How Can Foreign Victims Preserve Digital Evidence After Online Fraud in Turkey? 2026 Legal Guide

Learn how foreign victims of online fraud in Turkey can preserve WhatsApp messages, emails, bank records, cryptocurrency transactions, websites, screenshots, metadata, and other digital evidence for criminal complaints and compensation claims in 2026.

Online fraud can develop within minutes, but the digital evidence needed to identify the offender and recover the victim’s money can disappear just as quickly. Fraudulent websites may be removed, social media profiles can be deleted, messaging accounts may be closed, cryptocurrency may be transferred through multiple wallets, and money sent to a bank account may be moved before the victim understands what has happened.

For foreign victims in Turkey, preserving evidence correctly is therefore one of the most important steps after discovering an online scam. A screenshot alone may be useful, but a properly documented digital evidence package can be significantly stronger because it preserves the original message, account information, date, time, URL, transaction data, metadata, payment records, and the relationship between individual pieces of evidence.

Under the legal framework applicable in 2026, online scams involving information systems, banking infrastructure, payment channels, fake investment platforms, phishing websites, social media accounts, cryptocurrency transactions, or impersonation may fall within the fraud provisions of the Turkish Penal Code. Fraud committed through information systems or by using banking institutions may constitute qualified fraud under Article 158, depending on the circumstances. Turkish criminal procedure also provides investigative mechanisms through which prosecutors and courts may obtain electronic records and examine digital systems.

The following guide explains how foreign victims can preserve digital evidence, report online fraud, support asset-tracing requests, and avoid mistakes that may weaken a criminal complaint or compensation claim in Turkey.

Why Is Digital Evidence So Important in Online Fraud Cases?

Unlike traditional fraud, online fraud frequently takes place without any face-to-face meeting between the victim and the offender. The parties may communicate entirely through a mobile application, email account, social media profile, online investment platform, cryptocurrency exchange, or fraudulent website.

As a result, the identity and conduct of the offender often have to be reconstructed through digital traces.

Relevant evidence may include:

• WhatsApp or other messaging conversations
• SMS messages
• Emails
• Social media accounts
• Usernames and account identifiers
• Website addresses
• Domain information
• Bank account numbers
• International bank account details
• Payment receipts
• Cryptocurrency wallet addresses
• Blockchain transaction identifiers
• Cryptocurrency exchange records
• Telephone numbers
• Call records
• Voice messages
• Photographs
• Videos
• Online advertisements
• Fake invoices
• Investment statements
• Remote-access application records
• Authentication notifications
• Internet protocol information where lawfully obtainable
• Device and account login alerts

Digital evidence helps demonstrate not only that money was transferred, but also why the victim transferred it and what representations were made before the payment.

That distinction can be particularly important because a failed transaction or commercial disagreement is not automatically criminal fraud. Evidence showing deception before payment can help establish that the offender used misleading conduct to obtain an unlawful benefit.

What Should a Foreign Victim Do Immediately After Discovering Online Fraud?

The first objective should be preservation rather than confrontation.

A victim should avoid deleting applications, resetting the device, closing accounts, or modifying conversations before important information has been copied and secured.

Where possible, the victim should immediately preserve:

• The entire conversation history
• The offender’s profile page
• Username and account identifier
• Telephone number
• Email address
• Website URL
• Bank account details
• Payment recipient information
• Transfer receipts
• Cryptocurrency wallet address
• Transaction identifier
• Advertisements used by the offender
• Investment dashboard
• Account balance screen
• Withdrawal refusal messages
• Identity documents sent by the offender
• Contracts and invoices
• Any promises concerning repayment or profit

The victim should also prepare a chronological summary of what happened.

The timeline should record when first contact occurred, what representations were made, when each payment was requested, when each transfer occurred, when further payments were demanded, and when the victim first realized that the transaction might be fraudulent.

This chronological document can later help a lawyer, prosecutor, police officer, bank, or financial institution understand a complex digital fraud file.

Do Not Delete the Original Messages

One of the most common mistakes is relying exclusively on screenshots and then deleting the original conversation.

