Article 248 of the Spanish Criminal Code punishes as fraud anyone who, for profit, uses sufficient deception to cause another person to err and induces them to make a disposition of assets to their own or a third party’s detriment. Applied to a booking, the listing for an apartment that does not exist, the message impersonating the hotel so that you pay again, or the host who asks for a bank transfer and disappears all fit that definition, and the money you sent is the disposition of assets. What changes from one case to the next is who is obliged to give it back, and that depends less on the offence than on the route the payment took.
The three versions that reach the firm
The first is the ghost listing. The accommodation does not exist, or it exists but is not managed by the person advertising it, and the photographs are copied from another site. You find out at the door of the building, with your luggage, when nobody answers the phone. It is less frequent on Booking because registering a property requires more checks, but on Airbnb and on smaller sites it remains the most common variant, and the price is usually the bait, well below the market on high-demand dates.
In the second the message arrives through the platform itself. The hotel’s messaging system has been compromised, usually because someone at the property fell for a phishing email, and from that legitimate account the fraudster writes to guests with confirmed reservations. The wording is always similar, citing a card verification, a problem with the charge, or the cancellation of the reservation unless you confirm payment through a link within the next few hours. The link leads to a page imitating Booking that captures the card details or charges it directly. The victim has no way of suspecting anything because the message appears in the official chat and quotes the reservation number, the dates and the guest’s name.
The third is the oldest and the one that leaves the most money unrecovered. The host, real or not, suggests paying outside the platform by bank transfer or Bizum on the pretext of saving the commission, of a problem with the payment gateway, or of a discount. It may have been the host from the outset, or someone who has hijacked a genuine profile. In both cases the result is the same, you have paid into a private individual’s bank account with no contract behind it, and the platform never saw that money.
There is a variant that combines the second and the third, the “cancelled reservation”. You receive an email or message saying the reservation was cancelled by mistake and that to keep it you must pay again, this time by transfer. Someone who had already paid by card ends up paying twice.
Why the platform does not answer for what you paid outside its system
Booking and Airbnb are intermediaries. They connect the person letting with the person booking, take a commission and, in some cases, process the payment. They are not a party to the accommodation contract. Their legal regime is that of intermediary service providers, first under the Spanish Information Society Services Act and since 2024 under the EU Digital Services Act, which exempts them from liability for content uploaded by their users as long as they have no actual knowledge that it is unlawful and act once they do. Their general terms, which you accepted when registering, say the same thing more plainly. What is paid through their gateway is covered by their protection programmes, within the limits each one sets, on the same logic I describe for Amazon’s guarantee with third-party sellers. What is paid by transfer to a host’s account, or through an external link, falls outside.
That exclusion is not absolute. The same EU Regulation requires platforms that allow contracts with traders to identify those traders and to design the service so that consumers know who they are dealing with, and it withdraws the exemption where the offer is presented in a way that leads an average consumer to believe the platform itself is the provider. In the hacked-chat case, moreover, the fraudulent message came through the platform’s official channel and carried data that only the platform and the hotel held. Booking’s automated reply that “the payment was made outside our system” does not close the matter. It is the starting point of a claim, and it is where we start work at the firm when a booking platform fraud case comes in, because the platform’s position has weak points that need to be identified.
Something similar applies to the accommodation. If the hotel is genuine and it was its system that was breached, the hotel is also a victim, but that does not automatically place it outside the problem. It held your reservation and card data, and if it knew about the breach and did not warn guests, there is room to argue its liability for the damage. It is a claim to be raised calmly and with full documentation, and it is not ruled out from the start.
What you can recover depending on how you paid
This is the fact that decides almost everything, which is why the first thing I ask is how you paid.
With a card, whether inside the platform or through the fraudulent link, there is the chargeback, the card network mechanism by which a charge is reversed when the service was not provided or the merchant was not who it claimed to be. And if your card details were captured on a fake website and used for charges you did not order, payment services regulation obliges your bank to refund unauthorised transactions, subject to exceptions the bank will try to apply. How that claim is framed, what is said and what is left unsaid, is the lawyer’s job, and I cover it in more detail in the article on what the bank must refund after a cyber scam.
