Spanish police arrested a 20-year-old hacker accused of booking luxury hotel rooms worth up to €1,000 a night for just one cent before being caught.

Spanish police arrested a 20-year-old man in Madrid after allegedly manipulating the online payment system of a travel and hotel booking website to secure luxury hotel stays for just €0.01 per reservation. The scheme allowed him to book rooms costing up to €1,000 per night, causing more than €20,000 in losses to one hotel alone.

“He manipulated the online payment system and obtained reservations at high -end hotels , costing up to 1,000 euros per night, for minimal prices” reads the press release published by the Spanish National Police.

The investigation began on February 2 after a travel agency reported suspicious bookings on its website. Investigators found the suspect had sabotaged the integrated payment gateway, selecting a well-known international payment platform and launching a tailored cyberattack to alter the transaction validation process.

“The cybercriminal sabotaged the payment gateway system integrated into a hotel booking website. To do this, he selected the payment option through a well-known international electronic payment platform and, using a specifically designed cyberattack, altered the transaction validation process, causing the system to authorize the operation after entering only one cent.” continues the press release.

The system approved reservations as fully paid, while only one cent per booking was actually transferred. The fraud surfaced days later when the company received the minimal payments, revealing losses of about €20,000 in what police say is a previously unseen modus operandi.

After a detailed technical analysis, the police identified the suspect within just four days and arrested him while he was staying at a luxury hotel in Madrid. He had allegedly booked four nights at €1,000 per night and even consumed minibar items, leaving unpaid charges at some hotels. He was brought before judicial authorities on suspicion of computer fraud, and the investigation is still ongoing.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, luxury hotel payment hack)