

Can WhatsApp screenshots prove fraud, threats or harassment in Turkey? Learn how Turkish prosecutors and criminal courts evaluate screenshots, deleted messages, fake conversations, phone examinations, account ownership and digital evidence.
WhatsApp screenshots are frequently submitted as evidence in Turkish criminal investigations involving fraud, threats, harassment, blackmail, insults and financial disputes. A complainant may arrive at a police station or prosecutor’s office with several screenshots and claim that they prove who committed the offense. However, a screenshot and proof of criminal responsibility are not necessarily the same thing. Turkish criminal proceedings require evidence to be evaluated together, and digital evidence raises particular questions concerning authenticity, authorship, completeness, integrity and context. A screenshot may show words appearing on a screen, but the investigation may still need to determine who actually controlled the account, whether the conversation was manipulated, whether messages were omitted, whether the telephone number belongs to the accused person and whether the content actually proves the alleged crime. For foreigners involved in criminal proceedings in Turkey, these questions can become especially important where foreign telephone numbers, business WhatsApp accounts, translation issues or shared corporate devices are involved. Official judicial training materials also emphasize the potential for manipulation of instant-messaging screenshots and the importance of evaluating electronic material together with other evidence. (Adaylık)
Yes. WhatsApp conversations and screenshots can potentially be presented and evaluated as evidence. The fact that evidence exists electronically does not make it automatically inadmissible or automatically conclusive.
The real question is how much evidentiary weight should be given to the screenshot in the particular criminal case.
Suppose a complainant submits an image showing:
“John: Send €20,000 or I will kill you.”
The screenshot may be highly relevant, but several factual questions remain unanswered.
Who is “John”?
What telephone number is behind that saved contact name?
Who actually controlled that number?
Was the screenshot taken from the original device?
Does the complete conversation exist?
Were earlier or later messages deleted?
Has the image been edited?
What was the context?
WhatsApp normally displays the name saved by the person using the telephone.
Therefore, a screenshot displaying “Michael,” “Ahmet,” “Boss,” “My Partner” or another name does not by itself establish the legal identity of the sender.
Where authorship is disputed, identifying the actual telephone number associated with the alleged communication can become critical.
Even identifying the registered subscriber may not end the investigation.
A SIM card can sometimes be used by a family member, employee or another person.
Cases involving foreigners can create additional complications because the WhatsApp account may operate through a foreign telephone number.
The investigation should therefore distinguish:
Registered Subscriber → Actual Device User → WhatsApp Account User → Person Sending the Specific Message.
Potentially, but fraud cases usually require examination of considerably more than a single message.
Suppose a foreign investor receives WhatsApp messages stating:
“Transfer €100,000 today and your apartment will be registered tomorrow.”
The investor transfers the money, but the alleged seller disappears.
The screenshots can help establish the representations made before payment, but the criminal investigation should also examine the bank transfer, property records, identity of the recipient, telephone-number information and surrounding communications.
A useful evidentiary sequence is:
WhatsApp Representation → Victim Relies on Representation → Bank Transfer → Money Received → Promised Transaction Never Occurs → Subsequent Movement of Funds.
If a message says “send TRY 500,000 to this IBAN” and the victim subsequently transfers exactly TRY 500,000 to that account, the banking record can materially strengthen the evidentiary picture.
The person receiving money and the person sending WhatsApp messages may not necessarily be the same person.
A suspect may argue that someone else used their bank account.
That explanation should be evaluated together with telephone communications, money withdrawals, subsequent transfers and other evidence.
Fraudulent investment schemes frequently involve extensive messaging histories.
The alleged fraudster may promise guaranteed profits, immediate withdrawals or fictitious investment opportunities.
Messages after the money was transferred can be particularly important.
For example:
“Your investment has doubled.”
“Pay another €5,000 tax to withdraw.”
“Your account is temporarily blocked.”
A series of messages may reveal the alleged scheme more clearly than a single screenshot.
WhatsApp evidence may also connect bank payments with cryptocurrency wallet addresses.
The investigation can reconstruct:
WhatsApp Instruction → Bank Transfer → Crypto Exchange → Wallet Address → Subsequent Blockchain Transfer.
Following the money can be critical in establishing who ultimately benefited.
Yes, threatening messages can potentially form important evidence in a prosecution under TCK Article 106.
However, the precise wording and context must be examined.
“I will come to your house tonight and kill you.”
If authenticity and authorship are established, such a message can obviously create serious criminal-law issues.
Compare:
“You will pay for what you did.”
This statement could potentially be interpreted in several ways.
If the conversation continues:
“You will pay for what you did. My lawyer will file the lawsuit tomorrow.”
the legal context may be materially different.
Statements expressing an intention to file a lawsuit, criminal complaint or enforcement proceeding should not automatically be characterized as criminal threats.
