Cybercrime in Türkiye: Account Takeover, Card Fraud and What Victims Can Do

Takeover of social media or email accounts, theft of card details through fake links, unauthorised online banking transactions and fake sale listings are among the most common cybercrimes today. This article outlines the key provisions of the Turkish Criminal Code and the first steps victims can take.

Main offences under the Turkish Criminal Code

Unauthorised access to a computer system (Art. 243)

A person who unlawfully accesses all or part of a computer system, or remains in it, is punished with imprisonment of up to one year or a judicial fine. If data in the system is destroyed or altered as a result, the penalty is six months to two years' imprisonment. Unlawfully monitoring data transfers between computer systems with technical means, without entering the system, is a separate offence. Accessing another person's social media or email account by obtaining their password is assessed under this article in practice.

Disrupting systems, destroying or altering data (Art. 244)

This article covers obstructing or disrupting the operation of a computer system and corrupting, destroying, altering or making inaccessible data, inserting data into a system or sending existing data elsewhere. Committing these acts against systems of banks, credit institutions or public bodies increases the penalty, and obtaining unjust benefit by these means attracts a heavier penalty.

Misuse of bank or credit cards (Art. 245)

A person who obtains another's bank or credit card in any way and benefits by using it, or having it used, without the cardholder's consent is punished with three to six years' imprisonment and a judicial fine. Producing, selling or using counterfeit cards carries heavier sanctions.

Aggravated fraud through IT systems (Art. 158(1)(f))

Committing fraud by using IT systems, banks or credit institutions as instruments is an aggravated form of the offence. In such cases, the minimum prison term may not be less than four years, and the judicial fine may not be less than twice the benefit obtained. Fake e-commerce sites, fake listings and fraud by persons posing as bank staff or public officials frequently fall within this category.

Recent change: those who hand over their account or card

Under the fourth paragraph added to Article 158 by Law No. 7589 of 16 July 2026, where participation in fraud is limited to giving another person one's own or another's payment instruments, such as bank or credit cards, or the information or tools necessary to use an account held with a bank, brokerage, payment service provider or crypto-asset service provider, in order to obtain unjust benefit, the penalty is reduced by half. This makes clear that people who "rent out" their bank accounts or share card details may be held liable as participants in fraud. We have covered this in detail in a separate article.

First steps for victims

• Call your bank immediately: block your card, dispute unauthorised transactions and record your dispute in writing.
• Secure your accounts: change passwords, enable two-factor authentication and check the email and phone details linked to your account.
• Keep evidence: do not delete messages, emails, fake site or listing links, receipts or screenshots.
• File a complaint: apply to the Chief Public Prosecutor's Office or the police, including details of accounts to which money was transferred.
• Report to the platform: report the compromised account or fake listing to the platform concerned.

Recovering money

A criminal investigation allows the offender to be identified and, where necessary, protective measures concerning accounts. In addition, the victim may bring a civil action against the offender for compensation or pursue their rights by joining the criminal proceedings. Whether the bank fulfilled its security obligations may also be assessed depending on the facts.

Conclusion

Acting quickly is decisive in cybercrime cases: the sooner the bank is notified, accounts are secured and evidence is preserved, the easier it is to limit the damage and identify the offender.

This article is for general information purposes only and does not constitute legal advice.