Foreigners’ Bank Accounts Emptied Through Cyber Fraud in Turkey: Who Can Be Prosecuted? 2026

Was your Turkish bank account emptied through cyber fraud? Learn who may be investigated or prosecuted, including callers, hackers, money mules, account holders and organizers, how stolen funds can be traced, and what foreign victims should do in Turkey in 2026.

A foreign resident, investor, employee, student or business owner in Turkey may open their mobile banking application one morning and discover that the account balance has disappeared.

The unauthorized transactions may have followed a fake bank call, phishing link, SIM swap, stolen password, malicious software, compromised email account or fraudulent mobile-banking access.

The victim’s immediate question is usually:

“Who stole my money?”

Legally, however, the investigation may involve several different people.

The person who contacted the victim may not be the person whose bank account received the stolen money. The receiving account holder may not be the person who withdrew the cash. Another participant may have supplied GSM lines, banking credentials or cryptocurrency accounts. Organizers may remain behind several layers of intermediaries.

Official Turkish investigations in 2026 illustrate this structure. In a March 2026 case, the Istanbul Anatolian Chief Public Prosecutor’s Office reported that suspects allegedly impersonated bank employees, obtained victims’ SMS verification codes, accessed their accounts and moved the proceeds through different accounts. Prosecutors stated that victim statements, banking movements, communication records and digital evidence were evaluated together, and an indictment was prepared under the aggravated-fraud provision.

For foreign victims, the criminal complaint should therefore focus not only on the first person or IBAN discovered, but on reconstructing the entire fraud network.

Who Can Potentially Be Investigated?

Depending on the evidence and each person’s conduct, an investigation may examine:

• The person who deceived the victim
• The person who obtained banking credentials
• The person who took over the victim’s phone or SIM
• The person who accessed mobile banking
• The holder of the first receiving account
• People who knowingly supplied bank accounts
• People who transferred the proceeds onward
• People who withdrew the money
• Cryptocurrency-account operators
• Organizers and coordinators
• Persons involved in laundering criminal proceeds

Being investigated does not itself establish guilt.

Criminal responsibility must be assessed individually according to each person’s acts, knowledge, intent and the evidence.

The Person Who Called the Victim

One common structure begins with a telephone call.

The caller says:

“I am calling from your bank’s fraud department.”

The caller may know the victim’s:

• Name
• Bank
• Telephone number
• Account information
• Recent transaction information

The caller then creates panic:

“Someone is trying to empty your account.”

The supposed solution may actually enable the fraud.

If evidence identifies the person who deliberately deceived the victim to obtain money or banking access, that person may become a central suspect.

Fake Bank Employee Fraud

Official Turkish prosecutorial material from March 18, 2026 describes precisely this type of investigation. Suspects allegedly presented themselves as bank personnel, falsely told victims that suspicious transactions were occurring, obtained SMS verification codes and accessed the victims’ accounts. The proceeds were allegedly moved through different accounts to conceal the financial trail.

This demonstrates why a foreign victim should preserve more than the bank statement.

Preserve:

Call → SMS → Verification code → Banking access → Transfer → Recipient account → Subsequent movement.

The Person Who Sent the Phishing Link

Another suspect may have sent:

“Your bank account has been restricted. Verify your identity here.”

The link opens a fake website resembling the genuine bank.

The victim enters:

• Customer number
• Password
• Card information
• Verification information

The attacker then uses those credentials.

Where the evidence establishes deliberate participation, the person responsible for creating, distributing or operating the fraudulent infrastructure may be investigated according to their actual role.

The Person Who Accessed Mobile Banking

The person who deceived the victim and the person who actually accessed the banking system may be different.

Investigators may therefore examine:

• Login timestamps
• Device information
• Authentication records
• Password-reset events
• Relevant IP records
• New-device registration
• Transaction timestamps

The objective should be to identify the person or device associated with the unauthorized banking activity rather than assuming that the caller performed every technical step.

SIM Swap Participants

If the victim’s telephone suddenly stopped receiving calls and SMS messages shortly before the bank account was emptied, SIM swap or another form of number takeover may need to be investigated.

