Payment Security
CHS (Corporate Hotelstock Services Pvt. Ltd.) realises how important the security of your payment and booking data is to you. We have taken a number of steps to enhance the safety and confidentiality of the information you send to CHS over the Internet when you use our website and self-booking platform. Given below are answers to some questions that users may have with regard to payment security:
· Is my confidential information secure?
· How is my card information handled?
· What is a “secure session” and how does it help keep my information safe?
· How do I know I have entered a secure area?
· What type of connection do I need?
· Why do I need a login ID and password?
· What should I do if I am using a shared or “public” computer?
· What are “Cookies”? Do I need to accept them?
· Will CHS ever ask for my card details, OTP or password?
· What should I do if I suspect fraud or an unauthorised transaction?
1. Is my confidential information secure?
Whenever CHS asks you to send confidential information over the Internet, including your login details, traveller details and payment information, we require that a “secure session” using HTTPS (which is based on TLS encryption) is established first. Access to booking and billing records is restricted to authorised CHS team members and to the administrators of your own company’s account.
2. How is my card information handled?
Card payments on the CHS platform are processed through an online payment gateway. You enter your card details on the gateway’s secure payment page, and your bank authenticates and authorises the transaction directly, for example with a one-time password. CHS does not see, receive or store your full card number, expiry date or CVV. Under RBI guidelines, only card issuers and card networks may store actual card data, so merchants such as CHS do not keep it. Once your bank completes the transaction, it issues an authorisation code and a confirmation of the payment through the gateway.
Where your company has arranged corporate billing with CHS, no card is needed. The booking is invoiced to your company under the agreed terms, and you will not be asked to enter payment details.
3. What is a “secure session” and how does it help keep my information safe?
During a secure session, information passed back and forth between your device and CHS systems is encrypted using TLS (Transport Layer Security, the modern successor to SSL). Your browser and the CHS server exchange keys to create a private conversation that only your device and CHS systems can understand. Anyone who intercepted the data on the way would see only scrambled text.
TLS is used any time you access or supply personal and confidential information, including login details, traveller details and payment information, in the secure areas of the CHS platform. It requires only an up-to-date web browser and a web server that supports it, and all current versions of the major browsers do.
4. How do I know I have entered a secure area?
You can verify that you are in a secure area by checking the site address at the top of your page, which should begin with https:// instead of http:// and show a padlock icon. Secure sessions are established in the CHS online areas where your personal information is transmitted, including:
· User ID & password
· My profile / traveller details
· My bookings
· Billing details and the payment page (hosted by our payment gateway)
If the address does not match the official CHS website, or your browser shows a security warning, stop and do not enter any details.
5. What type of connection do I need?
Nearly all Internet Service Providers (ISPs) support secure sessions automatically, as do most online services. If you use your company’s internal connection to access the Internet and you find you cannot open the secured CHS pages, your company may be blocking access through a “firewall”. Please speak to your company’s IT administrator for further details on your network’s Internet access.
6. Why do I need a login ID and password?
A login ID and password are an additional security measure that helps protect your confidential information. They let CHS verify exactly who you are, show you only the bookings you and your company are authorised to see, and help prevent unauthorised access. Your login is personal to you. Please do not share it with colleagues, even in your own team. If someone else needs to book or view trips on your behalf, ask your company’s administrator to arrange access for them. If you think your password may have been seen by someone else, change it immediately and let us know.
7. What should I do if I am using a shared or “public” computer?
If you use a shared computer that others also work on, and you are concerned that they may view “cached” pages after you have left, please log out and then close your browser completely before leaving. This reduces the possibility of anyone viewing your confidential information. No other user will be able to access your information online without your login ID and password.
8. What are “Cookies”? Do I need to accept them?
A cookie is a small text file on your device that reminds our system of your browser preferences and security requirements and lets CHS recognise your session. If your browser prompts you when a cookie is “served”, you must accept it, or access to confidential information will be denied, because we will not be able to ensure that the information is being sent to the right person. Since cookies are site specific, only CHS online services can read and make use of the information.
