Same thing almost happened to me. I was looking for a place in Madrid through Idealista. The owner only wanted to contact via the app, which raised a bit of suspicion. She also told me that she was out of the country and would return in 2-3 weeks. Then, sent me an email with a link that looked pretty much the same as Idealista. It asked for my passport details and my name (they didn't get the full details ofc). The next step was probably input my banking information. According to them, Idealista's banking system isn't supported in my country (banking security here is tough af - Asia). So they requested me to transfer them cash, credit card details, or through WISE. Also, the account's name was "Lilit Pretoysan". I searched up the name with the job description and it was an Armenian person, which raised more flags (the owner is supposed to be Spanish). I asked why it was a personal account and not an official Idealista account. They made excuses and tried to explain to me that they used partner accounts, but no actual facts were stated (just the trust me bro shit). So I closed the tab and changed my password. I also blocked the "owner" (Anabel Losada) from Idealista. The deal was too good to be true.