How Long Can a Hotel Keep Your Credit Card Details?

There is no single legal deadline that tells a hotel when to delete your credit card information, so the honest answer to how long a hotel can keep your credit card details is: as long as it has a legitimate business, legal, or regulatory reason to hold them. In practice that means at least 120 days after checkout to handle possible chargebacks, and often three years or more once tax record-keeping and contract disputes are factored in. What the law does control, tightly, is how that data must be stored and what pieces of it must be destroyed right away.

Why a Hotel Holds Your Card After You Leave

Some charges post after you’ve already driven off. Minibar items, room service, on-demand movies, and damage found by housekeeping all get billed to the card the hotel already has. The same card covers no-show fees and late-cancellation penalties. That operational need fades within days or weeks, but it’s only the first layer.

Retention length is really governed by the Payment Card Industry Data Security Standard (PCI DSS), which every merchant that accepts cards must follow, from a small inn to a global chain. PCI DSS doesn’t name a number of days. Requirement 3 tells merchants to keep cardholder data only when there is a business, legal, or regulatory need, hold it for the minimum time necessary, and purge what’s no longer needed at least every quarter.¹ That flexible “business need” language is why the same card details can sit in a hotel’s systems for very different lengths of time depending on what’s happened with your stay.

The 120-Day Floor: Chargebacks

The shortest common justification for holding your card data is the chargeback window. Under Visa’s rules, a cardholder has up to 120 days from a purchase to initiate a dispute.² Hotels routinely keep the relevant records at least that long so they can respond with proof if a guest contests a charge. Once the window closes without a dispute, this particular reason to hold the data expires.

The Multi-Year Tail: Taxes and Legal Claims

Chargebacks are the short story. The longer one is tax law. The IRS generally requires businesses to keep records supporting income, deductions, or credits for at least three years after the return is filed. If the IRS suspects unreported income above 25 percent of gross income, that extends to six years. Records tied to bad debts or worthless securities must be kept seven years.³ A hotel’s transaction records document revenue, so they can fall within these rules.

State statutes of limitations on written contract disputes add another layer, running from three to ten years depending on the state. If a billing disagreement ever became a lawsuit, the hotel would want the underlying records to defend itself. So while day-to-day need for your card details fades within a few months, legal and tax justifications can keep your information archived for years.

Worth knowing: retained transaction records are not the same thing as a usable, ready-to-charge copy of your card. Under PCI DSS Requirement 3.4, any stored account number must be rendered unreadable wherever it lives, using strong encryption, tokenization, truncation, or one-way hashing.¹ A compliant hotel doesn’t have your full readable card number sitting in a database years later.

What a Hotel Is Not Allowed to Keep

One piece of your card cannot be stored at all, ever, even encrypted: the three- or four-digit security code on the back (CVV or CVC). PCI DSS Requirement 3.2 prohibits merchants from retaining sensitive authentication data after a transaction is authorized. The security code, full magnetic stripe data, and any PIN information must be destroyed as soon as the payment clears.¹ If a hotel asks you to re-provide the security code for a later charge, that’s the rule at work, not a system glitch.

When retention finally does end, disposal is regulated too. The FTC’s Disposal Rule requires businesses holding consumer information to take reasonable measures to prevent unauthorized access when getting rid of it: shredding or burning paper, wiping or destroying electronic media.⁴

Can You Ask a Hotel to Delete Your Card Details?

Depending on where you live, yes. California’s Consumer Privacy Act was the first major state law giving residents a right to request deletion of their personal information, and roughly 20 states had comprehensive privacy laws on the books as of 2026 with similar provisions.⁵ The hotel must verify your identity before acting on a request.

The catch: the hotel can legally decline if it still has a valid reason to keep the data. Settling a final bill, meeting IRS retention requirements, and defending against potential legal claims all count as recognized exceptions.⁵ A deletion request the week after checkout is almost certainly going to be denied or deferred. Filed after the chargeback window, tax retention period, and any state statute of limitations have all run, it has more force, though by then the hotel’s own PCI DSS purge schedule may have already handled it.

Limiting What the Hotel Gets in the First Place

You have more control at the front end than at the back end. A few options keep your real card number out of the hotel’s systems entirely.

Booking through an online travel agency like Expedia or Booking.com often means the OTA is the merchant of record. It collects your payment, then sends the hotel a virtual card number to cover the room. Your actual card details never reach the hotel.⁶ The retention question shifts to the OTA, which is bound by the same PCI DSS rules.

Paying at the front desk with Apple Pay or Google Pay works on the same principle. Both use tokenization: the terminal receives a device-specific token and a one-time code, not your card number. A later breach of the hotel’s systems produces a token that’s useless anywhere else.

For online bookings, several banks and standalone providers let you generate a virtual card number tied to your real account but locked to a single merchant, sometimes with a spending cap. When the trip is done, you can close the virtual number. Even if the hotel keeps it on file for years, there’s nothing usable left to take.

One more habit that helps: when a hotel offers to keep your card on file for future stays, decline. That’s an easy way to end an operational retention that would otherwise have expired.

If a Charge You Didn’t Authorize Shows Up

Call the hotel first. A minibar charge for items you didn’t touch is often resolved on the phone. If it isn’t, federal law gives you a formal path, and the deadline is shorter than most people expect.

The Fair Credit Billing Act requires your card issuer to investigate billing errors when you send written notice within 60 days of the statement date on which the disputed charge first appeared. Miss that window and you lose the formal FCBA right. The notice must identify your account, flag the charge, and explain why you think it’s wrong. The issuer has to acknowledge within 30 days and resolve the dispute within two billing cycles, no more than 90 days.⁷

Card networks run their own chargeback process on a longer clock, typically 120 days from the transaction.² Most people trigger it by calling the number on the back of their card. Useful, but it doesn’t replace the FCBA right, and the 60-day statutory deadline is the one to protect first. Review the statement carefully in the weeks after your stay so nothing slips past it.

1
PCI Security Standards Council. PCI DSS v3.2.1 Quick Reference Guide
2
Visa. Chargeback – Debit and Credit Card Purchase Disputes
3
Internal Revenue Service. How Long Should I Keep Records
4
eCFR. 16 CFR 682.3 – Proper Disposal of Consumer Information
5
State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
6
J.P. Morgan. Using Virtual Credit Cards for Travel Agency Payments
7
Office of the Law Revision Counsel. 15 USC 1666 – Correction of Billing Errors