A bank transfer or a Bizum payment is a different matter, because you ordered the transaction yourself. The bank cannot treat it as unauthorised, and what remains is to request a recall through the beneficiary’s bank, which only works if the money is still in that account, something that rarely happens after a few hours. That is why time matters so much in this variant. From there the route is to identify the holder of the receiving account and claim against them, through the criminal courts if there is fraud and through the civil courts in any event, and that requires a police report and a court order to the bank, because a private individual will not be given the name of an account holder.
Cash handed over on arrival, or a deposit paid in hand, leaves no payment institution to claim against and everything turns on proving who received the money.
Fraud or breach of contract, the difference that sets the route
Not every property that fails to match its listing is a fraud. If the flat exists, the host is who they claim to be, and the problem is that it has half the floor space, no air conditioning or a view onto a light well, the matter is civil. Article 61 of the Consolidated Text of the General Law for the Defence of Consumers and Users provides that the offer, promotion and advertising form part of the contract and are enforceable, so the photographs and the description in the listing are part of what you are owed. What you can seek in that civil claim is a price reduction, termination of the contract with a refund and, if you prove the loss, compensation.
The fourteen-calendar-day right of withdrawal for distance contracts, which many texts cite for this situation, does not apply to accommodation bookings for specific dates. The Act itself excludes it in Article 103 for accommodation services other than residential purposes where the contract provides for a specific date of performance. Anyone who tells you that you can cancel a hotel booking within fourteen days without giving a reason is quoting a rule that does not exist for this contract. What governs is the cancellation policy you accepted when booking.
Fraud arises when the deception was there from the outset. The listing was never real, the host impersonated someone else, the chat message was not sent by the hotel. There you have sufficient deception, error, disposition of assets and loss, which are the elements of Article 248, and the intent to profit follows from the very act of keeping the money. The practical difference is significant. In a civil breach you know who you are claiming against and the problem is proving what you were promised. In fraud the first problem is finding out who the fraudster is, and that requires criminal proceedings.
Penalties and limitation periods by amount
The Criminal Code grades fraud by the amount defrauded. Article 249 sets the general penalty at six months to three years’ imprisonment and, where the amount does not exceed 400 euros, reduces the offence to a minor offence punishable by a fine of one to three months. Article 250 aggravates it, with one to six years’ imprisonment plus a fine, among other cases where the amount defrauded exceeds 50,000 euros or the fraud affects a large number of people, which is usual in hacked-chat campaigns where the same group writes to hundreds of guests. The limitation period follows the penalty, under Article 131.
| Amount defrauded | Classification | Penalty (Articles 249 and 250 Criminal Code) | Limitation period (Article 131 Criminal Code) |
|---|---|---|---|
| Up to 400 euros | Minor fraud offence | Fine of one to three months | One year |
| Over 400 euros | Basic fraud | Six months to three years’ imprisonment | Five years |
| Over 50,000 euros or a large number of victims | Aggravated fraud | One to six years’ imprisonment and a fine of six to twelve months | Ten years |
The 400-euro figure matters more than it seems. A weekend booking often falls below it and is handled as a minor offence trial, with no compulsory lawyer, but also with fewer investigative resources. Once it is shown that the same receiving account has collected from several victims, the total changes the classification and the court takes a different view of investigating.
Where to report and what happens if the fraudster operates from outside Spain
In online fraud the Spanish Supreme Court applies the ubiquity criterion, under which the offence is deemed committed in every place where any of its elements took place. The disposition of assets, your payment, was made from where you were, so you can report at the police station or court of your own domicile even if the accommodation is in Lisbon and the receiving account in Lithuania. In A Coruña the report is filed with the National Police, the Guardia Civil or directly at the duty court, and for certain offences with no known perpetrator there is also online reporting through the National Police electronic office, although filing in person is usually more useful because it allows the full documentation to be submitted.