A cropped screenshot can fundamentally alter meaning.
This is why digital evidence should be evaluated together with the complete factual record rather than mechanically accepted based only on its visual appearance. Official Turkish judicial materials concerning electronic evidence likewise stress the importance of technical examination and evidence integrity. (Adaylık)
WhatsApp communications may become relevant where repeated unwanted contact forms part of an alleged offense.
One isolated message and hundreds of unwanted messages over several weeks present very different evidentiary circumstances.
The investigation should determine when messages began, how frequently they were sent, whether the recipient asked the sender to stop and whether communication continued afterward.
For example:
1 June – 2 messages
2 June – 17 messages
3 June – 28 messages
4 June – Recipient blocks number
5 June – Messages allegedly begin from another number
This can provide a much clearer evidentiary picture than isolated screenshots.
Repeated WhatsApp communications can also become relevant to allegations concerning persistent stalking under the applicable provisions of Turkish criminal law.
Messages may be combined with allegations concerning following the complainant, appearing at their workplace or contacting relatives.
Blackmail allegations can depend heavily on electronic communications.
“Pay me €50,000 or I will send these photographs to your family.”
The message can become central evidence, but investigators should still establish authenticity and authorship.
Where the threat refers to photographs, videos or documents, those materials may also become evidence.
Screenshots are not the only relevant WhatsApp evidence.
Voice messages can sometimes provide stronger identification evidence because the sender’s voice may potentially be examined together with other material.
Do not rely exclusively on recordings created by playing the message through another telephone.
Videos transmitted through WhatsApp may similarly become relevant.
Repeated downloading, conversion or editing can complicate later technical examination.
Deleted messages can create substantial evidentiary disputes.
Suppose the submitted screenshot shows:
Suspect: “I will destroy you.”
But the complete exchange was:
Complainant: “Your company stole my money.”
Suspect: “That is false.”
Complainant: “I will publish fake stories about you everywhere.”
Suspect: “If you do that, I will destroy you in court.”
A cropped screenshot may present the conversation very differently.
The accused person should preserve their own complete conversation where available.
Messages showing the complete context may be more valuable than denying that the conversation occurred.
The answer depends on the device, backups, technical circumstances and how the data was deleted.
Digital-forensic examination can become important where missing messages materially affect the criminal allegation.
Official judicial materials emphasize that timely examination of digital devices can be important because electronic evidence may become inaccessible or lose evidentiary usefulness over time. (Rayp Adalet)
Technically, yes.
Images can be edited, conversations can be recreated and contact names can be changed.
That does not mean every WhatsApp screenshot should be presumed fraudulent.
Simply saying “Photoshop” is generally not a meaningful evidentiary analysis.
Does the screenshot hide the telephone number?
Are timestamps inconsistent?
Are messages missing?
Does the conversation abruptly begin halfway through an argument?
Does the opposing party possess the original telephone?
Does the suspect’s own device contain a different conversation?
Where authenticity is genuinely disputed, examination of the device from which the screenshots were taken may become important.
There is a major evidentiary difference between an isolated JPEG image and a conversation visible on the original device together with surrounding messages.
Depending on the case, technical examination may address device data, files, communications and other electronically stored information.
Digital-forensic principles emphasize preservation and examination in a manner designed to protect the integrity of electronic material. (Rayp Adalet)
In more technically complex investigations, forensic methods can be used to preserve and verify copies of digital data.
A defense challenging digital evidence may need to determine whether the evidence examined by an expert corresponds with the material originally obtained.
Sometimes a complainant submits screenshots forwarded by a friend.
This creates another evidentiary layer.
Who actually received the messages?
Where is the telephone on which the conversation occurred?
The chain should be explained.
A WhatsApp account may be accessible from computers or other linked devices.
This can become important where authorship is disputed.
Foreign companies operating in Turkey may use a single business account accessible by several employees.
The investigation should determine who had access at the relevant time.
Employee → Device → WhatsApp Account → Access Period → Linked Device → Relevant Message Time.
Where the suspect claims the telephone was stolen before the messages were sent, objective evidence becomes important.
Police reports, SIM replacement records and communications concerning the lost device can support the chronology.
Similarly, a claim that the account was compromised should not remain purely theoretical.
Evidence of unauthorized access, linked devices or security notifications may become relevant.
A photograph and name can be copied.
Therefore:
Profile Picture ≠ Identity Proof.
Technical and circumstantial evidence should be considered together.
In some internet-based investigations, technical records may assist identification, although access to platform data can be complicated where providers are located abroad. Turkish Ministry of Justice materials recognize practical difficulties in obtaining information from foreign social-media and messaging providers and emphasize the importance of examining relevant digital devices. (Rayp Adalet)
Where relevant digital information is held abroad, international judicial-assistance procedures may become necessary depending on the investigation and type of data sought. Ministry of Justice guidance specifically addresses international evidence requests concerning internet-based offenses. (diabgm.adalet.gov.tr)
Another important issue is how the evidence was obtained.
