The deadline running right now is measured in hours. An ordinary bank transfer can be frozen in the receiving account if the receiving bank is alerted before the fraudster moves it, a Bizum payment settles in seconds and cannot be revoked, and with a card there is a chargeback, whose clock also starts at the moment of payment. Every hour that passes without notice to your bank reduces what is left to freeze.
The criminal complaint has no deadline of its own, but the offence does become time-barred. Fraud under Article 248 of the Spanish Criminal Code prescribes after five years where the sum defrauded exceeds 400 euros and after one year where it does not, because it is then a minor offence (Articles 131 and 249). That margin is theoretical. The data that identify the perpetrator, the holder of the receiving account, the number he wrote from, the IP address used to upload the listing, are kept for a limited time and are only requested once a complaint is on the table.
Once the complaint is filed, the investigating court opens proceedings and writes to the receiving bank and the telecoms operator. That phase is counted in months. If an identified perpetrator emerges, he is questioned as a suspect and the case proceeds under the abbreviated procedure towards trial before the criminal court, or through the minor offence track if the amount is low. If no one emerges, the court orders a provisional stay, which closes nothing definitively and is reopened as soon as a new lead appears.
There remains the civil route against whoever collected the money, if he is ever identified, with a five-year limitation period (Article 1964 of the Spanish Civil Code) and, for claims up to 15,000 euros, the oral procedure since Royal Decree-Law 6/2023.
How the scam of the flat that does not exist is built
The listing is real in appearance and false in everything else. The photographs are copied from another listing, sometimes on the same portal, and the price sits below the market rate for the area, just enough to make you write first and ask later. The conversation quickly leaves Idealista for WhatsApp or email, and the supposed owner explains that he works outside Spain, cannot show the flat and will send the keys by courier or through a rental platform as soon as he receives the holding deposit, the security deposit or the first month. He attaches a formal-looking contract and a copy of an identity card that is not his. When the money arrives, he disappears, or asks for a second payment for “shipping insurance” that disappears too.
There are variants. A genuine estate agency whose portal account has been hijacked publishes listings that are not its own, so the verified professional badge no longer guarantees anything. A payment link sent by the fake landlord leads to a gateway that mimics the portal’s and harvests your card details. A flat that does exist is shown to several applicants on the same day and each is charged a reservation fee. And on the owner’s side, the fake tenant who “made a mistake” and transfers too much, asking for the difference back before the original transfer turns out to be fraudulent or is reversed.
What offence it is and what the penalty is
What has been done to you is fraud under Article 248 of the Spanish Criminal Code. The deception is the listing and the owner who does not exist, the error is yours in believing it, the act of disposal is the payment and the loss is the money that does not come back. The penalty is set by Article 249, imprisonment of six months to three years, graded according to the amount, the harm caused and the means used. Where the sum defrauded does not exceed 400 euros, it is tried as a minor offence with a fine of one to three months. Where the same listing has taken money from many people, the aggravated fraud of Article 250 applies for affecting a large number of victims or exceeding 50,000 euros, with imprisonment of one to six years and a fine. With a holding deposit and a security deposit of one or two thousand euros, you are in the imprisonment bracket, and that is what sends the case into a full investigation rather than a minor offence trial.
| Scenario | Provision | Consequence | Limitation period |
|---|---|---|---|
| Fraud not exceeding 400 euros | Art. 249 Criminal Code, minor offence | Fine of one to three months | One year |
| Fraud exceeding 400 euros | Arts. 248 and 249 Criminal Code | Imprisonment of six months to three years | Five years |
| Aggravated fraud, over 50,000 euros or a large number of victims | Art. 250 Criminal Code | Imprisonment of one to six years and a fine | Ten years |
| Civil claim against the identified recipient | Art. 1964 Civil Code | Refund of the sum with interest | Five years |
At the firm we act as private prosecutor in this type of case, and at this point the work consists of fixing the legal classification and the amount so that the complaint enters through the right door, which is what determines how much will be investigated. We explain it on our cybercrime page.
A deal between private individuals and a portal that only hosts listings
Two ideas need dismantling. The first is that there is a consumer law protecting you. A rental between private individuals is not a consumer relationship, and Royal Legislative Decree 1/2007 does not simply apply to someone who contracts with another private individual, real or fictitious. Your protection comes from the Criminal Code and the Civil Code.
The second is that Idealista sold you something. The portal is a noticeboard that hosts third-party content, under the intermediary regime of Law 34/2002 and the EU Digital Services Regulation, and it is not liable for the listing unless, once notified that it is fraudulent, it fails to remove it. Notifying the portal serves to take the listing down so that it stops attracting victims, and to have the portal preserve the data of the account that published it. It does not serve to get paid. It is the same scheme as accommodation bookings that do not exist, and I already explained on the blog what to do if you are scammed on Booking or Airbnb.