Screenshots can be useful, but the original messages may contain additional information such as:

• Message timestamps
• Sender information
• Delivery data
• Attachments
• Voice recordings
• Original file names
• Links
• Contact details
• Message sequence
• Account identifiers

Where an application allows the conversation to be exported, the victim should preserve an exported copy in addition to screenshots.

The original conversation should remain on the device whenever reasonably possible until appropriate copies have been secured.

How Should WhatsApp Evidence Be Preserved?

WhatsApp is frequently used in investment fraud, fake property transactions, impersonation scams, commercial fraud, romance scams, fake visa services, and cryptocurrency schemes.

A foreign victim should preserve the complete conversation rather than only the most incriminating messages.

Evidence should ideally show:

• Telephone number
• Profile name
• Profile photograph
• Full message sequence
• Dates
• Times
• Payment instructions
• Bank account details
• Cryptocurrency wallet addresses
• Voice messages
• Photographs
• Documents
• Deleted-message indications where visible

Screenshots should be taken sequentially so that the context can be understood.

Where technically available, the conversation should also be exported with attachments. The exported data should be stored without editing it.

A victim should avoid cropping screenshots in a way that removes the telephone number, date, time, or relevant application interface.

How Should Telegram and Other Messaging Evidence Be Preserved?

Telegram and similar applications may create additional evidentiary difficulties because users can change usernames, delete accounts, or remove messages.

The victim should therefore preserve:

• Username
• Display name
• Profile address
• Telephone number if visible
• User identifier if technically available
• Group or channel name
• Group invitation link
• Administrator information
• Complete conversation
• Payment instructions
• Files and attachments
• Voice messages
• Screenshots of the profile

If the fraudulent communication occurred inside a group, screenshots should identify the group and the sender rather than showing only isolated messages.

How Should Email Evidence Be Preserved?

A screenshot of an email does not contain all the technical information that may later become relevant.

Foreign victims should preserve the original email wherever possible.

Useful evidence includes:

• Sender address
• Recipient address
• Date and time
• Subject
• Full body
• Attachments
• Original email file
• Message headers

Email headers may contain routing and server information that is not visible on the ordinary screen.

The victim should avoid forwarding the only available copy and then deleting the original message.

Where possible, the original email should be exported in its native email format and stored securely.

How Should Social Media Evidence Be Preserved?

Fraudsters frequently operate through Instagram, Facebook, TikTok, LinkedIn, X, or other platforms.

A profile may disappear immediately after the victim sends money.

The victim should capture:

• Full profile page
• Username
• Profile URL
• Account description
• Profile photograph
• Follower information where relevant
• Posts used in the fraud
• Advertisements
• Direct messages
• Comments
• Contact information
• Links in the biography
• Connected websites
• Payment instructions

The actual profile URL can be much more useful than a screenshot displaying only the account name.

Fraudsters often copy the name and photographs of legitimate people or companies. Therefore, identifying the exact account involved is critical.

How Should Fraudulent Websites Be Preserved?

Fake banking, cryptocurrency, e-commerce, immigration, investment, and trading websites can disappear quickly.

The victim should preserve:

• Complete website address
• Landing page
• Login page
• Account dashboard
• Deposit instructions
• Withdrawal page
• Terms presented to the victim
• Contact page
• Company information
• Payment details
• Error messages
• Withdrawal rejection notices

Screenshots should display the browser address bar wherever possible.

A victim should also record the date and time when each page was accessed.

If money was shown on a fraudulent investment dashboard, the victim should preserve the dashboard before access is blocked.

A displayed online balance does not necessarily prove the existence of actual assets, but it may help demonstrate the representations used to induce further payments.

Why Should Original Files Be Preserved?

Digital photographs, videos, documents, PDFs, and audio recordings may contain technical information that can be lost when files are edited, converted, compressed, or repeatedly forwarded.

The original file should therefore be preserved separately from any working copy.

Victims should avoid:

• Renaming every file
• Editing photographs
• Adding annotations to the original
• Converting original files unnecessarily
• Compressing evidence repeatedly
• Re-saving screenshots through social media applications

A separate annotated copy can be prepared for explanation, while the original remains unchanged.

What Is Metadata and Why Can It Matter?

