can revoke a digital key at any time.
5. Revoked at check-out
Keys are valid only for the time window the hotel defines. At check-out they are revoked, in most cases automatically when the PMS informs FLEXIPASS. A previous guest cannot open the door after a new check-in.
What has actually gone wrong? (documented cases)
Here is what the public record shows, with dates. Some of it is old, and we say so.
- A Bluetooth signal replayed in a test (2018). In a News4Jax report from 23 February 2018, a security researcher described capturing a phone's Bluetooth key transmission with an antenna and replaying it to open a lock. He also warned that an attacker with the administrator password could do almost anything, and said he knew of no actual criminal hacks.
- An admin password reset in testing. A researcher quoted in a NerdWallet article republished by U.S. TV station sites said that on one lock they examined, the team could reset the administrative password without authorisation. The republished page carries no date.
- Ransom demand against a hotel key system (reported January 2018). MarketScale reported on 10 January 2018 that hackers targeted a hotel's electronic key system in Austria and locked the hotel out of its computer system. A ransom of two bitcoins was reportedly paid, and the hotel returned to traditional keys.
- A key card flaw in a widely used RFID hotel lock system (2024). SecurityWeek reported on 22 March 2024 that the flaw "impacts more than three million locks" at "more than 13,000 locations across 131 countries". Starting from one card from the property, even an expired one, an attacker could forge keycards from any MIFARE Classic card, and one pair of forged cards could open any door in the property. At the time, "only 36% of affected locks have received the fix".
- No known U.S. cases, per the FBI (dated). The same NerdWallet article quotes the FBI as saying it had not seen any compromised hotel mobile key systems in the U.S. The republished page carries no date, so treat this as a historical statement, not a current one.
The pattern: the weak points were admin access, unpatched lock firmware and old card formats. The phone itself was rarely the problem.
Mobile key vs key card: which is safer?
| Feature | Plastic key card | Mobile key |
|---|---|---|
| Can it be copied or cloned? | Older card formats can be: in 2024, forged cards for a widely used RFID lock system could be made from any MIFARE Classic card (SecurityWeek) | The key is an encrypted credential on the phone. A 2018 test replayed a captured Bluetooth signal against one lock (News4Jax), so lock firmware matters |
| If it is lost | The front desk encodes a new card | The hotel revokes it and issues a new one |
| At the end of the stay | The card stops working; the plastic remains | The key is revoked at check-out |
| Can it be revoked remotely? | No; a new card is encoded at the desk | Yes, at any time |
| Protected by a phone lock? | No; whoever holds the card can use it | In most cases, yes (PIN, Touch ID or Face ID) |
| Main weak point | Old card formats and unpatched locks | Admin access, lock firmware and processes |
For a wider comparison of costs and guest experience, see digital hotel keys vs keycards.
The weakest link is usually process, not technology
Most of the incidents above started with something a hotel or provider could control. Practical fixes:
- Admin passwords. Change default passwords on lock software and key-platform accounts. Use a unique, long password per account and limit who holds admin rights.
- Staff access. Give staff keys only for the doors and hours they need, and remove access when someone leaves.
- Firmware and software updates. Ask your lock provider how updates are released and who installs them. The 2024 card flaw shows how long fixes can take to reach every door.
- Lost phones. Make revocation a routine front-desk task, with a keycard ready as a fallback.
- Guest phones. Remind guests to keep a screen lock on.
10 security questions to ask any digital key provider
Use these alongside the questions to ask any digital key provider:
- Which exact lock models and software do you support, and which key types does each one allow?
- How is the key protected on the phone and between the phone and the lock?
- How are keys revoked: automatically at check-out, manually, or both?
- How are room moves, late check-outs and cancelled stays handled?
- What happens without a data connection? Can a downloaded key still open the door?
- Which phones and wallets are supported?
- Who holds admin rights to the lock system and the key platform, and how are those accounts protected?
- How are lock firmware and app updates delivered, and who applies them?
- What access logs exist, who can see them and how long are they kept?
- What is the fallback when a phone battery dies or a key fails?
Before rollout, check your lock configuration.
Guest data and privacy
A digital key needs very little guest data. In a FLEXIPASS integration, the PMS or guest platform requests a key with the room number and the check-out date and time.
The bigger privacy and security point is timing. Booking a room alone should not grant access. Identity checks, payment and room readiness come first, and the key follows the hotel's approved check-in workflow.
Ask any key provider which role it plays under data protection law (for example processor or controller under the GDPR), where guest data is hosted, how long it is kept and whether it signs a data processing agreement.
What to tell guests
- Keep your phone locked with a PIN, Touch ID or Face ID.
- If you lose your phone, tell the front desk straight away.
- If you prefer a keycard, ask. Digital keys and physical keycards can be used at the same time.
More guest answers: what to do when a mobile key is not working.
FAQ
Can hotel mobile keys be hacked? Researchers have shown attacks in testing, such as replaying a captured Bluetooth signal and resetting a lock's admin password. The researcher quoted in 2018 knew of no criminal cases. Patched lock firmware and strong admin passwords matter more than any single feature.
What happens if a guest loses their phone? The hotel can issue a new key or an overriding keycard and revoke the old key at any time.
Can the previous guest still open the room? No. Digital keys are valid only for the time window the hotel defines, and they are revoked at check-out.
Are mobile keys safer than key cards? In several ways: they are encrypted, revocable remotely and protected by the phone's lock. Older card formats can be cloned, as the 2024 RFID flaw showed. See the table above.
Can a guest copy a plastic keycard into Apple Wallet? No. A FLEXIPASS Wallet Key is a digital credential issued through the hotel's supported integration. It is not a tool for scanning or copying a plastic keycard.
Who can see guest data? A key request carries the room number and the check-out date and time. Which other guest data a provider processes, where and for how long, should be set out in its data processing agreement, so ask for it before rollout.