The secret master code thieves use to break into hotel room safes

Lax security is found even in four- and five-star hotels

Many hotel safes can be broken into using a simple code, according to security experts.

The problem lies in default settings left by the manufacturers, which enable an override code to be entered to open the safe in case a guest forgets their own code.

The problem was highlighted in a YouTube video uploaded by “Lock Picking Lawyer”, which shows a man stowing a valuable bottle of Scotch whisky into a Saflok safe.

He enters a four-digit code to lock it. The man then demonstrates putting an incorrect code in to show it won’t open.

However, he quickly proves that would-be thieves don’t need to know the real code in order to break in.

“What this hotel did not do was reset the administrator password that comes from the factory,” he says.

He enters the “super-user mode” – the lock button – followed by 999999, and the safe opens.

Stefan Vito Hiller, a global risk consultant to hotels with Sky Touch Consulting, confirmed that this security risk is a real problem in the hotel industry.

“It is a common known problem in hotels since the beginning of in-room safes,” he told The Independent. “It is standard in our security audits to check for default code settings and occasionally we find safes with this setting.

“This is not necessarily a problem in just cheap hotels. Default-code settings can be found also in four- and five-star hotels around the world. When safes get installed, it is the hotel’s responsibility to change those codes but because of lack of product knowledge by hotel management it doesn’t often get changed.

“In the video, 999999 is mentioned as a default code. It can also be 111111 or 000000 or 1111, 9999, 0000, depending on the product and manufacturer.

“Some safe manufacturers configure their products differently and do not have a default code setting.”

How to keep belongings safe in hotels

Vito Hiller offers the following tips for travellers to ensure their valuables are secure:

- Check for default-code settings before putting anything into the safe.

- Check if the safe is actually mounted to the wall and not just the furniture.

- Do not use birth dates, room number or check-in date as the pin-code.

- Always keep your hotel room door shut.

- If you want to be as safe as possible, only stay in hotels that are certified in Global Hotel Security Standards such as the Global Lighthouse Certification Program.

How hotels can ensure the safety of guests

He offers the following tips to hotels to improve security:

- Check all safes for default codes and replace them with a new code that is only known to management.

- Conduct regular security walk-rounds and check for any open bedroom doors.

- Put security awareness signs up and remind guests to put valuables in the safe.

- Train staff in security awareness and suspicious behaviour.

- Have proper hotel security policies in place.

- Conduct regular security audits and get certified in Global Hotel Security Standards.

This article was previously accompanied, for illustrative purposes, by a photograph of an Elsafe Infinity I model safe. The primary supplier of this model, Assa Abloy Hospitality Ltd, has asked us to make clear that Elsafe safes do not use master codes and have a much higher level of security over-ride. The issue highlighted in the article therefore does not apply to Elsafe products. We are glad to clarify matters. 15/5/18