"Booking a 1.71 Million Won Luxury Hotel for Just 17 Won... 'We've Never Seen This Method Before'"

Hacked payment system to book hotels
Spanish police arrest 20-year-old man

This image is for illustrative purposes and is unrelated to the article. Pixabay

A 20-year-old man who habitually stayed at luxury hotels in Spain at bargain prices by hacking the payment system of a hotel booking website has been arrested by police.

According to AFP on the 18th (local time), the Spanish national is accused of manipulating the website's payment system by altering the authentication procedures of an electronic payment platform so that it appeared as though the accommodation fees had been properly paid.

A 1.71 million won hotel stay for 17 won

Police investigations found that the man hacked the online booking website’s payment system and booked luxury hotels where room rates went up to 1,000 euros (about 1.71 million won), while actually paying only 0.01 euros (about 17 won).

On the payment screen and in the booking records, it appeared that the full amount had been paid, but the amount actually transferred to the hotel was just 1 cent. Police said, "This cyberattack was designed to alter the payment authentication system itself," adding, "This is the first time we have identified a crime carried out in this way."

The investigation began after an online booking site reported suspicious transactions earlier this month. The transaction records appeared to show normal payments, but a discrepancy was detected a few days later when the payment platform relayed the actual transfer amounts to the hotel.

Police identified the suspect four days after receiving the report and arrested him on the spot while he was staying at a luxury hotel in Madrid. At the time of his arrest, he was reportedly in the middle of a four-night stay in a room worth a total of 4,000 euros (about 6.85 million won). Police said the damage caused to this hotel alone, where he had stayed multiple times, exceeded 20,000 euros (about 34.3 million won).

Warning over a new type of cybercrime

Police defined this case as "a new type of cybercrime that involved the sophisticated tampering of electronic payment authentication procedures." Local authorities stressed the need to strengthen security checks on travel and accommodation booking sites and payment platforms, and to expand procedures to re-verify the actual transfer amount even after payment has been marked as completed.