Secretly accessing another person’s telephone, account or private communications can raise separate privacy and criminal-law issues.
The Constitution and Turkish criminal procedure contain safeguards concerning unlawfully obtained evidence.
This should be distinguished from unlawfully breaking into someone else’s account to obtain private conversations.
A person obtaining conversations between two other individuals without authorization presents a substantially different legal question.
Trying to prove one offense by committing another unlawful act can create significant problems.
A forwarded message is not necessarily equivalent to the original conversation.
The source should be established.
A screen recording showing the conversation being scrolled can provide additional context, although authenticity and source can still be disputed.
In some disputes, parties attempt to strengthen preservation by documenting digital content through formal procedures. This does not necessarily eliminate every question concerning underlying authorship or authenticity.
Where alleged threatening or insulting messages remain on the complainant’s device, official prosecutorial guidance contemplates examination of the telephone and recording the messages and relevant details such as sender/recipient numbers, dates, times and frequency. This illustrates why the original device and underlying communication can matter beyond a simple screenshot. (Mevzuat)
If the accused person admits sending the messages, authenticity may no longer be the primary dispute.
The defense may instead focus on whether the words actually satisfy the elements of fraud, threat, harassment or another alleged offense.
The legal characterization remains separate.
A person may admit writing:
“Send the money to my account.”
That statement alone does not necessarily establish fraudulent intent.
The entire commercial transaction must be examined.
A person may admit writing:
“You will pay for this.”
Context may determine whether this was an unlawful threat or a reference to lawful proceedings.
Ten screenshots are not automatically stronger evidence than one.
Ten cropped screenshots from the same manipulated conversation may be weaker than one properly preserved complete digital record.
Depending on how evidence is collected and stored, technical information associated with files can sometimes assist analysis.
A screenshot is essentially a visual representation of what appeared on a screen at a particular moment.
It may not preserve all underlying application information.
Foreign suspects and victims frequently communicate in English, Arabic, Russian, Persian, French, German or other languages.
This is particularly important for threats and harassment.
Idioms and culturally specific expressions may not carry identical meaning in Turkish.
The original message should remain available alongside the translation.
An emoji can sometimes alter the perceived tone of a message.
Their meaning should be assessed within the overall conversation.
Accurate translation and transcription can become particularly important.
Foreign victims should preserve communications in the language originally used by the alleged fraudster.
Both should be retained.
A witness may testify that they saw the messages on the complainant’s telephone at the relevant time.
This can provide supporting evidence.
The precise circumstances remain important.
In fraud cases, the combination can be particularly significant:
Message requesting money + bank transfer + recipient account + subsequent withdrawal.
In harassment cases, messages may be compared with CCTV showing the suspect near the complainant’s home.
Where legally obtained and relevant, location-related evidence may also be considered alongside communications.
Communication records can potentially corroborate that the parties were in contact, although the existence of communication does not necessarily prove the content of a WhatsApp conversation.
Evidence that two people communicated and evidence establishing exactly what they said are different.
There is no universal rule that every WhatsApp screenshot is either sufficient or insufficient by itself.
The court must evaluate the evidence in the particular case.
The critical questions are whether the evidence is lawfully obtained, reliable and sufficient when assessed together with the entire case file.
A screenshot should therefore not eliminate the fundamental requirement that criminal responsibility be established through legally admissible evidence to the standard required in criminal proceedings.
Do not automatically challenge authenticity if the message is unquestionably genuine.
Instead examine the legal meaning, surrounding conversation, intention and remaining elements of the alleged offense.
Produce or request examination of the complete conversation.
Identify specific technical or contextual inconsistencies and seek appropriate examination rather than relying on a general accusation of fabrication.
Focus on telephone-number ownership, actual control, device evidence and other identification evidence.
Identify each person’s access and the relevant timestamps.
Preserve remaining devices, backups and other evidence capable of reconstructing the conversation.
Examine foreign-number ownership, translation, account access and the possibility that corporate devices or intermediaries were involved.
Preserve the original phone, complete conversation and relevant files.
Do not edit screenshots merely to highlight important sections.
Messages that appear unhelpful may actually strengthen credibility by demonstrating completeness.
Screenshots should be connected with the financial loss.
Chronology can become essential.
Do not paraphrase the alleged statement if the original message exists.
Do not delete the conversation after learning of the investigation.
Your device may contain messages missing from the complainant’s screenshots.
Additional messages can create new allegations and complicate the defense.
Creating fake conversations is likely to make the situation substantially worse.
