A guest trashed their apartment and gave fake details: why online check-in needs identity verification

A host recently told us something no property owner wants to go through. A guest left their apartment wrecked. The host took photos, worked out the cost of the damage and went to the police to file a report. That’s when they realised the guest’s name, ID number and address were all fake.

The host did have online check-in, but their PMS only offered a form. The guest typed whatever they wanted, the system accepted it and nobody checked whether those details existed or belonged to them. When the host needed to know who that person was, there was no way to find out.

A form checks the format, not the identity

A check-in form validates that the ID number has the right length, that the date is a date and that the email contains an @. It can’t tell whether that ID belongs to the person typing it, or whether it exists at all.

For a guest with good intentions, that doesn’t matter. For someone who already knows they’ll cause trouble, a form is an invitation: they just invent a name or copy someone else’s. The host then hands the police details that lead nowhere.

The guest report sent to the authorities is built from that same data too. If it’s fake, the host has completed the paperwork with information that’s worthless.

What a document scan and selfie would have changed

With HazCheckin’s online check-in, guests don’t type their details. Their document provides them and their face confirms them:

1. Document scan. The guest photographs their ID card or passport and the data is read straight from the document. Nobody types it, so nobody can make it up.
2. Selfie with liveness detection. The guest takes a selfie and the system checks there’s a real person in front of the camera, not a printed photo or a screen. We cover it in depth in identity verification and liveness detection.
3. Face match. The face in the selfie is compared with the photo on the document. If they don’t match, the host sees it in the dashboard, on the reservation, before the guest arrives.

The result is simple: the details you hold belong to the person who will sleep in your apartment. If something goes wrong, your police report carries a real name and document, verified and tied to that person.

The best effect is the one you don’t see

The most useful thing about verification doesn’t happen after the damage, but before the booking. Someone planning a party or who knows they won’t respect the home looks for the place where nobody really asks them to prove who they are. When check-in requires a document and a selfie, many of those guests never finish it.

For everyone else, little changes. Scanning a document and taking a selfie is quicker than filling in a form by hand, and it’s done from the phone before arrival.

Is it legal to ask guests for a selfie?

Yes, as long as it’s done properly. A face image used to verify identity is biometric data, a special category under GDPR. Processing it is allowed with the person’s explicit consent (Article 9(2)(a) GDPR) and appropriate safeguards. This is how we apply it at HazCheckin:

• Explicit, informed consent. Before starting, the guest sees what their document and face are used for and ticks a box to give consent. Without it, nothing is processed.
• Limited purpose. The selfie is used to confirm that the document holder is the person checking in. Nothing else.
• Data stays in Europe. Face matching runs on servers in the European Union.
• Automatic deletion. Documents and selfies are deleted automatically when the retention period ends, without the host having to remember.
• No loose photocopies. This isn’t the same as photocopying an ID at reception and keeping it in a drawer, a practice the Spanish data protection authority has already fined. We explain it in the fines for photocopying guest IDs.

For consent to be freely given, guests who don’t want to take a selfie should have an alternative, such as identifying themselves in person on arrival. Face verification is optional per property: you decide where to turn it on.

What verification doesn’t do (and what it does)

Identity verification doesn’t stop a guest from breaking something. What it does is make sure that, if it happens, you know who it was and can claim for it. Combined with the contract the guest signs during check-in and a security deposit, it goes from paperwork to the protection the host in this story didn’t have.

If your online check-in today is just a form, ask yourself what you’d do with that data on the day you really need it. In HazCheckin, the document scan, the selfie and the guest report are a single process. See how it works on the platform.