Loading story…
Spanish National Police arrested a 20-year-old Spanish national accused of hacking an online hotel booking workflow to fraudulently reserve luxury hotel rooms for €0.01 by manipulating the payment validation process. Authorities said the attack altered how an electronic payment platform’s validation was confirmed so bookings appeared fully paid, while only a nominal charge was actually processed; police described it as the first known case they have seen using this specific method.
Investigators opened the case after an unnamed booking website reported suspicious activity; the transactions initially looked legitimate and the discrepancy was only detected days later when the payment platform transferred the actual paid amount to the hotel. Police said the suspect repeatedly used the technique at a luxury Madrid hotel, causing losses exceeding €20,000, and was arrested while staying on a four-night reservation valued at about €4,000; authorities also allege he consumed minibar items and sometimes left those charges unpaid.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Following the arrest, the suspect was presented to judicial authorities on suspicion of computer fraud. Police said the investigation remained ongoing into repeated fraudulent bookings, unpaid minibar charges, and the broader impact on affected hotels.
Spanish National Police arrested the 20-year-old man while he was staying at a luxury hotel in Madrid on a four-night reservation worth about €4,000 that allegedly cost him only €0.01. Authorities said the scheme exploited a booking website’s payment validation flow, enabling repeated stays and losses exceeding €20,000 to at least one hotel.
After technical analysis of the manipulated payment-validation activity, Spanish police identified a 20-year-old Spanish suspect within four days of the initial complaint. Investigators described the case as complex and the method as a previously unseen or novel attack technique.
A travel or booking agency reported suspicious activity involving fraudulent luxury hotel reservations to Spanish National Police after noticing discrepancies in payment processing. Multiple sources place the report on 2026-02-02, marking the start of the investigation.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcebitdefender.com
Open sourcetechxplore.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **critical payment-processing flaw** was reportedly exploited in Spain by a 20-year-old fraudster who obtained luxury hotel stays for **€0.01** while merchants received what appeared to be legitimate payment confirmations for bookings worth **tens of thousands of euros**. The attack did not rely on stolen card numbers; instead, it allegedly **manipulated the transaction data flow** between a hotel booking site and a major payment platform so the merchant saw an approval for the full amount while the actual transferred value was only one cent. The case highlights an integrity failure in online payment validation rather than a conventional card-theft scheme. The reporting indicates the weakness stems from a **timing gap between payment authorization and final settlement**, allowing the discrepancy to remain undetected until days later, after the guest had already checked out. One account puts the direct loss at **more than €20,000** and says Spanish police identified the method as a new modus operandi. For security and fraud teams, the incident underscores the need for **real-time reconciliation** between authorized and settled amounts, stronger validation of payment notifications, and controls to ensure the amount confirmed by a processor exactly matches the amount ultimately received.
Jul 12, 2026
Spanish National Police, working with international partners, dismantled a cybercrime organization accused of stealing and laundering about **€140 million** through fake investment platforms, **business email compromise (BEC)**, CEO fraud, invoice fraud, and man-in-the-middle attacks. Investigators said the group operated an industrial-scale laundering network tied to more than **800 bank accounts**, **120 business accounts**, **19 companies**, and **67 money mules**, with confirmed links to over **€94 million** in transactions and another **€61 million** connected to 2024 CEO fraud activity. Authorities arrested **four suspects** in Spain, Portugal, and Panama during an operation supported by **Europol** and **Interpol**. Raids in Spain and Portugal led to the seizure of computers, smartphones, and other digital devices allegedly used in the schemes, while police froze **€3 million** in criminal proceeds for potential victim restitution. Officials said the network’s main operators were taken into custody and the laundering infrastructure was effectively dismantled, though the investigation into its wider international links remains ongoing.
Jul 16, 2026
Attackers are exploiting hotel reservation systems and booking workflows in a fraud campaign dubbed the **Reservation Hijack Scam**, using stolen reservation details and compromised staff accounts to contact real travelers through trusted channels including Booking.com messaging, email, SMS, and WhatsApp. Researchers said the scam is especially effective because messages arrive in legitimate conversation threads or from authentic hotel accounts, making fake payment requests appear to be routine customer service. Victims are then directed to spoofed guest portals, branded PDFs, or typo-squatted payment sites designed to steal card details or induce bank transfers. In more advanced intrusions, attackers first phish hotel employees for credentials to hospitality platforms such as **Cloudbeds**, or gain persistent access by tricking partners into running malicious commands that deploy a remote access trojan. Cloudbeds said observed cases were caused by credential phishing rather than a breach of its platform. The activity has been reported most heavily in the **UK, France, Germany, the US, Brazil, and Australia**, prompting recommendations that travelers verify payment requests only through official hotel or booking channels, while hospitality organizations strengthen phishing-resistant authentication, access controls, monitoring, and incident response.
Jun 29, 2026