Hundreds left with nowhere to sleep after booking a Madrid holiday flat that didn’t exist

A listing with more than 700 reviews and a 7.7 rating looked like one of the safer bets in Madrid. Yet hundreds of travellers who booked it arrived to find a residential building, a sign telling them to go to the police and a review praising the flat’s location in Ferrol, Galicia.

How did a non-existent holiday flat have hundreds of reviews?

For close to a week, travellers from around the world have been wheeling suitcases up to number 19 on Avenida de Menéndez Pelayo, the street running along the edge of Madrid’s Retiro park, with confirmed bookings in their hands. 

What they found was an ordinary apartment block where neighbours say there’s never been a tourist flat, and a notice on the gate saying the accommodation advertised on Booking.com doesn’t exist and that anyone who paid should report it to the Policía Nacional (National Police).

The listing, named Palacio Central Madrid, promised a 53-square-metre apartment with breakfast, parking, free airport transfers, a spa and a 24-hour multilingual reception, all for between €90 and €180 a night. Its 7.7 score from more than 700 reviews was exactly the sort of thing that makes holidaymakers think ‘that many people can’t all be wrong’ and press book.

However, one of those reviews gives the game away, as it praised the flat’s location in Ferrol, a port city on Galicia’s north-west coast that’s hundreds of kilometres from Madrid.

Booking blames a hacked partner account 

Booking.com removed the listing on Wednesday October 7 after it had been live for six days, describing the case as an incident that had affected one of its partners. Sources familiar with the case said the platform’s own systems weren’t breached.

That explanation could also account for the reviews. Nobody has confirmed where they came from, so there’s no evidence they were made up. If criminals did take over a genuine advertiser’s account, though, the rating and comments may have belonged to a real property and been carried over to the fake Madrid flat, which would explain why at least one guest remembered being in Galicia.

It wouldn’t be the first time either. This summer, a real holiday property near Siena had its Booking profile hijacked and used to sell a non-existent apartment near the Colosseum in Rome. Then in April, Booking confirmed that unauthorised third parties had accessed customers’ booking details, including names, email and postal addresses and phone numbers. 

Booking said it had looked for alternatives and offered travellers new accommodation “whenever possible”, adding that its size makes it “an attractive target for cybercriminals”. It hasn’t said whether everyone who paid will get their money back. 

Families, retirees and a baby left on the pavement

The building’s concierge, Cris Bellón, estimates that more than 800 people have been caught out, around 90 per cent of them from abroad. On one evening alone, about 50 people were gathered on the pavement, including a Nigerian family on their way to Milan, a Moroccan family with a baby and two retired travellers from Ecuador. 

Two Madrid taxi drivers ended up taking six Chinese tourists back to Terminal 2 at the airport, while the president of the local residents’ association said one traveller was taken away by ambulance after their blood pressure dropped. Residents had first assumed the crowds waiting with luggage were there for a casting.

Some of those affected have filed complaints with the Policía Nacional, which is investigating, although there’s still no official count of victims.

Consumer group OCU wants faster refunds

Spain’s consumer organisation OCU said on Thursday October 8 that the Madrid case isn’t an isolated one, as its complaint records include travellers who turned up to find the property didn’t exist or the conditions were false.

It argued that platforms which profit from bookings can’t act as “mere intermediaries”, and that it isn’t enough to say the responsibility lies solely with the accommodation provider. Where there are reasonable signs of fraud, OCU wants platforms to help put things right and return the money paid.

The group is calling on Booking and other rental platforms to check that listings are genuine, verify who’s behind them, remove fraudulent ads quickly and set up fast refund procedures. Meanwhile, Spanish MEP Laura Ballarín plans to ask the European Commission whether Booking may have breached up to four articles of the Digital Services Act (the EU law setting out what online platforms must do to tackle illegal and misleading content), including rules on checking hosts’ identity.

What to check before booking a holiday flat in Spain

OCU’s advice is to check that the property’s tourist registration number matches the official regional register, pay only through the platform’s official channels and be wary of any request for a bank transfer outside it. It also recommends keeping every piece of documentation linked to the booking. 

Lawyers who handle similar cases suggest reading the detailed reviews rather than just the overall score, being wary of prices well below others in the area and looking the address up on Google Street View, which in this case would have shown a residential block rather than a spa. Paying with a virtual card can add an extra layer of protection too.

So anyone with a booking at the Madrid address, or who spots reviews that don’t match the city they’re travelling to, should contact the platform straight away, keep every message and payment receipt and report it to the Policía Nacional.