Metadata is information associated with a digital file.

Depending on the file type, metadata may include:

• Creation date
• Modification date
• File format
• Device information
• Location information
• Author information
• Software used
• File size

Metadata is not automatically conclusive evidence of authenticity because it may sometimes be altered. Nevertheless, preserving the original file may provide investigators or forensic experts with significantly more information than a simple printed copy.

Should Digital Evidence Be Hashed?

In significant fraud cases, calculating a cryptographic hash of preserved files may help document that a file has not changed after preservation.

A hash produces a digital fingerprint for the file.

If the same file later produces the same hash value, this can support the argument that its digital contents remained unchanged.

Hashing is particularly useful when preserving:

• Large email archives
• Chat exports
• Video files
• Audio files
• Website archives
• Transaction datasets
• Forensic copies

It does not by itself prove that the underlying content is true, but it can strengthen the chain of custody.

What Is a Chain of Custody?

A chain of custody records who collected evidence, when it was collected, where it was stored, and whether it was modified.

For important online fraud cases, the victim or legal team should record:

• Name of the person preserving the evidence
• Date and time of preservation
• Device used
• Original location of the evidence
• Method used to copy it
• Storage location
• File hash where appropriate
• Any later transfer of the evidence

This can become especially important when the authenticity or integrity of digital material is challenged.

How Should Bank Transfer Evidence Be Preserved?

For bank-transfer fraud, the victim should obtain official bank records rather than relying only on mobile-banking screenshots.

Relevant information includes:

• Sender account
• Recipient account
• Account holder name
• Transfer date
• Transfer time
• Amount
• Currency
• Transaction reference
• Payment description
• International payment data where applicable

If the fraud was discovered quickly, the victim should immediately contact the bank and request appropriate fraud-related measures.

A criminal complaint and recovery efforts are separate processes. Prompt action may be particularly important where money can still be traced before being transferred through additional accounts.

What Evidence Should Be Preserved in Fake Investment Fraud?

Foreign victims of fake investment platforms should preserve far more than the final transfer receipt.

Useful evidence includes:

• Online advertisement
• Initial contact
• Sales presentation
• Promised returns
• Fake investment contract
• Website address
• Platform dashboard
• Deposit records
• Trading history displayed by the platform
• Messages from the supposed adviser
• Withdrawal requests
• Withdrawal refusals
• Requests for additional tax
• Requests for release fees
• Requests for insurance payments
• Bank account information
• Cryptocurrency addresses

A common pattern involves showing artificial profits and then demanding further payment before a supposed withdrawal can be processed.

Every additional payment request should be preserved.

How Should Cryptocurrency Fraud Evidence Be Preserved?

Cryptocurrency fraud requires precise transaction identification.

Victims should preserve:

• Cryptocurrency type
• Amount transferred
• Wallet address
• Transaction identifier
• Date and time
• Exchange used
• Account records
• Deposit and withdrawal history
• Identity verification records held by the exchange
• Screenshots of the fraudulent platform
• Communications directing the transaction

The transaction identifier is particularly important because blockchain transfers may be traceable through multiple wallets.

The victim should not send additional cryptocurrency merely because the offender claims that another payment is required to release frozen assets, pay tax, unlock a wallet, or complete a withdrawal.

SIM Swap and Online Banking Fraud

Where the victim’s telephone number or banking credentials were compromised, evidence may include:

• SIM replacement notifications
• Mobile operator communications
• Bank login alerts
• Password-reset messages
• One-time password messages
• Unauthorized device notifications
• Account login history
• Unauthorized transfers
• Customer-service records

The victim should immediately notify both the bank and mobile operator and request preservation of relevant transaction and account records.

Remote Access Fraud

Some scams persuade victims to install remote-access applications.

The offender may then access the victim’s computer or mobile device and initiate transactions.

Victims should preserve:

• Name of the application
• Installation records
• Session records if available
• Messages instructing installation
• Calls during the session
• Bank transactions
• Security notifications
• Device login records

Before uninstalling the software, important records should be preserved where doing so can be accomplished safely.

If continued access by the offender remains possible, cybersecurity measures should be taken promptly to secure the device and accounts.