The relevant questions include:

Was a replacement SIM or eSIM activated?

When did the genuine SIM lose service?

Who requested the change?

What authentication occurred afterward?

When was mobile banking accessed?

The telecommunications timeline should be compared with the banking timeline.

The First Receiving Account Holder

Suppose the foreign victim loses TRY 750,000.

Bank records show:

Victim → Account A: TRY 750,000

It is tempting to conclude:

“Account A belongs to the fraudster.”

That conclusion may be premature.

The account holder may be:

• A principal fraud participant
• A knowing intermediary
• A paid money mule
• Someone who rented the account
• Someone deceived through a fake job
• Someone whose banking credentials were compromised

The investigation should establish the account holder’s actual conduct.

Account Ownership Does Not Automatically Prove the Entire Fraud

A bank statement can prove that money entered a particular account.

It does not automatically establish that the registered account holder:

called the victim, created the phishing website, knew the money was criminal proceeds or personally controlled the account when the transfer occurred.

Those questions require further evidence.

At the same time, the registered account holder cannot necessarily avoid scrutiny merely by saying:

“Someone else used my account.”

The explanation must be tested objectively.

Money Mules Can Become Important Suspects

Cyber-fraud organizations frequently need bank accounts that are not registered directly to the organizers.

They may recruit people with offers such as:

“Let us use your account for one day.”

“Receive money and keep 5%.”

“We need your IBAN for company payments.”

“Just withdraw the money and give it to us.”

Turkish prosecutors have continued to warn in 2026 that fraud organizations obtain bank accounts, GSM lines and digital banking access from third parties, including through promises of income or account rental.

A May 2026 prosecution announcement from Trabzon also described an investigation in which a suspect allegedly collected and rented bank accounts and supplied those accounts to people committing technology-assisted fraud.

Can a Money Mule Be Prosecuted Even If They Never Spoke to the Victim?

Potentially, depending on what the person intentionally did and knew.

The fact that an account holder never contacted the victim can be important, but it does not automatically end the criminal analysis.

Investigators may ask:

Why did you provide your account?

Who had your mobile banking password?

Did you receive a commission?

Did you transfer the money onward?

Did you withdraw cash?

Were similar transactions repeated?

Did you know the source of the money?

The answers can help distinguish an innocent account holder from a knowing participant.

A Genuine Victim Should Not Automatically Be Treated as a Fraudster

Suppose a university student responds to a fake employment advertisement:

“International payment assistant needed. Salary plus commission.”

The student is instructed to receive money and forward it.

The student may later discover that the incoming funds came from cyber-fraud victims.

That does not mean the student’s explanation must automatically be accepted.

But it also does not mean criminal intent should automatically be inferred merely because the money entered the student’s account.

Relevant evidence may include:

• Job advertisement
• Recruiter messages
• Employment documents
• Payment instructions
• Complete WhatsApp or Telegram history
• Commission arrangement
• Prior transactions
• Knowledge of suspicious circumstances

Individual criminal responsibility requires an individual evidentiary assessment.

What About the Person Who Withdraws the Cash?

Suppose:

Victim → Account A → ATM withdrawal

The person visible at the ATM may become highly relevant.

Investigators may examine:

• ATM location
• Withdrawal time
• Amount
• Card used
• Available surveillance footage
• Communications around the withdrawal

If Account A belongs to one person but another person repeatedly withdraws the proceeds, that can help investigators reconstruct actual control over the account.

What About Someone Who Transfers the Money to Another Account?

Another common chain is:

Victim → Account A → Account B → Account C

The investigation should determine why each transfer occurred.

A person who knowingly transfers criminal proceeds onward may have a materially different position from someone whose account was accessed without authorization.

Bank records provide the financial path.

Messages, devices, authentication records and surrounding circumstances can help explain why the transfers occurred.

What About Cryptocurrency?

Cyber-fraud proceeds may be moved:

Victim → Mule account → Cryptocurrency exchange → USDT → Private wallet

The people involved in acquiring, transferring or controlling the crypto assets may also become relevant to the investigation.

