6 Tourist Scams in Medellín

A friendly group of locals at a Parque Lleras bar invites you to share a round, slips scopolamine — burundanga — into your drink, then walks you home as a compliant zombie who hands over phone, cards, and watch with a smile. By the time you wake up the next afternoon with no shoes, the bank accounts are empty and you don't remember a face.

It's a Friday night in Provenza and the rooftop bar two blocks off Parque Lleras has the kind of crowd that makes Medellín feel like the easiest city in South America. A woman at the next table catches your eye, raises her aguardiente shot, and waves you over. Her friend speaks decent English. Within ten minutes you're three deep at their table, music loud, and somebody is ordering another round you didn't pay attention to. The bartender brings the tray. You pick up your glass, clink, drink. Twenty minutes later the room narrows. You feel fine — better than fine. Whatever they're saying, you find yourself agreeing.

You don't remember leaving the bar. You don't remember the elevator. You wake up on a sofa or the floor of an apartment you've never seen, sometimes with your shoes off and your clothes wrong. The phone is gone. The wallet is gone. Your bank app — when you finally borrow a phone to check — shows ATM withdrawals to the daily limit at three machines in three neighborhoods, plus a Bre-B transfer you "authorized" at 4 a.m. The Swedish backpacker whose case El Tiempo published in 2024 woke up wearing his clothes inside-out, with no memory of the false guide who'd offered to walk him from Parque Lleras back to his hostel; everything he traveled with was gone.

Scopolamine — burundanga — is a powdered alkaloid extracted from the borrachero tree that grows wild across Antioquia. A few milligrams in a drink wipe out short-term memory and short-circuit the part of your brain that says no, while leaving you upright and conversational. The US Embassy in Bogotá issued a public security alert in January 2024 after eight US citizens died in suspicious drugging cases in Medellín between November 1 and December 31, 2023, almost all linked to El Poblado nightlife. In December 2024 the Alcaldía de Medellín announced the arrest of "La Reina de la Escopolamina" — the queen of scopolamine — who'd been operating out of Parque Lleras, and El Colombiano has tracked at least three named gangs ("Las Barbies," "Los Calvos," and the false-guide ring that drugged the Swede) running the same playbook on rotation. If a stranger orders or hands you a drink in El Poblado, leave it on the table — go to the bar, watch the bartender pour a fresh one into a sealed bottle or can, and keep your hand over the top until you sip it.

A match on Tinder, Bumble, or Grindr suggests a quiet drink at her place or a hotel bar in El Poblado, then disappears to "freshen up" while two accomplices arrive with a key and a knife, drug your drink, and clean out your phone, accounts, and Rolex before dawn.

She matched fast — too fast — and the photos look real enough that you don't reverse-image-search them. She suggests skipping the bar and meeting at a furnished apartment in El Poblado she's renting "with a friend." You take an Uber over, climb the stairs, and there's a bottle of aguardiente already opened on the kitchen counter. She pours two glasses. You talk for half an hour. She excuses herself to change. The buzzer rings, and she calls back from the bedroom that her friend forgot her keys — can you let him in?

It's two men, not one. They walk you back to the sofa with the kind of calm that tells you this is rehearsed. The drink you've already had is doing something to your reflexes. One of them takes your phone and asks for the unlock code in unaccented English. The other goes through the duffel for your passport, your laptop, your watch. The woman is gone, or she's the one quietly photographing your ID. You wake up alone the next morning with the door locked from the inside and your bank app showing wires you don't remember authorizing. A Belgian tourist who met his date on a Medellín app in 2024 lost more than 170 million pesos (~$40,000) the same way in Laureles — Rolex, cash, watches, the whole bag — according to El Colombiano's reporting.

The US Embassy in Bogotá issued its "Risks of Using Online Dating Applications" security alert on January 11, 2024, after at least eight US citizens died in Medellín between November and December 2023 in cases the embassy linked to dating-app meetups. Cal State Fullerton graduate Paul Nguyen, whose family told ABC7 he'd matched a woman on Tinder his last night in town, was one of the named victims. The New York Times' January 2024 investigation found that robberies of foreign visitors had roughly doubled year-over-year in Medellín through that period, with dating-app introductions cited as the most common opening move. The honeytrap works because it converts a screening problem (is this person safe?) into a logistics problem (can I find the apartment?), and apartments are private spaces with no bartenders, no bouncers, and no witnesses. If a match insists on meeting at a private apartment or short-term rental on the first date in Medellín, cancel — propose a busy public restaurant in Provenza instead, and if she refuses, you've already saved your trip.