Preserve the original device and complete WhatsApp conversation. Identify the exact screenshots relied upon and determine whether the telephone number is visible.
Compare screenshots with the original conversation, identify missing messages, preserve voice notes and media and reconstruct account and device access.
Connect the digital evidence with banking, witness, CCTV or other relevant evidence and prepare the criminal complaint or defense according to the complete chronology.
A useful structure is:
Screenshot → Original Device → Sender Number → Actual User → Date/Time → Previous Message → Subsequent Message → Alleged Crime → Corroborating Evidence → Defense Objection.
Use:
Representation → WhatsApp Message → Payment Instruction → Bank Transfer → Recipient → Subsequent Money Movement → Alleged Deception.
Use:
Exact Statement → Previous Conversation → Subsequent Conversation → Sender Identity → Context → Supporting Evidence → Legal Characterization.
Use:
Date → Number of Messages → Sender Account → Recipient Response → Request to Stop → Continued Contact → Additional Conduct.
The strongest approach is to treat a WhatsApp screenshot as one component of a digital evidence chain rather than automatically treating the image itself as conclusive proof. The exact alleged message should first be identified. The original device and complete conversation should then be preserved. The sender’s telephone number should be distinguished from the contact name displayed on the recipient’s screen. Where authorship is disputed, subscriber information, actual device use, linked devices and access by other persons should be examined. Where authenticity is disputed, the screenshot should be compared with the conversation on the original device and appropriate technical examination considered. Where messages have been deleted or cropped, the surrounding conversation should be reconstructed as far as lawfully possible. In fraud cases, WhatsApp messages should be connected to banking transactions, property movements or cryptocurrency transfers. In threat cases, the exact language and context should be analyzed. In harassment cases, frequency, duration and continued contact after objections may become significant. Foreign-language messages should be preserved in their original language and translated carefully. Finally, all digital material should be evaluated together with the remaining criminal evidence. The practical roadmap is therefore: preserve the phone → preserve the full conversation → identify the sender number → establish actual account control → compare screenshots with originals → identify cropped or deleted messages → preserve voice notes and media → examine linked devices → evaluate authenticity → evaluate lawfulness of acquisition → reconstruct context → analyze translations → connect messages with bank records in fraud cases → reconstruct frequency in harassment cases → analyze exact wording in threat cases → obtain appropriate technical examination where necessary → challenge unsupported authorship allegations → evaluate all digital evidence together with the complete criminal file.
They can potentially be submitted and evaluated as evidence. Their weight depends on factors such as authenticity, authorship, completeness, lawfulness and supporting evidence.
There is no automatic rule that a screenshot is always sufficient or insufficient. The court evaluates the evidence in the context of the complete criminal case.
Not necessarily. A displayed contact name may simply be the name under which the recipient saved a telephone number. The actual number and account user may require verification.
Manipulation can potentially be investigated through comparison with original devices, complete conversations and other technical or circumstantial evidence. The appropriate method depends on the case.
They can be important evidence, particularly when messages contain false representations or payment instructions. Bank records, recipient accounts and other financial evidence can substantially strengthen the case.
Potentially, yes. The exact wording, authorship, context and authenticity should be established. A cropped sentence should not automatically be evaluated without its surrounding conversation.
Yes. Deleted messages may affect the completeness of the evidence, and depending on the technical circumstances, other devices or digital evidence may help reconstruct relevant parts of the conversation.
Actual account control becomes an important factual question. Device access, linked devices, telephone information and surrounding evidence should be examined.
The answer depends heavily on how the communications were obtained. Messages received directly by a participant present a different legal situation from communications obtained through unauthorized access to another person’s device or account.
Preserve your original device and complete conversation, do not delete messages, identify the number and account involved, compare the submitted screenshots with your records and raise specific authenticity, authorship, completeness or context objections where supported by evidence.
WhatsApp evidence can become decisive in Turkish investigations involving fraud, threats, harassment, blackmail, financial crime and other allegations, but the evidentiary analysis should extend beyond isolated screenshots. Original devices, complete conversations, sender identification, deleted messages, voice notes, account access, banking records and digital-forensic findings may all affect the outcome.
Fırat Fesih Kaya Law Office provides legal assistance to foreign nationals, foreign investors, company directors and international clients involved in Turkish criminal proceedings concerning WhatsApp and other digital evidence.
Fırat Fesih Kaya can assist with WhatsApp screenshot evidence, disputed digital communications, fraud investigations, threat and harassment allegations, deleted-message disputes, digital forensic examinations, prosecutor statements and criminal defense proceedings in Turkey.
Phone: +90 312 434 22 22
Mobile Phone: +90 532 769 22 22
Email: info@firatfesihkaya.av.tr
Address: Mevlana Boulevard No: 221, Yildirim Tower, Balgat, Cankaya / Ankara, Turkey