Preserve:

• Exchange information
• Asset type
• Blockchain network
• Wallet addresses
• Transaction hashes
• Date and time
• Amount

A wallet address shows a blockchain destination.

It does not automatically prove the real-world identity of its controller.

Can Cryptocurrency Transactions Be Traced?

Potentially.

Blockchain records may allow investigators or forensic specialists to reconstruct movements between wallets.

If funds enter an identifiable cryptocurrency service provider, account records may create additional investigative leads.

But three questions must remain separate:

Can the transaction be traced?

Can the person controlling the wallet be identified?

Can the asset ultimately be recovered?

A positive answer to the first question does not guarantee the other two.

What About the Organizer Who Never Touches the Money?

Cyber-fraud networks may be divided into roles.

One person may recruit account holders.

Another may make calls.

Another may manage phishing infrastructure.

Another may coordinate bank transfers.

Another may convert proceeds into cryptocurrency.

An organizer therefore should not automatically escape investigation merely because the stolen money never entered an account registered in that person’s name.

The relevant issue is whether evidence establishes intentional participation in the criminal conduct.

What About Companies Used to Receive the Money?

A fraud scheme may use a corporate bank account rather than a personal account.

The investigation should distinguish between:

the company, shareholders, directors, authorized banking users, employees and the people who actually controlled the transaction.

Corporate status does not automatically make every director or shareholder personally criminally responsible.

Investigators should determine who authorized, controlled or knowingly facilitated the relevant transactions.

Shell Companies Can Be Used to Move Cyber-Fraud Proceeds

Recent 2026 enforcement demonstrates the scale such investigations can reach.

In a 2026 Adana-centered operation concerning alleged technology-assisted aggravated fraud and laundering of criminal proceeds, the Ministry of Interior reported that suspects allegedly used shell companies described as investment, finance and cryptocurrency advisory businesses. Following financial analysis, authorities reported seizure measures involving 692 bank accounts and eight cryptocurrency accounts, together with other assets.

Similarly, Bursa police reported a 2026 investigation involving alleged investment fraud and laundering in which hundreds of bank accounts connected with suspects and legal entities became subject to judicial seizure measures.

For a foreign victim, this demonstrates why a complaint should seek investigation beyond a single recipient IBAN where the evidence suggests a broader network.

Which Criminal Offences May Be Investigated?

The exact legal classification depends on the conduct.

Depending on the facts, a cyber-fraud investigation may involve allegations concerning:

• Fraud
• Aggravated fraud
• Unauthorized computer-system conduct
• Misuse of bank or payment instruments
• Identity-related offences
• Forged documents
• Laundering of criminal proceeds
• Participation in criminal activity

It would be incorrect to assume that every person in the transaction chain committed every possible offence.

Each suspect’s conduct must be classified separately.

Aggravated Fraud and Banking Systems

Article 158 of the Turkish Criminal Code regulates aggravated forms of fraud, including fraud committed by using information systems or banks or credit institutions as instruments. The current consolidated text should always be checked against the date of the alleged offence because criminal provisions can be amended over time.

In the March 2026 bank-impersonation investigation discussed above, prosecutors specifically reported preparing an indictment under Article 158/1-l based on the alleged conduct in that case.

The precise subsection applicable to another cyber-fraud case depends on its facts.

Can Money Laundering Also Be Investigated?

Potentially, where the statutory elements are supported by the evidence.

Cyber-fraud proceeds may be moved through multiple accounts, companies, cash withdrawals or cryptocurrency in an attempt to conceal their origin or ownership.

But the mere fact that money passed through several accounts should not automatically be described as money laundering.

Knowledge, conduct and the applicable statutory elements still need to be established.

Official 2026 operations show that laundering allegations can accompany technology-assisted fraud investigations where financial evidence supports that broader theory.

Can the Foreign Victim’s Own Account Be Investigated?

Yes, potentially, as part of reconstructing the crime.

Investigators may need records from the victim’s account to establish:

• Normal balance
• Unauthorized transactions
• Authentication events
• Transaction times
• Recipient accounts
• Security notifications

Obtaining and examining the victim’s banking records does not mean the victim is accused of the offence.

