5 Legal Steps Victims Should Follow in Cases of Cyber Fraud Crime

While digitized financial infrastructures, e-commerce platforms, and mobile banking applications have made daily life easier, they have also fundamentally changed the methods of organized crime networks. Today, classic methods of fraud and deception have been replaced by sophisticated actions carried out in seconds via digital networks. Cybercrime , a type of cybercrime that directly targets not only the financial assets of victims but also their personal data and digital identity security, is one of the most common types of cybercrime.

The biggest mistake victims of online fraud make is panicking in the initial shock. Attempting to persuade the perpetrator by continuing communication, angrily deleting correspondence or receipts, or resorting to fake platforms that set up a second scam online promising to "recover your lost money" leads to irreparable losses. In cybercrime cases, time is the most critical factor; because transferred amounts change hands rapidly in digital pools, being transferred to crypto assets or shell accounts within minutes. Therefore, maintaining composure and fully understanding the technical and legal aspects of the process is essential.

Methods of Cyber Fraud Crime and the Basic Typologies Encountered

Cyber fraud activities do not adhere to a single pattern, but are carried out using constantly evolving and complex information technology techniques and psychological manipulation methods.

The most common typologies encountered in practice are as follows:

• Fake Payment Pages, Phishing, and Clone Websites : Perpetrators create exact visual copies (clone websites) of banks, government portals, shipping tracking companies, or popular marketplaces. Victims are lured into phishing networks via SMS, email, or social media advertisements with messages like "Your shipment could not be delivered," "Your account has been suspended," or "Affordable product," where their card information, one-time SMS verification codes, and personal data are stolen.

• Social Engineering, Fake Investment Networks, and IBAN Rental Scams: Victims are presented with "earning money through small tasks" scenarios via leveraged fake exchange platforms, fake cryptocurrency funds, or Telegram task groups promising high returns. In these systems, the victim's trust is first gained through small earnings payments; then, high-value transfers are requested. Organized IBAN rental scam networks targeting university students or those in need are used to conceal the money; thus, the amounts sent by the victim are distributed to rented accounts belonging to third parties, aiming to erase the trail.

• Unauthorized Access and Remote Control of Bank Accounts: Mobile banking systems are infiltrated through fake help/support applications (AnyDesk, TeamViewer, etc.) or pirated APK files installed on victims' phones. Suspects withdraw loans without the account holder's consent, empty overdraft limits, and transfer funds to different channels within seconds through unauthorized FAST/EFT transactions.

What does this mean?

Scammers no longer knock on your door; they bring a digital copy of your bank, shipping company, or a trusted online shopping site to your screen. While you think you're clicking on a simple shipping tracking link, buying an attractive second-hand item, or making a profitable investment, you're actually handing over your passwords to an organized crime network. Your money doesn't just sit idle; to prevent tracing, it's divided into dozens of different "escrow" bank accounts (student or third-party accounts) rented with money, and then quickly converted into crypto assets and digitally vanished. In short, this isn't a simple dispute, but a professionally designed digital trap to make your money inaccessible within minutes.

Information Systems Fraud Crime and Legal Sanctions (Turkish Penal Code 158/1-f)

In the Turkish Penal Code, fraud is defined as deceiving someone through fraudulent conduct, thereby causing harm to that person or another, and gaining benefit for oneself or another. However, when information technology tools are involved in the commission of the crime, the legislator does not consider this a simple deception. According to Article 158/1-f of the Turkish Penal Code, committing fraud "by using information systems, banks, or credit institutions as tools" is considered an aggravated form of the crime.

Distinguishing Between Simple and Aggravated Fraud: The fundamental difference between simple fraud, regulated in Article 157 of the Turkish Penal Code, and information system fraud lies in the means used by the perpetrator. In classic fraud, the parties often meet face-to-face, and deceptive actions are carried out through direct contact. In crimes committed through information technology, however, the perpetrator uses websites, banking infrastructures, counterfeit software, or digital communication networks as tools of manipulation. Because the anonymity offered by cyberspace almost completely eliminates the victim's ability to monitor the perpetrator, the elements of aggravated fraud are considered far more dangerous.

The law prescribes quite severe penalties for the actions covered under Article 158/1-f of the Turkish Penal Code, including the prescribed prison sentences and fines .

• Imprisonment Sentence: While the minimum sentence for aggravated fraud is normally 3 years, if the crime is committed through information systems or banks/credit institutions (clause f), the minimum sentence starts directly at 4 years and can go up to 10 years . If the crime is committed by three or more people or within the framework of an organized crime group, these sentences are increased by half or up to double.