That the fraudster is outside Spain is the norm, and it needs saying plainly what that means. The investigation requires international cooperation, which within the European Union runs through the European Investigation Order and outside it depends on bilateral treaties and on the willingness of the requested country. For small amounts, that cooperation arrives late or not at all, and the case ends in a provisional dismissal because the perpetrator has not been identified. A provisional dismissal is neither an acquittal nor a judgment, the case can be reopened if the perpetrator is identified before the offence becomes time-barred, and that is what happens when a later police operation breaks up the group and cross-references the accumulated reports.
The report also has three uses that do not depend on anyone being arrested. It is the document the bank and the platform will require before processing any refund. It is the only way for a court to order the receiving bank to disclose the account holder’s name, who is often a person resident in Spain who lent their account and who can be claimed against, in criminal and civil proceedings. And it adds your case to the others, which is what allows the amount and the number of victims to raise the classification.
What you can do today on your own
Some things depend on you alone and, done in the first few hours, change the outcome.
Keep the complete platform chat, with screenshots showing the date, the sender and the reservation number, and do not delete it even if the platform tells you they already have it. The email or text with the payment link should also be kept, with the exact address it led to, without opening it again. The same goes for the transfer or Bizum receipt, which must show the recipient’s IBAN or phone number, and for the number or profile from which you were contacted. Download the original booking confirmation before the listing disappears, because fake listings are taken down within hours and with them the photographs, the host’s name and the terms. In these cases the electronic evidence you preserve is usually what decides the claim.
Do not pay anything to anyone, by any route, until the matter is clear. Phone numbers appearing in the suspicious message are not to be dialled, and anyone who contacts you offering to recover the money in exchange for an advance is the usual second scam built on the first. Notify your bank through its official channel, without using a number you have been given, and report the fraud to the platform from the app rather than replying in the compromised chat. With that done, the case retains everything that can be retained, and what follows is no longer your job.
Claiming on your own against the platform and the bank, in the face of the automated replies you will receive, has a specific cost, which is that what you put in writing in those first claims stays on file and can be turned against you when the bank argues that the payment was negligent, or when the platform closes the case with an email you accepted. At the firm we act for victims of fraud on booking platforms, we determine according to the payment method who to claim against and on what basis, we file the report with the documentation that leads the court to request the receiving account details, and we then claim against whoever is identified, through the criminal and civil courts. You can call +34 677 841 007 or write to us through the contact page. When you call, have to hand the booking confirmation, the payment receipt with the date and recipient, the screenshots of the chat or of the message with the link, and any reply the platform or the bank has already given you.
Frequently asked questions
Can I get my money back if I paid the host by bank transfer or Bizum?
It is the hardest variant, because you ordered the payment yourself and the bank cannot treat it as an unauthorised transaction. What remains is to attempt a recall through the beneficiary’s bank, which only works if the funds are still in the account, and to file a report so that the court identifies the holder of that account and a claim can be brought against them. The sooner you act, the better the chance the money has not left.
Booking says it is not liable because the payment was made outside its platform, is that true?
It is their starting position and it is supported by their terms and by the law, which treats the platform as an intermediary. It is not an absolute rule. Where the fraudulent message came through the official chat with data that only the platform and the hotel held, or where the platform presented the offer as its own, there are arguments to challenge its liability. That argument is not won through the app’s complaints form.
Does a police report help the bank refund me or is it just a formality?
It serves three specific purposes. The bank and the platform require it to process a refund, it is the only way for a court to order the receiving bank to disclose who collected the money, and it joins your case to those of other victims of the same group, which raises the criminal classification. The fraudster being outside Spain does not make it useless, although it does make a provisional dismissal likely until the perpetrator is identified.
Is it worth claiming for 400 or 800 euros and do I need a lawyer?
It depends on the payment method. If you paid by card, the chargeback and the claim against the bank almost always make sense and you can file the police report yourself. If you paid by transfer or Bizum to a foreign account and the money has already left, civil proceedings for 400 euros against an unidentified account holder are not worth it, and we will tell you so in the first call. It is worth it when the recipient has an account in Spain, when there are several victims of the same listing, or when the bank refuses a refund the regulation obliges it to make.