Can Recipient Accounts Be Suspended or Seized?

Turkey’s current Criminal Procedure Code contains Article 128/A, which establishes a mechanism concerning qualifying accounts at banks, payment service providers and crypto-asset service providers where the statutory conditions are satisfied.

The provision also addresses situations in which suspected criminal proceeds are transferred to another financial institution before the suspension process is completed.

This is particularly relevant to cyber fraud because money can move rapidly from the first recipient to several additional accounts.

Can Seized Money Be Returned to the Foreign Victim?

Potentially.

Current Article 128/A provides that where seized criminal proceeds are determined to belong to the injured victim, they can be returned to the owner during the investigation or prosecution.

This does not guarantee that every cyber-fraud victim will recover the stolen money.

The proceeds must first be identified, located and secured, and the factual and legal requirements must be satisfied.

Why Reporting Speed Matters

Consider two cases.

Case A

The foreign victim discovers the fraud within an hour.

Victim → Account A

The money remains there.

Case B

The victim discovers the fraud several weeks later.

Victim → Account A → Account B → Account C → Crypto exchange → Private wallet

The second case can be significantly more difficult.

Prompt reporting cannot guarantee recovery, but delay can materially complicate asset tracing.

What Evidence Can Identify the Actual Cyber Fraudsters?

A serious investigation may combine:

Banking evidence

Incoming and outgoing transactions, recipients, withdrawals and subsequent transfers.

Telecommunications evidence

Relevant telephone and subscriber information.

Digital banking evidence

Login events, authentication records and device information.

Digital devices

Phones, computers, routers and other equipment.

Communications

WhatsApp, Telegram, SMS, email and other messages.

ATM evidence

Withdrawal information and available surveillance footage.

Cryptocurrency evidence

Exchange accounts, wallet addresses and transaction hashes.

Victim statements

How the deception occurred.

The March 2026 Istanbul investigation is a useful practical example: prosecutors stated that victim statements, bank movements, communication records and digital evidence were evaluated together.

Bank Records Alone May Not Identify the Principal Fraudster

A bank statement may show:

Victim → Ahmet’s account

But the investigation may later establish:

Fraud organizer → Account recruiter → Ahmet’s account → Another person withdraws cash.

That is why the criminal complaint should not stop at:

“Prosecute the owner of this IBAN.”

It should request investigation of the entire transaction and communication chain.

What If the Recipient Claims Their Account Was Hacked?

That possibility should be objectively investigated.

Relevant evidence may include:

• Banking security alerts
• Password resets
• New-device registrations
• Authentication records
• SIM changes
• Customer complaints
• Transaction history

A genuine compromise and a fabricated “my account was hacked” explanation can produce very different evidentiary pictures.

What If the Account Holder Gave Someone Their Password?

This increases the need for careful investigation.

Questions include:

Why was access provided?

For how long?

Was money expected?

Was commission paid?

Did the account holder monitor transactions?

Did they withdraw or transfer funds?

Did they continue after becoming suspicious?

No single answer automatically determines criminal liability.

Multiple Victims Can Change the Evidentiary Picture

Suppose one person receives a single unexplained payment.

That may require investigation.

Now suppose the same account receives payments from 40 unrelated fraud victims and immediately transfers each payment onward while retaining a percentage.

The evidentiary picture is materially different.

Patterns can matter.

Can the Foreign Victim Recover Money From a Money Mule?

Possible recovery routes depend on the circumstances and should be analyzed separately from criminal guilt.

Questions can include:

• Did the person still possess the money?
• Was it seized?
• Did the person benefit?
• Where did the money move?
• Are other assets identifiable?
• What civil remedies may be available?

A criminal complaint should therefore be coordinated with the money-recovery strategy.

Is the Bank Automatically Responsible Because the Account Was Emptied?

No automatic conclusion should be drawn.

Potential bank responsibility requires separate analysis of matters such as:

• Authentication procedure
• Security measures
• Transaction pattern
• Customer notifications
• Fraud indicators
• Timing of the customer’s notification
• Bank response
• Applicable contractual and statutory rules

Criminal prosecution of fraudsters and a potential claim involving the bank are distinct legal questions.