9. Will CHS ever ask for my card details, OTP or password?
No. CHS will never ask you for your card number, CVV, one-time password (OTP), PIN or login password over a phone call, email, WhatsApp message or SMS. Payment is requested only through the payment page on the CHS platform or a secure payment link sent from an official CHS channel. If someone claiming to be from CHS or from a hotel asks for these details, do not share them. End the call and contact CHS on +91 11 42268433 or +91 98180 84527 to check.
10. What should I do if I suspect fraud or an unauthorised transaction?
Act quickly. Contact your bank right away to block the card or account involved. Tell CHS at info@corporatehotelstock.com or on +91 98180 84527 so that we can secure your account and check any related booking. You can also report cyber fraud to the National Cyber Crime Reporting Portal at cybercrime.gov.in or by calling the helpline 1930. Reporting early improves the chance of stopping or recovering a fraudulent payment.
Seven tips to protect yourself against online fraud and identity theft
We have put together a list of tips that you can use to protect yourself, your colleagues, your family and friends. A quick read could help you spot potential fraud before it happens.
1. Don’t take the bait
This is one of the main ways that fraudsters and hackers gain access to your information. Don’t open links, pictures or attachments from unknown contacts, or if you are simply suspicious. Red flags include content that your contact wouldn’t normally share, messages asking you to “update your KYC” or “confirm your booking” through a link, or an attachment from someone you rarely deal with. If something feels off, do not reply. Verify with the sender through another channel, such as calling a number you already know to be genuine. Other forms of bait include being “randomly” selected as the winner of a contest you did not enter, too-good-to-be-true offers, and fake “virus” alerts.
2. Use strong passwords and keep them private
Your password is often the only thing between a scammer and your email, bank or booking account. Avoid easy-to-guess passwords such as “Password”, “123456” or your birthday. Use a long password with a mix of upper and lower case letters, numbers and special characters, and use a different password for each service. Where two-factor authentication is available, such as a one-time password sent to your phone, switch it on. A scammer then cannot get into your account with your password alone.
3. Use only sites that start with HTTPS
If you are on any site where you plan to make a purchase or enter personal information, check that the address begins with https:// and that a padlock icon is shown in the address bar. Also read the full web address carefully. Fraudulent sites often use look-alike names with a changed letter or an extra word. Different browsers display the padlock differently, so make sure you check the actual letters in the address.
4. Stay up to date on current scams
Staying informed is one of the best ways to protect yourself from fraud and identity theft. Common scams in India include fake customer-care numbers that appear in online search results, calls from someone pretending to be a hotel front desk asking you to pay again to “hold” a booking, “refund” requests that actually take money from your UPI account, and people posing as government or bank officials. Follow advisories from CERT-In (cert-in.org.in) and the National Cyber Crime Reporting Portal (cybercrime.gov.in) to keep up with what is currently going around.
5. Keep personal information confidential
Unless you are very confident about the site you are using, be wary of entering personal information. Be especially careful with requests for financial information, your Aadhaar, PAN or passport number, your date of birth or your family details. Most sites do not need this information. Hotels do require a valid photo ID at check-in, and CHS asks for ID details only where a hotel needs them for your stay. Share them only through the secure forms on the CHS platform or directly with the hotel at check-in, and never through an unsolicited message or call.
6. Don’t respond to calls asking for remote access to your computer or phone
Anyone who phones you to gain remote access to your computer or phone, using apps such as AnyDesk, TeamViewer or similar tools, is very likely up to no good. These scammers may say they are fixing an error, updating your software or helping with a refund, but in the end they want to take over your device, see your banking details and move money out of your accounts. The best thing to do with any unknown caller asking for remote access is to hang up without saying a word.
7. Be wary of unusual payment requests
Be wary of anyone asking for payment in an unusual form, such as to a personal UPI ID or personal bank account, in cryptocurrency, or through gift cards or pre-loaded cards. These are used because they are hard to trace. Reputable businesses accept payment through a standard payment gateway or against a proper invoice. If you receive an invoice or a message saying that CHS’s bank details have changed, do not pay until you have confirmed it by calling CHS on a number you already know to be genuine.