Voice Calls and Recorded Communications

Fraud often begins with a telephone call from someone claiming to represent a bank, police authority, prosecutor, investment company, cryptocurrency exchange, or government institution.

Victims should preserve:

• Telephone number
• Date
• Time
• Duration
• Call log
• Voicemail
• Subsequent messages
• Any legally obtained audio recording

The legality and admissibility of a secretly recorded conversation can depend heavily on the circumstances in which it was made. A foreign victim should therefore obtain legal advice before relying on covert recordings as evidence.

Should a Victim Confront the Fraudster?

Usually, preserving evidence and seeking immediate legal and financial intervention is more important than prolonged confrontation.

Warning the offender that a criminal complaint will be filed may cause:

• Account deletion
• Website closure
• Transfer of funds
• Destruction of records
• Movement of cryptocurrency
• Disappearance of intermediaries

There may be cases where communication should continue for evidentiary or investigative reasons, but this should be assessed carefully.

Victims should never make additional payments merely to keep the offender communicating.

Criminal Complaint After Online Fraud

A foreign victim may report suspected fraud to the competent public prosecutor or law-enforcement authorities.

The complaint should be structured clearly and supported by organized evidence.

A useful criminal complaint may identify:

• Victim
• Suspected offender if known
• Telephone numbers
• Social media profiles
• Email addresses
• Bank accounts
• Cryptocurrency wallets
• Relevant websites
• Fraudulent representations
• Payment dates
• Total financial loss
• Available digital evidence

Online fraud involving information systems or banking mechanisms may be assessed as qualified fraud depending on the facts. Under the Turkish Penal Code, the legal characterization depends on the specific method used by the offender.

2026 Procedural Development in Qualified Fraud Cases

Foreign victims should be aware that procedural rules concerning qualified fraud changed at the end of 2025.

Following Law No. 7571 and the related jurisdictional changes effective from late December 2025, qualified fraud cases under Article 158 are handled before the Criminal Court of First Instance rather than under the previous allocation to the Heavy Criminal Court. This distinction is relevant when reviewing older online materials because older guides may still describe the previous court structure.

The underlying criminal characterization of online or banking fraud remains fact-specific.

Can Prosecutors Obtain Digital Records?

Victims should preserve evidence themselves, but certain information may only be obtainable through official investigation.

Depending on the circumstances and legal requirements, investigators may seek records from:

• Banks
• Payment institutions
• Telecommunications providers
• Cryptocurrency exchanges
• Internet platforms
• Hosting providers
• Other relevant entities

Turkish criminal procedure also contains legal mechanisms for examining, copying, and securing data stored on computer systems where statutory conditions are satisfied.

A victim should therefore identify potential evidence sources in the criminal complaint even where the victim cannot personally obtain the records.

Can Bank Accounts Be Traced or Frozen?

Where fraud proceeds are transferred through bank accounts, early investigative action may significantly affect recovery prospects.

The criminal complaint should identify every known recipient account and transfer.

Where legally justified, competent authorities may consider precautionary measures concerning assets or accounts.

However, filing a complaint does not automatically guarantee that funds will be frozen or recovered.

Money may already have been:

• Withdrawn in cash
• Transferred to another account
• Sent abroad
• Converted to cryptocurrency
• Distributed through multiple intermediary accounts

Speed is therefore important.

Can Cryptocurrency Be Frozen?

Cryptocurrency recovery depends heavily on where the assets are located.

If funds reach an identifiable centralized exchange, investigative authorities may have greater opportunities to seek information or preservation measures than where assets remain in a private wallet.

Relevant factors include:

• Exchange jurisdiction
• Identity verification records
• Transaction path
• Timing
• International cooperation
• Whether assets remain on the platform

Foreign victims should provide exact wallet addresses and transaction identifiers rather than general screenshots alone.

Can Deleted Messages Still Be Used?

Deletion does not necessarily mean that all evidence has disappeared.

Copies may remain:

• On the recipient’s device
• In backups
• In exported conversations
• On other synchronized devices
• In attachments
• Within account records
• In official records obtainable during investigation

However, recovery is not guaranteed.