What If SIM Swap Was Used?

Potential telecommunications-provider issues may also require separate examination.

Relevant questions include:

• How was the replacement SIM obtained?
• What identity verification occurred?
• When was the new SIM activated?
• When did the genuine SIM stop working?
• When were banking credentials reset?
• When were transactions executed?

The timeline can be crucial.

Foreign Victims Should Preserve the Original Language of Communications

If the fraudster communicated in English, Arabic, Russian, Persian, French or another language, preserve the original messages.

Translations can later be prepared where necessary.

Do not replace the original evidence with translated screenshots.

Do Not Delete the Phone

Do not:

• Factory-reset the phone
• Delete suspicious messages
• Delete emails
• Remove banking notifications
• Destroy SIM cards
• Remote-wipe devices containing relevant evidence

Necessary account-security measures should be taken without unnecessarily destroying evidence.

Do Not Contact Suspects to Threaten Them

A victim who discovers the recipient’s name may want to send:

“Return my money immediately or I will have you arrested.”

This can be counterproductive.

It may cause funds to move, accounts to close or communications to disappear.

The recovery strategy should be coordinated with evidence preservation and the criminal process.

First 24 Hours After a Bank Account Is Emptied: 20-Step Checklist

1. Contact the bank through an official channel.
2. Report every unauthorized transaction.
3. Secure mobile and online banking.
4. Change compromised credentials safely.
5. Secure the associated email account.
6. Contact the mobile operator if SIM compromise is suspected.
7. Preserve the affected telephone.
8. Preserve SMS verification messages.
9. Preserve bank notifications.
10. Preserve suspicious calls and messages.
11. Obtain complete bank statements.
12. Record every recipient IBAN.
13. Record exact transaction times.
14. Identify onward transactions where known.
15. Preserve ATM information where relevant.
16. Preserve cryptocurrency records where relevant.
17. Prepare a chronological timeline.
18. Prepare an evidence index.
19. Consider prompt criminal reporting and asset tracing.
20. Preserve proof of every notification made to banks, operators and other institutions.

15 Questions the Criminal Investigation Should Answer

1. How did the fraudster first contact the victim?

Telephone, SMS, WhatsApp, email, website or another channel?

2. What deception was used?

Fake bank security warning, investment opportunity, phishing or another method?

3. How were banking credentials obtained?

This may identify another participant.

4. Was the victim’s SIM compromised?

Compare telecommunications and banking records.

5. Who accessed mobile banking?

Technical records may help.

6. Which account first received the stolen money?

Identify the complete IBAN.

7. Who actually controlled that account?

Ownership and control should be distinguished.

8. Did the account holder receive a commission?

This can be relevant to knowledge and intent.

9. Where did the money move next?

Trace every subsequent transfer.

10. Was cash withdrawn?

Identify ATM activity.

11. Was cryptocurrency purchased?

Preserve blockchain evidence.

12. Were companies used?

Identify directors and actual banking users separately.

13. Were other victims connected to the same accounts?

Patterns can reveal a larger scheme.

14. Who ultimately benefited?

This can lead beyond intermediaries.

15. What assets can still be secured?

This question is central to recovery.

2026 Current Enforcement Position in Turkey

Technology-assisted fraud remains an active enforcement area in Turkey in 2026.

Official investigations this year have involved fake bank calls, investment fraud, rented bank accounts, shell companies, hundreds of bank accounts, cryptocurrency accounts and alleged laundering of criminal proceeds.

The current criminal-procedure framework also includes Article 128/A, which provides mechanisms for rapid action concerning qualifying suspicious financial accounts and for seizure of suspected proceeds under the conditions specified by law. The provision further permits return of seized proceeds when they are established to belong to the victim.

For foreign victims, the key lesson is:

Do not investigate only the caller.

Do not investigate only the first IBAN.

The complete chain may be:

Fraud organizer → Caller or phishing operator → Banking-access participant → Money-mule account → Transfer intermediary → Cash withdrawal or crypto conversion → Ultimate beneficiary.