Recovering the money depending on how you paid
The payment method decides more than the amount. If you made a bank transfer, your bank can ask the receiving bank to freeze and return the funds, and that works as long as the money is still there. If you paid by Bizum, the operation is irrevocable, but the receiving phone number is linked to an account with an identifiable holder, and that holder is the first name to appear in the investigation. If you paid by card, a chargeback exists, and if you were led to a fake gateway that captured your details, the charge is an unauthorised transaction and payment services legislation obliges the bank to refund it. How that claim to the bank is framed, with which arguments and in which order, is the lawyer’s job, and at the firm we do it alongside the criminal complaint. I wrote about when the bank must refund you after phishing. If you paid in cash, by money order or in cryptocurrency, the money only comes back through the criminal route, once there is a convicted person with assets.
What to do today and what not to do
Save the listing with its web address and the date, even if the portal removes it later. Do not delete the WhatsApp conversation or the emails, including the files you were sent, the contract and the identity card copy, because that identity card usually belongs to another victim. Keep the payment receipt with the receiving IBAN or phone number. Stop talking to the fraudster. Trying to extract information from him on your own adds nothing to the investigation and usually ends in a second payment. Do not send any further documents and do not sign anything. If you were asked for your identity card and sent it, say so in the complaint, because that document can be used to contract in your name or to repeat the scam on others, and in that case there are additional offences, from usurpation of civil status under Article 401 of the Criminal Code to document forgery. File the complaint with the National Police or the Guardia Civil with all of that, and notify the portal.
How to check who the owner is before paying
This is for the next flat. The owner of a property is recorded at the Land Registry and anyone can request a nota simple, a registry extract, by the property’s address, at the relevant registry or through the Registrars’ online portal, for a few euros and with a reply in one or two days. The extract shows who the owner is and what charges the property carries. Ask the landlord for his identity card before sending anything and compare. An owner who lives abroad and has an empty flat in A Coruña has someone here to show it. One who does not, and asks for the deposit in order to send the keys, is describing the scam. Never pay a deposit without having entered the flat with the person named in the extract or with someone who proves he represents that person.
After the complaint
The competent investigating court is that of the place where you made the payment, because in these frauds the courts apply the ubiquity criterion. From there the holder of the receiving account is identified. Very often this is someone who lent his account in exchange for a commission and barely knows who he was working for. That person, the money mule, is civilly liable for the money that passed through his account and can be convicted of negligent money laundering under Article 301.3 of the Criminal Code, with imprisonment of six months to two years and a fine. If the account is in another EU country, identification is slower but possible. If it is outside the EU, the odds drop sharply and the weight shifts to the claim against the bank. You can join the proceedings as private prosecutor to request investigative steps and claim the refund within the same case, and if the case is stayed for lack of an identified perpetrator, that stay is provisional and is reopened on any new lead. You want to be inside the proceedings when that happens.
Whoever tries to sort this out alone usually loses the money twice. First with the payment, and then when he files a complaint without the amount properly fixed or the payment method documented, the court stays the case for lack of evidence and the bank rejects the claim because it was raised late or with the transaction wrongly classified. At the firm we fix the criminal classification, file the complaint and the appearance as private prosecutor, and in parallel raise the claim against the bank, in A Coruña and across Galicia. You can call +34 677 841 007 or write through our contact page, and you will find what we do under cybercrime. When you call, have to hand the screenshot of the listing with its link, the full conversation, the payment receipt with the receiving IBAN or phone number, and the date and method of payment. With that we know within ten minutes what can be recovered and how.
Frequently asked questions
How long do I have to report a rental scam?
The offence of fraud prescribes after five years if the sum defrauded exceeds 400 euros and after one year if it does not. That deadline is not your problem. The money is frozen or lost in the first hours, and the data identifying the perpetrator are kept for a limited time, so report it this week, not when you find the time.
Is there any point reporting it if the fraudster is outside Spain?
Yes, because the receiving account is almost never where the fraudster claims to be. It is frequently a Spanish account belonging to a money mule, and that person is identifiable and liable for the money. If the account is in another EU country, identification is slower but it gets done. Outside the EU the options come down to the claim against the bank.
Can I claim against Idealista if the listing came from a genuine estate agency whose account was hijacked?
Neither Idealista nor the agency is the one who took your money. The portal is liable only if, once notified of the fraud, it fails to remove the listing, and the agency only if the loss of its account was due to gross negligence that would have to be proved. In practice the useful claim is against whoever received the money and against your own bank over the payment method.
Is it worth hiring a lawyer if I was scammed out of 500 euros?
If you lost less than 400 euros and paid by transfer or Bizum, file the complaint yourself with what you have and do not spend money on a lawyer, because it is a minor offence and the road is short. Above that figure, and whenever you paid by card or through a fake gateway, it is worth it, because the claim against the bank and the private prosecution are the two routes with money at the end and neither is done well alone.