You step off the curb in El Poblado at 1 a.m. and wave down what looks like a regular yellow taxi, but two blocks later the doors lock and a second man in the front passenger seat turns around with a gun. The next four hours are a forced ATM tour of half of Medellín — the millionaire's ride.

The Uber ETA is fifteen minutes and you're tired, so when a yellow taxi rolls up to the curb on Calle 10 outside the bar in El Poblado, you wave him over. The driver nods, pops the door for you, asks where you're staying. You give the address in your basic Spanish. The car pulls away. Two blocks down, at a red light, the front passenger door opens and a second man slides in next to the driver. You barely register it before he turns around in his seat with a small black handgun pointed at your chest and tells you, calmly, to hand over your phone and unlock it.

They drive you in a slow loop through Belén, Itagüí, Envigado, El Poblado — anywhere with an ATM. At each one the second man walks you in, stands at your shoulder, and reads the screen as you withdraw the daily maximum. They go through your apps. Bre-B, Nequi, Daviplata — they know which Colombian fintech apps Americans use, and they know the per-transaction limits. A Canadian backpacker staying at Los Patios hostel in 2024 (whose story circulated through Reddit threads) was held for about three hours, drained of every account, then dumped in a side street; locals helped him flag a real cab. In February 2025 the Policía Metropolitana de Medellín arrested "Los Calvos," a four-man crew El Colombiano reported had been running paseos millonarios on foreigners directly out of Parque Lleras for months.

The scam is called paseo millonario — "millionaire's ride" — because the per-victim take averages well into the millions of pesos once cards, fintech apps, and cash get drained. It works because Medellín's yellow-taxi fleet has no app-based identity verification: any car painted yellow with a meter on the dash can pull up to a curb at 2 a.m. and look legitimate. Real, regulated taxis exist — but the only way to verify one is to call from a hotel or use the Cabify or Tappsi app, which routes you through a vetted dispatch. Uber, InDriver, and DiDi route the same way. The crews target tourists at the exact moment a tired drunk gringo is least likely to wait fifteen minutes. Never hail a street taxi in Medellín after dark — open Uber, InDriver, or DiDi before you leave the bar, and wait inside the doorway with the bouncer until your specific license plate pulls up.

A friendly stranger off the Comuna 13 stairs offers you cocaine, you wave him off, and ten seconds later two men in untucked polo shirts flash a laminated badge and demand to "inspect" your wallet for the marked bills they say you just handled. The badges are fake, the shirts are the uniform, and the only way out is the cash in your pocket.

You're walking down from the Comuna 13 graffiti tour at the bottom of the orange escalators, or back to your Airbnb on a side street off Parque Lleras after dinner, when a man in a windbreaker steps in front of you and asks quietly if you want to buy cocaine. You shake your head, say no thanks, keep walking. Half a block later, two more men appear — one in front, one behind — pulling laminated ID cards out of their back pockets. They're plain-clothes police, they say. They saw the exchange. They need to see your wallet now to check for marked bills.

The ID is a printed laminate. The badge — if there is one — looks more like a security-guard pin than a Policía Nacional shield. They don't take you to a station. They tell you to empty your wallet on the hood of a parked car so they can "verify" your cash, and they pocket whatever they find. If you try to call 123, one of them grabs your wrist; if you ask for their cédula numbers, they get loud and start invoking arrest. The Reddit Reddit thread documenting the Cartagena pier version of this exact scam describes the same beat-for-beat staging — a drug dealer offers cocaine, a "cop" arrives within seconds, the cop and the dealer split the take. The choreography is too tight to be coincidence; they work as a single team.

Real Colombian police — Policía Nacional and Policía de Turismo — wear uniforms, drive marked vehicles, and never inspect a tourist's wallet at the curb. They take suspects to a CAI (Centro de Atención Inmediata) station. The Lawyers Colombia legal portal published a public alert on the "Colombian Fake Police MULTA" scam in 2024, naming El Poblado, Comuna 13, and downtown plazas as the most active zones, and noting that fake-officer crews have started carrying convincing laminate IDs purchased at Medellín stationery shops for under 20,000 COP (~$5). The whole shakedown rests on the tourist's instinct to cooperate with anyone who flashes a badge — and on the prior "drug offer" being fresh enough that the victim feels guilty even though they declined. If a plain-clothes "officer" demands to see your wallet on the street, say loudly that you'll only do it at the nearest CAI station and start walking toward Avenida El Poblado where actual uniformed police patrol — they'll vanish before you get there.

You're walking the salsa strip on Carrera 70 with your phone out checking Google Maps when a parrillero — a passenger on a motorcycle — leans out, plucks the phone from your hand at speed, and the bike is gone before you finish turning your head. In Colombia, locals call it "dar papaya": you handed it to him.