Victims should therefore preserve digital material immediately rather than relying on later forensic recovery.

Are Screenshots Admissible Evidence?

Screenshots can be valuable evidence, but their weight depends on context and authenticity.

A stronger evidentiary package usually combines screenshots with:

• Original messages
• Exported conversations
• URLs
• Account identifiers
• Bank records
• Original emails
• Attachments
• Metadata
• Transaction records
• Witness testimony
• Forensic examination where necessary

A screenshot should ideally show enough surrounding information to establish where it came from and when it was captured.

Should Evidence Be Notarized?

In some disputes, formal documentation of online content may strengthen proof that specific material existed at a particular time.

Whether formal certification or another evidence-preservation procedure is necessary depends on:

• Value of the claim
• Risk that content will disappear
• Type of platform
• Anticipated authenticity dispute
• Availability of the original data

Not every screenshot requires formal certification. The appropriate method should be selected according to the individual case.

Foreign Victims Who Are Outside Turkey

A victim does not necessarily need to remain physically in Turkey throughout the case.

Depending on the procedure, a Turkish lawyer may assist under a properly issued power of attorney.

Legal representation can be particularly useful where the victim needs to:

• File a criminal complaint
• Submit additional evidence
• Follow the investigation
• Request access to permitted file materials
• Communicate with authorities
• Pursue compensation
• Take enforcement measures

This can be important for tourists, foreign investors, foreign employees, expatriates, and individuals who returned to their home country after the fraud.

Interpretation and Language Rights

Foreign victims should not sign a statement that they do not fully understand.

Where procedural interpretation rights apply, the victim should ensure that statements accurately reflect:

• Amount transferred
• Currency
• Method of fraud
• Number of payments
• Identity information
• Digital evidence
• Suspected accounts

Errors in names, dates, account numbers, and wallet addresses can create serious investigative problems.

Recovering Money Is Different From Reporting the Crime

A criminal complaint seeks investigation and prosecution of the suspected offender.

Financial recovery may require additional legal steps.

Depending on the case, a foreign victim may need to consider:

• Civil claims
• Enforcement proceedings
• Interim measures
• Claims against contractual counterparties
• Claims involving financial institutions
• Restitution
• Attachment of identified assets

The availability of each remedy depends on the facts.

A criminal conviction does not automatically guarantee that the victim will receive all lost money.

Evidence of Damages

Victims should document the full economic consequences of the fraud.

Relevant documents may include:

• Bank transfer records
• Exchange fees
• Cryptocurrency purchase records
• Interest expenses
• Transaction charges
• Currency conversion losses
• Professional expenses
• Contractual payments caused by the fraud

Claims for additional losses must be supported by evidence demonstrating both the amount and causal connection.

Legal Remedies if the Investigation Is Closed

If prosecutors conclude that there is insufficient basis for prosecution, the victim may have procedural remedies against the decision.

The applicable route and deadline depend on the type and date of the prosecutorial decision.

Foreign victims should obtain a complete copy of the decision and determine the notification date immediately.

Missing a statutory challenge period can prevent further review.

Where new digital evidence emerges after the initial complaint, it should also be assessed promptly.

Common Evidence Preservation Mistakes

Foreign victims frequently weaken otherwise strong cases by:

• Deleting the conversation
• Blocking the offender before recording account information
• Saving only one screenshot
• Cropping screenshots excessively
• Failing to preserve URLs
• Losing transaction identifiers
• Resetting the telephone
• Deleting emails
• Editing original files
• Failing to obtain official bank records
• Sending additional money
• Delaying the criminal complaint
• Assuming the bank will preserve everything indefinitely

The safest approach is to preserve broadly and organize carefully.

A Practical Digital Evidence Checklist

A foreign victim of online fraud in Turkey should generally preserve the following:

1. Complete conversation history.
2. Screenshots showing account identity.
3. Telephone numbers.
4. Email addresses.
5. Social media usernames and profile URLs.
6. Website URLs.
7. Original emails and headers.
8. Bank transfer receipts.
9. Official account statements.
10. Cryptocurrency wallet addresses.
11. Blockchain transaction identifiers.
12. Investment platform screenshots.
13. Voice messages.
14. Call records.
15. Contracts and invoices.
16. Original photographs and files.
17. Relevant metadata.
18. A chronological incident summary.
19. Copies stored in more than one secure location.
20. Details of potential third parties holding additional records.