• In addition to imprisonment, a judicial fine of [ amount] days is also imposed against the perpetrator. According to the clear provisions of the law, in acts falling under clause (f), the amount of the judicial fine cannot be less than twice the amount of the illicit gain obtained from the crime .

• Prohibition of Settlement: While simple fraud cases are subject to settlement under the Code of Criminal Procedure, aggravated fraud offenses under Article 158 of the Turkish Penal Code are not subject to settlement. This means that even if the parties reach an agreement, the investigation and prosecution will continue directly.

Competent Court and Nature of Public Prosecution: In cases of aggravated cyber fraud, the competent court is the High Criminal Court . Because the crime directly undermines public order, economic security, and general trust in information systems, it is not among the crimes subject to complaint. Even if the victim withdraws their complaint after filing it, or declares that their losses have been compensated, the Public Prosecutor's Office will continue the investigation ex officio, and the public prosecution will be decided by the High Criminal Court. Compensation may only lead to the application of the "effective repentance" provisions under Article 168 of the Turkish Penal Code and a reduction in sentence; it does not result in the dismissal of the case.

What does this mean?

Individuals who trap you through the internet or bank accounts cannot simply be released as if they committed a minor offense when caught. The law considers those who misuse computer and banking systems to be directly liable for "serious crimes." These cases are handled not by lower courts, but by the High Criminal Court, which deals with the most serious offenses. Since the minimum prison sentence for the perpetrator starts at 4 years, it is legally extremely difficult to have the sentence suspended or directly converted to a fine. Moreover, even if the suspect calls you and says, "I'll give you your money back, withdraw your complaint," and you withdraw your complaint, the state will not let go of the perpetrator; the case will not be closed, and the public prosecution will continue until a conviction is handed down.

Immediate Steps to Take in the First 24 Hours of a Fraud Incident

When a cyber fraud case is detected, the initial steps taken are the most critical stage in determining whether the money can be recovered and whether the perpetrators can be identified. Instead of acting in panic, victims should quickly implement the following technical and administrative measures according to a specific plan:

• Contacting Bank Customer Service and Reporting Suspicious Transactions: As soon as fraud is detected, the bank's direct lost/stolen or suspicious transaction line should be contacted immediately. Clearly explain to the customer representative that an unauthorized transfer has been made or that money has been transferred through a fraudulent transaction, and immediately open a suspicious transaction report . If the transfer was an EFT, wire transfer, or FAST transaction , a request to block the target account at the receiving bank should be submitted immediately. If the money is still in the receiving bank's pool or has not yet been withdrawn as cash from the suspicious account, the transfer can be stopped through the interbank fraud reporting mechanism. At the end of the call, be sure to request the case/ticket ID.

• Securing Digital Evidence: In investigations into cybercrime , it is impossible to proceed without concrete technical data. Therefore, a complete record of all channels through which the perpetrator was contacted must be obtained.

  • The fake website links (full URL addresses) used by the suspect.

  • Social media profiles, usernames, shared fake certificates.

  • Take screenshots of your WhatsApp, Telegram, or SMS conversations and back up your chat history (avoid directly deleting the chat or reporting and then deleting it).

  • Bank transfer transaction receipts (the sent IBAN, recipient's name and surname, reference number, and transaction time must be clearly visible).

  • If it's a crypto transfer, the relevant transaction code (TXID) and the destination wallet addresses.

• Device Security and Network Isolation: If a mobile banking account has been compromised remotely or via malicious APK software, it is crucial that the victim does not immediately "reset the device to factory settings." Resetting the device will erase backdoor records, IP traces, and digital logs left behind by the perpetrators, making forensic analysis impossible. Instead, the phone or computer should be immediately put into airplane mode, Wi-Fi and cellular data connections should be disconnected, and the device should be isolated from the network; any evidence should be preserved until it is submitted to the authorities.

What does this mean?

The first few minutes after realizing you've been scammed are like a fire breaking out. The money withdrawn from your account doesn't just sit there; criminals distribute the money to third parties' accounts or convert it to cryptocurrencies within minutes, attempting to cover their tracks. Calling your bank immediately and reporting a "suspicious transaction" is an emergency brake that will prevent the money from being withdrawn from the other account or disappearing elsewhere. Panic-induced resetting your phone or deleting messages with the scammer is equivalent to wiping away fingerprints at the scene. Therefore, you should immediately save messages, receipts, and links, turn off your device's internet, and not destroy the digital traces that will allow the police and prosecutors to find the perpetrator.

Prosecutor's Complaint and the Process of Criminal Investigation

Once the necessary urgent notifications are completed at the bank, the formal legal process should be initiated without delay. Since the crime of cyber fraud is an act investigated ex officio, clarifying the incident depends on a thorough technical investigation conducted by the judicial authorities.

