Loading story…
A critical payment-processing flaw was reportedly exploited in Spain by a 20-year-old fraudster who obtained luxury hotel stays for €0.01 while merchants received what appeared to be legitimate payment confirmations for bookings worth tens of thousands of euros. The attack did not rely on stolen card numbers; instead, it allegedly manipulated the transaction data flow between a hotel booking site and a major payment platform so the merchant saw an approval for the full amount while the actual transferred value was only one cent. The case highlights an integrity failure in online payment validation rather than a conventional card-theft scheme.
The reporting indicates the weakness stems from a timing gap between payment authorization and final settlement, allowing the discrepancy to remain undetected until days later, after the guest had already checked out. One account puts the direct loss at more than €20,000 and says Spanish police identified the method as a new modus operandi. For security and fraud teams, the incident underscores the need for real-time reconciliation between authorized and settled amounts, stronger validation of payment notifications, and controls to ensure the amount confirmed by a processor exactly matches the amount ultimately received.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Spanish police arrested a 20-year-old alleged hacker accused of manipulating online payment flows so stays worth thousands of euros in Madrid luxury hotels were validated after only a one-cent payment. The case exposed a timing gap between payment validation and final settlement in booking and payment workflows.
A travel agency reported a fraud scheme in which luxury hotel reservations were confirmed even though only one cent was actually transferred, triggering the investigation. Reported losses from the scheme exceeded 20,000 euros.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Spanish National Police arrested a **20-year-old Spanish national** accused of hacking an online hotel booking workflow to fraudulently reserve luxury hotel rooms for **€0.01** by manipulating the **payment validation** process. Authorities said the attack altered how an electronic payment platform’s validation was confirmed so bookings appeared fully paid, while only a nominal charge was actually processed; police described it as the **first known case** they have seen using this specific method. Investigators opened the case after an unnamed booking website reported suspicious activity; the transactions initially looked legitimate and the discrepancy was only detected **days later** when the payment platform transferred the *actual* paid amount to the hotel. Police said the suspect repeatedly used the technique at a luxury Madrid hotel, causing **losses exceeding €20,000**, and was arrested while staying on a **four-night reservation** valued at about **€4,000**; authorities also allege he consumed minibar items and sometimes left those charges unpaid.
Jun 29, 2026
Attackers are exploiting hotel reservation systems and booking workflows in a fraud campaign dubbed the **Reservation Hijack Scam**, using stolen reservation details and compromised staff accounts to contact real travelers through trusted channels including Booking.com messaging, email, SMS, and WhatsApp. Researchers said the scam is especially effective because messages arrive in legitimate conversation threads or from authentic hotel accounts, making fake payment requests appear to be routine customer service. Victims are then directed to spoofed guest portals, branded PDFs, or typo-squatted payment sites designed to steal card details or induce bank transfers. In more advanced intrusions, attackers first phish hotel employees for credentials to hospitality platforms such as **Cloudbeds**, or gain persistent access by tricking partners into running malicious commands that deploy a remote access trojan. Cloudbeds said observed cases were caused by credential phishing rather than a breach of its platform. The activity has been reported most heavily in the **UK, France, Germany, the US, Brazil, and Australia**, prompting recommendations that travelers verify payment requests only through official hotel or booking channels, while hospitality organizations strengthen phishing-resistant authentication, access controls, monitoring, and incident response.
Jun 29, 2026Gen Threat Labs reported that **more than 350 accommodations in 50 countries** were tied to "Reservation Hijack" scams that used real booking details to target travelers with convincing phishing messages. The campaigns delivered fraudulent payment requests through **SMS, WhatsApp, email, and in-app messages**, directing victims to fake accommodation-branded payment pages. Researchers said the activity appeared organized and repeatable, citing shared phishing-page components, repeated asset paths, fake live-support chat features, and common card-validation language across multiple incidents. The findings followed **Booking.com** warnings to customers that unauthorized parties may have accessed reservation-linked information and reset reservation PINs, indicating exposure of private booking data that could be used to personalize scams. Gen said the largest concentration of affected properties was in Europe—especially **Germany, France, the United Kingdom, Italy, and Spain**—but the activity also reached the **United States** and other regions. The company urged travelers to verify payment requests only through official booking channels, while accommodations were advised to strengthen **MFA**, account monitoring, endpoint protection, and staff phishing awareness.
Jun 29, 2026