Frequently Asked Questions

1. Is a screenshot enough to prove online fraud in Turkey?

A screenshot may be useful, but it should not be the only evidence where additional records are available. Original messages, exported conversations, payment records, account identifiers, URLs, emails, and transaction data usually create a stronger evidentiary package.

2. Should I delete or block the scammer after discovering the fraud?

Do not delete the conversation. Before blocking an account, preserve the profile, username, telephone number, URL, messages, payment instructions, and other identifying information. Whether further communication is advisable should be evaluated according to the case.

3. Can WhatsApp messages be used as evidence?

WhatsApp conversations may form part of the evidence. The complete conversation, contact information, dates, attachments, voice messages, and original data should be preserved whenever possible rather than relying on isolated screenshots.

4. What should I preserve after a cryptocurrency scam?

Preserve wallet addresses, transaction identifiers, exchange records, account history, communications, website information, payment instructions, and screenshots of the fraudulent platform. Exact blockchain transaction data can be critical for tracing funds.

5. What should I do immediately after transferring money to a fraudster?

Contact the bank or relevant financial service provider immediately, preserve all transaction information, avoid making further payments, and obtain legal advice concerning a prompt criminal complaint and possible asset-preservation measures.

6. Can I file a fraud complaint in Turkey if I live abroad?

Depending on the circumstances, a foreign victim may be represented in Turkey through a lawyer acting under a properly issued power of attorney. Physical presence is not necessarily required for every stage of the process.

7. Can deleted online messages be recovered?

Sometimes additional copies may exist on devices, backups, synchronized accounts, or third-party systems, but recovery is never guaranteed. Immediate preservation is safer than relying on later forensic recovery.

8. Can money transferred in an online scam be recovered?

Recovery may be possible, particularly where action is taken before funds are withdrawn or transferred further. However, recovery depends on asset location, transaction timing, available evidence, investigative measures, and whether attachable assets can be identified.

9. What happens if the prosecutor closes the investigation?

The victim may have a legal remedy against a decision not to prosecute, subject to the applicable procedure and deadline. The notification date should therefore be recorded immediately and the decision reviewed by a lawyer.

10. Do I need a lawyer after online fraud in Turkey?

Legal representation can be particularly valuable where the fraud involves significant losses, multiple bank accounts, cryptocurrency, foreign transfers, anonymous offenders, fake investment platforms, or disappearing digital evidence. A lawyer can organize evidence, prepare the criminal complaint, follow investigative measures, and assess parallel recovery options.

Client-Focused Legal Support for Foreign Victims of Online Fraud

Online fraud cases often depend on what happens during the first days after the victim discovers the loss. Preserving digital evidence correctly, identifying bank accounts and cryptocurrency transactions, filing a structured criminal complaint, and evaluating asset-recovery options at an early stage can substantially affect the effectiveness of the legal process.

Fırat Fesih Kaya Law Office provides legal assistance to foreign individuals, investors, business owners, tourists, and expatriates affected by online banking fraud, cryptocurrency fraud, fake investment schemes, phishing, social media scams, identity impersonation, and other forms of digital fraud in Turkey.

If you have transferred money, cryptocurrency, or valuable assets as a result of suspected online fraud, you may contact our office for an individual legal assessment and representation concerning evidence preservation, criminal complaints, asset tracing, recovery proceedings, and available legal remedies.

Phone: +90 312 434 22 22
Mobile Phone: +90 532 769 22 22
Email Address: info@firatfesihkaya.av.tr
Office Address: Mevlana Boulevard No: 221, Yıldırım Tower, Office No: 148, 06520 Balgat, Çankaya, Ankara, Turkey

Legal Disclaimer: This publication provides general legal information and does not constitute legal advice. Online fraud cases should be assessed individually according to the method of fraud, location of the parties and assets, available evidence, financial institutions involved, and legislation in force on the relevant date.