• Complaining to the Cyber Crimes Investigation Bureau of the Public Prosecutor's Office: In cases of cyber fraud, filing a criminal complaint directly with the Cyber Crimes Investigation Bureau, which is part of the competent Public Prosecutor's Office, significantly speeds up the process. While it is possible to file a complaint with the police station or gendarmerie, the transfer of documents to the prosecutor's office can cause delays. A criminal complaint is made by submitting a comprehensive petition to the courthouse of the victim's place of residence or to the public prosecutor's office in the place where the crime was committed (where the bank branch to which the money was transferred is located).

• Mandatory Technical Information to be Included in a Complaint Petition: Standard, abstract, general complaint petitions can obstruct the investigation or prolong the process. In addition to a chronological account of events, the petition must clearly state technical details:

  • Sender and recipient bank account details, IBAN numbers, and the exact transaction time, down to the second of the transfer.

  • Domain names, full URL structures, and server IP addresses (if any) of phishing sites.

  • The suspect's contact information, including mobile phone numbers, WhatsApp/Telegram accounts, and digital profile links.

  • The relevant receipts, screenshots, and digital evidence should be numbered and submitted to the prosecutor's office as attachments to the petition.

• Forensic Computing Investigations: IP Address Tracing, Log Records, and HTS Transcripts. After the prosecutor's office processes the complaint, it sends a forensic instruction to the Cyber Crimes Department of the police department. Within this scope;

  • The Information and Communication Technologies Authority (BTK) and relevant internet service providers (ISPs) are contacted to identify the IP addresses, port numbers, and subscriber identities used at the time of the crime.

  • Bank transactions of the accounts to which the money was transferred, internet banking login logs, and ATM camera footage are examined.

  • Retrospective HTS (communication traffic) records are obtained and added to the file in order to uncover the suspects' communication network, accomplices, and location data.

What does this mean?

Cybercriminals constantly leave technical footprints in the digital world. However, for a prosecutor to follow these footprints isn't like a series of TV shows where a prosecutor simply presses a few buttons; each step is linked to a chain of legal procedures. The prosecutor first sends an official letter to the bank asking, "Whose account did this money go into?", then sends a letter to the telephone company asking, "Which IP address connected to this line at that time?". It takes a certain amount of bureaucratic time for institutions to respond to these official letters. The more technical evidence you provide in your complaint, from the time of the money transfer to the link used, the easier it becomes for the prosecutor to write to the right places, and the less likely your case is to be closed as an unsolved crime.

Compensation for Material Damages: Enforcement Proceedings and Legal Cases

In cyber fraud cases, the most common misconception among victims is that filing a complaint with the prosecutor's office or initiating a criminal trial in the High Criminal Court will automatically return their money to their accounts. However, in Turkish law, criminal proceedings and private law proceedings are subject to completely different purposes and procedural rules.

• Distinction Between Criminal Cases and Compensation Claims: The primary duty of a criminal court is to determine whether a crime has been committed, to ascertain the criminal responsibility of the perpetrator, and to impose imprisonment or a fine. When sentencing the perpetrator, the criminal court does not, on its own initiative, decide on compensation for the material damage suffered by the victim or the return of the money. Therefore, in order to actually recover the amount lost due to the crime of information systems fraud , debt collection lawsuits must be filed in civil courts independently of the criminal investigation, or enforcement proceedings must be initiated with enforcement offices to recover the defrauded money . Requesting a precautionary attachment order from the court without delay to prevent suspects or front individuals from concealing assets is the most fundamental instrument to increase the chances of collection.

• Unjust Enrichment Lawsuits Against Account Holders to Whom Funds Were Transferred : Cybercrime networks frequently use "rented" bank accounts belonging to third parties to conceal transferred funds. Even if the account holder claims in criminal proceedings, "I let my friend use my account; I was unaware of the incident," this does not absolve them of liability under private law. According to Articles 77 and subsequent articles of the Turkish Code of Obligations, an unjust enrichment lawsuit can be filed against the account holder for an increase in assets without a justifiable legal reason. This allows the victim to recover their losses directly from the legal owner of the bank account through seizure of assets.

• Legal Liability Arising from Gross Negligence and Security Breach of the Bank: According to the established jurisprudence of the Supreme Court, banks are "institutions of trust" and are obligated to protect their customers' deposits against all types of digital attacks (objective duty of care). In cases of unauthorized money transfers without the customer's explicit consent, fake SIM card cloning incidents, and suspicious access to internet banking from unusual locations/at night , the bank's liability arises if its security algorithms prove insufficient. Unless the victim has committed gross negligence in sharing their password, the damages resulting from the bank's security vulnerability, which is contrary to regulations, can be claimed directly from the bank through compensation lawsuits filed in consumer courts or commercial courts of first instance.

