Booking.com hosted a fake Madrid flat for six days while hundreds arrived with luggage

The listing called 'Palacio Central Madrid' offered a 53-square-metre apartment with breakfast, parking, free airport transfers, a spa and 24-hour reception for €90–180 a night, backed by a 7.7 score from more than 700 reviews. Travellers with confirmed bookings instead found an ordinary residential block at number 19 Avenida de Menéndez Pelayo by Retiro park, where neighbours say there has never been a tourist flat.

The listing ran for nearly a week before Booking.com removed it on Wednesday 7 October 2026. The building's gate carried a notice saying the accommodation advertised on Booking.com doesn't exist and directing anyone who paid to the Policía Nacional; one review gave the game away by praising the flat's location in Ferrol, a Galician port city hundreds of kilometres from Madrid.

The building's concierge, Cris Bellón, estimated more than 800 people were caught out, about 90% of them from abroad; on one evening about 50 waited on the pavement, including a Nigerian family bound for Milan and a Moroccan family with a baby. Two taxi drivers drove six Chinese tourists back to the airport, and the residents' association said one traveller left by ambulance after their blood pressure dropped.

Booking.com described the case as an incident affecting one of its partners — a hacked partner account, with the platform's own systems not breached — and said it offered travellers new accommodation 'whenever possible'; it has not said whether everyone who paid will be reimbursed. It is not an isolated pattern: this summer a real property near Siena had its Booking profile hijacked to sell a non-existent flat near the Colosseum, and in April Booking confirmed unauthorised third parties had accessed customers' booking details.

Concierge estimated 800-plus people caught out, about 90% from abroad; the listing ran six days before removal on 7 October; refunds still unresolved

Listing verification let a non-existent property carry hundreds of reviews, one of them describing another city entirely

The listing stayed live for six days while victims kept arriving at the address daily

Blaming a hacked partner account shifted attention from why the platform's own checks missed it

Refund responsibility was left ambiguous — the platform declined to promise everyone would be made whole

A 7.7 score from 700 reviews is only a trust signal if reviews provably come from real stays — when reviews can be carried over from another property, the platform's core promise is what failed.

Some victims filed complaints with the Policía Nacional, which is investigating; there is no official count. Consumer group OCU said its complaint records already include travellers who found properties non-existent, argued platforms profiting from bookings cannot act as 'mere intermediaries', and demanded genuine-listing checks, host verification, quick takedowns and fast refunds. Spanish MEP Laura Ballarín plans to ask the European Commission whether Booking breached up to four articles of the Digital Services Act, including rules on checking hosts' identity.