Carrera 70 in Laureles is the salsa strip — open-air bars, locals dancing on the sidewalk, a softer scene than the gringo crush of Parque Lleras. You stop at a corner near the Estadio metro to check the next club's address on Google Maps. Your phone is in your right hand, screen up, brand visible. Behind you, a small motorcycle — the cheap 125cc kind that's everywhere in Medellín — slows in the bike lane. You don't look up. The passenger, the parrillero, leans out and the phone is gone in a flick of the wrist that takes maybe a quarter of a second. By the time the air rushes past your face, the bike is already a block ahead, taking the next right.

There is nothing to do. You can't chase a motorcycle. The phone is, within ten minutes, on a workbench in one of the fifty unmarked phone-resale shops two German tourists tracked their stolen iPhone to in 2024 (their story posted to the Medellín Expats Facebook group). The SIM card has been pulled and tossed; the device is being parted out for screen, battery, and logic board. Your two-factor authentication apps are inside it. Your bank app is inside it. If you didn't have Find My iPhone set to lost-mode-with-passcode, somebody with your unlock code can drain Bre-B and Nequi before you can borrow a phone to call the bank. El Colombiano reported 99 documented street thefts in the El Poblado neighborhood in a single year — a rate of more than one every four days — with the great majority of phones taken by motorcycle pairs.

Colombians have a phrase for this: no dar papaya. Literally, "don't give papaya" — don't make yourself an easy target. Locals walk Medellín with phones tucked deep in front pockets, AirPods rare, watches turned face-in. The motorcycle phone-snatch is a structural feature of Colombian urban crime: motorbikes are cheap, lane-splitting is legal, helmets hide faces, and resale fences operate openly along the corridors near downtown. The Carrera 70, Estadio, Laureles, and Avenida El Poblado intersections are the densest snatch zones because they combine pedestrian density with two-lane bike access. Locals on Reddit threads repeat the same advice every week to incoming tourists: walk like you've lived here for a year. Use Google Maps offline-downloaded for Antioquia before you leave the hotel, drop the route into your head, and walk Carrera 70 with the phone in your front pocket — if you must check, duck into a café first.

A friendly English-speaking driver at José María Córdova offers a "flat rate" to your hotel for the 35-kilometer ride to El Poblado, then on the airport return trip charges 2,850,000 COP (~$750) instead of the 285,000 COP you agreed to — by adding a single zero to a handwritten receipt. The standard regulated white-taxi rate is 110,000 COP.

You land at José María Córdova International — 35 kilometers up the mountain from Medellín proper, in Rionegro — exhausted from the flight, jet-lagged, and unprepared for the altitude shift. Outside the arrivals hall, before you reach the official white-taxi line, an English-speaking driver waves you down with a friendly "Hotel? Where you going?" He quotes a price that sounds reasonable — maybe 200,000 or 285,000 pesos — and helps with the bag. You take it. Over your stay he texts you and shuttles you a few times around El Poblado, a chatty fixer-friend who knows the city. On your last morning he drives you back to MDE for the agreed fare. You hand him a card; he runs it; you go.

You don't notice until you're somewhere over the Caribbean: the charge that ran through is not 285,000 COP. It's 2,850,000 COP — about 750 USD, ten times the agreed amount. The driver added a zero. Two Canadian tourists, who'd traveled to Medellín for the Core Tomorrowland festival in May 2024, lived this exact scenario and surfaced it to Medellín Expat News and Pulzo. The friend they trusted for three days — the man who'd picked them up at MDE in fluent English — overcharged them by 2,565,000 COP on the ride back, on a card transaction they only spotted mid-flight. The standard regulated rate from MDE to El Poblado in a licensed white airport taxi is 110,000 COP (~$26), per the official airport tariff and per Reddit Reddit's pinned guidance. Anything dramatically over that — and especially anything quoted in English by a freelance driver — is a markup, a rigging, or a setup for a card-charge bait-and-switch.

José María Córdova works on a two-tier system. Inside the arrivals hall, an official white-taxi line dispatches metered or flat-rate cars to Medellín for 110,000 COP, and that rate is posted on signs in Spanish and English. Outside, on the curb past the official line, freelance drivers — some legitimate, some not — work tourists in English and quote whatever the market will bear. Uber, InDriver, and DiDi all run in Rionegro, but Colombia restricts ride-share pickups at airports, so app drivers will sometimes meet you across the parking lot with an additional surcharge. The only consistent defense is knowing the official rate before you walk past the taxi line. Take the regulated white airport taxi from inside the arrivals hall at the marked Taxi line, pay the 110,000 COP posted rate in cash, and ignore any English-speaking driver waving from the curb beyond.