What does this mean?

A criminal court may imprison the perpetrator, but it won't put your money back in your pocket. No matter how severe the sentence, the only way to recover the money is through private law, meaning filing a separate debt collection or compensation lawsuit. Even if the person who received the money claims, "I only rented out my account to someone, I'm not the fraudster," they are legally obligated to return the money to you down to the last penny for unjust enrichment. Furthermore, if your bank turned a blind eye to suspicious and unusual withdrawals from your account or allowed a security breach, you can pursue your money directly through the bank. In short, while the prosecution process is underway to ensure the perpetrator receives punishment, civil lawsuits must be filed immediately to recover the money.

Professional Legal Consulting and Case Management in Cybercrime Cases

In cases of cybercrime , expert support is essential to ensure the legal process is not left to chance and that no mistakes are made in complex procedural rules. This is where a cybercrime lawyer (commonly referred to in practice as a criminal defense lawyer ) steps in, managing the technical and strategic moves that determine the fate of the case from start to finish.

• Risk of Loss of Evidence and Monitoring Statute of Limitations: The evidence gathering process in cybercrimes is extremely sensitive due to the potential for digital data (IP logs, server records, crypto wallet transactions) to be deleted in seconds. Securing electronic records and avoiding missing legal deadlines, such as the statute of limitations for cyber fraud, is only possible with professional monitoring. Otherwise, concerns about "how long will a fraud case take?" may be replaced by irreversible loss of rights due to incomplete procedures.

• Procedures for Appealing Decisions of Non-Prosecution (KYOK): During the investigation phase, the prosecutor 's office may issue a decision of non-prosecution (KYOK) on grounds such as the perpetrators having foreign connections, their identities not being established, or insufficient evidence being found. In such cases, the appeal against the non-prosecution decision must be filed with the Magistrates' Court within the 15-day legal period, emphasizing any deficiencies in the forensic IT investigations.

• Evaluation of Technical Forensic Computing Reports: Forensic computing expert reports obtained through the prosecutor's office or court in cyber fraud cases contain highly complex technical terminology. Refuting adverse aspects in these reports using legal language, and clearly explaining inconsistencies in HTS records or log files to the court in a way that will be interpreted favorably, directly depends on the lawyer's technical knowledge and experience in cyber criminal law practice.

• Simultaneous Management of the Process in Criminal and Civil Law Aspects: The case must be followed not only in terms of punishing the perpetrators (criminal trial) but also in terms of compensation for damages (civil/unjust enrichment lawsuit). To avoid loss of rights, it is essential that both processes are managed simultaneously and in a coordinated manner, treating each as a pending matter.

What does this mean?

Simply submitting a standard petition to the police station or courthouse requesting "appropriate action" is unfortunately ineffective in cyber fraud cases. This is because digital data is quickly deleted, and if your complaint isn't properly documented and supported by technical details, the prosecutor's office may close the case citing "insufficient evidence." If the case is closed, you must appeal to the judge within the prescribed time limit, providing valid reasons, and identify and explain any errors in the technically complex computer reports presented to the court in a way the judge can understand. Furthermore, you must pursue two separate legal avenues simultaneously: to have the perpetrator imprisoned and to recover your money. Attempting these procedures on your own, due to a lack of knowledge of procedural rules, could lead to you being unjustly accused and your case being shelved.

Schedule an online appointment for legal review and process evaluation.

Investigation and compensation processes for crimes committed through information systems require a high degree of precision due to the analysis of technical reports, strict statutes of limitations, and procedural law rules. A comprehensive legal review of existing digital evidence, bank records, and technical data in accordance with current legislation and Supreme Court precedents at the outset is crucial in preventing potential loss of rights. A legal assessment of the case documents within the specific context of the incident clarifies the judicial and administrative roadmap to be followed.

Online Appointment Request

Frequently Asked Questions (FAQ)

Does filing a criminal complaint automatically refund the stolen money?

No. Criminal courts focus solely on convicting the perpetrator. Recovering the funds requires initiating a separate civil lawsuit (such as unjust enrichment) or debt collection proceedings.

Is legal mediation possible in cyber fraud crime cases?

No. Cyber fraud under Article 158/1-f of the Turkish Penal Code is classified as an aggravated crime and is strictly excluded from mediation.

Are individuals who rent out their bank accounts (IBANs) legally liable?

Yes. Account holders who lend their bank credentials face criminal investigation as accomplices and are legally liable under the Code of Obligations to repay the received amount.

What is the very first step after discovering cyber fraud?

Immediately contact your bank’s fraud department to report suspicious activity, request a transfer block on the target account, and preserve all digital logs without deleting any chats or receipts.