Each person’s potential criminal responsibility must then be determined from their own conduct, knowledge, intent and the evidence.

Frequently Asked Questions

1. My Turkish bank account was completely emptied through cyber fraud. Who can be prosecuted?

Potential suspects can include the person who deceived you, people who obtained or used your banking credentials, knowing account providers or money mules, people who transferred or withdrew the proceeds, organizers and other intentional participants. Criminal responsibility must be established individually.

2. Is the person whose IBAN received my money automatically the fraudster?

No. The account owner is an important investigative lead, but ownership alone does not establish that the person personally deceived you or knowingly participated in the fraud.

3. Can someone who rented their bank account be prosecuted?

Potentially, depending on what they knowingly and intentionally did. Turkish authorities are actively warning about bank-account rental and money-mule arrangements in 2026.

4. Can the fraudster be prosecuted if my money was transferred voluntarily?

Potentially, yes. A victim can voluntarily execute a transfer because of intentional deception. The relevant representations, intent and surrounding evidence must be examined.

5. Can Turkish prosecutors follow money through several bank accounts?

Potentially. Official 2026 investigations show extensive examination of banking movements and multiple accounts in technology-assisted fraud cases.

6. Can money transferred into cryptocurrency still be investigated?

Yes, potentially. Exchange records, wallet addresses and transaction hashes may provide investigative leads. Tracing a transaction, identifying a wallet controller and recovering the asset are separate questions.

7. Can money still sitting in the recipient’s account be secured?

Potentially, where the statutory requirements for the applicable suspension or seizure mechanism are satisfied. Article 128/A is particularly relevant to qualifying technology-related offences.

8. Can seized cyber-fraud proceeds be returned to me?

Article 128/A provides for return of seized criminal proceeds where they are established to belong to the victim. Application in an individual case depends on the facts and procedural status.

9. Can I also make a claim against my bank?

Potentially, but bank responsibility requires a separate analysis of authentication, security measures, transaction circumstances, notifications and applicable legal rules. Criminal prosecution of fraudsters does not automatically establish bank liability.

10. What should a foreign victim do immediately?

Secure the bank and related digital accounts, preserve the phone and communications, document every unauthorized transaction, identify recipient accounts, preserve telecom and crypto evidence where relevant, and consider prompt criminal reporting and asset tracing.

Criminal Complaint and Money Recovery Assistance for Foreign Cyber-Fraud Victims in Turkey

When a foreigner’s Turkish bank account is emptied through cyber fraud, identifying the first recipient is only the beginning.

A comprehensive investigation may require analysis of fake bank calls, phishing messages, SIM changes, mobile-banking access, authentication records, recipient accounts, money mules, ATM withdrawals, companies, cryptocurrency exchanges, private wallets and the people coordinating the scheme.

The essential questions are:

Who deceived the victim? Who obtained the banking credentials? Who accessed the account? Who received the stolen money? Who actually controlled the receiving accounts? Who transferred or withdrew the proceeds? Who ultimately benefited? Which proceeds or other assets can still be identified and secured?

Fırat Fesih Kaya Law Office provides legal assistance to foreign residents, investors, executives, employees, students, tourists and international business owners whose Turkish bank accounts have been targeted by cyber fraud.

Lawyer Fırat Fesih Kaya assists foreign victims with criminal complaints, prosecutor proceedings, bank and digital evidence preservation, recipient-account tracing, money-mule investigations, SIM swap cases, cryptocurrency transactions, asset tracing and legal strategies for recovery of identifiable proceeds.

Early intervention can be especially important because cyber-fraud proceeds may move through several accounts, cash withdrawals or cryptocurrency transactions within a short period.

Phone: +90 312 434 22 22
Mobile: +90 532 769 22 22
Email: info@firatfesihkaya.av.tr
Address: Mevlana Boulevard No:221, Yıldırım Tower No:148, 06520 Balgat, Çankaya, Ankara, Turkey

This publication is provided for general informational purposes and does not constitute legal advice. Criminal responsibility, bank or telecommunications-provider liability and recovery possibilities depend on the conduct of each participant, available evidence, location of the proceeds, applicable law and procedural stage of the individual case.