Foreign Defendant Claims a Social Media Account Is Not Theirs: How Is Account Ownership Proven in Turkey? (2026 Updated Guide)

A foreign defendant denies owning a social media account in Turkey. Learn how Turkish authorities establish account ownership through IP records, devices, phone numbers, platform data and digital evidence.

A foreign defendant accused of committing a crime through Instagram, X, Facebook, YouTube, TikTok, WhatsApp or another online platform may argue that the relevant social media account does not belong to them. This defense can be highly significant, particularly where the prosecution relies mainly on screenshots, a username, profile photographs or information associated with the account.

In Turkey, the existence of a social media account under a particular name does not automatically establish that the defendant personally created or operated the account at the relevant time. Account ownership and actual use can require technical investigation. Turkish judicial decisions have emphasized the importance of investigating IP information, subscriber details, account access data and other technical evidence when the accused denies making the relevant online publication.

For a foreign defendant, this issue can be even more important because names, telephone numbers, email addresses, passports, photographs and other identifying information may have been used by another person to create a fake account.

Is a Social Media Username Enough to Prove Ownership?

Generally, a username alone should not be treated as conclusive proof that a particular person operated the account.

A username can be selected by another person. A profile photograph can be copied. A person’s name can be used without permission. An account can also be compromised or accessed by someone else.

Turkish case law has recognized situations in which an account may have been falsely created using a person’s personal information or may have been accessed by another person.

The relevant question is therefore:

Who actually controlled and used the account when the alleged criminal conduct occurred?

What Evidence Can Establish Account Ownership?

A Turkish criminal investigation may examine multiple categories of evidence, including:

• IP addresses;
• Access dates and times;
• Internet service provider records;
• Subscriber information;
• Telephone numbers;
• Email addresses;
• Device information;
• Computers and mobile phones;
• Application login records;
• Platform records;
• Cloud data;
• Account recovery information;
• Payment records;
• Location-related technical evidence;
• Messages and communications;
• Other digital forensic evidence.

No single category should automatically be assumed to be decisive in every case.

IP Address Can Be Important

The IP address used to access or operate an account may provide an important technical connection between an online activity and an internet connection.

However, an IP address does not necessarily prove that a specific individual personally typed the message or uploaded the content.

Other people may have access to the same connection, and technical circumstances such as shared networks, public Wi-Fi, corporate networks or other connection structures may affect the analysis.

The Date and Time of the IP Address Matter

An IP address without accurate time information may be insufficient for a reliable attribution.

The investigation may need to establish:

Account activity → exact date → exact time → IP address → internet provider → subscriber information → device/user evidence.

Turkish judicial decisions have specifically referred to the need to investigate the IP address, timing information and related subscriber data when account ownership is disputed.

Internet Subscriber Information Is Not the Same as User Identity

Suppose an IP address is associated with an internet subscription registered to a foreign defendant.

That may establish that the connection belonged to a subscription associated with the defendant.

It does not necessarily establish beyond dispute that the defendant personally used the device at that moment.

The defense should therefore distinguish subscriber identity from actual user identity.

Mobile Phone Numbers Can Provide Additional Evidence

If the social media account is linked to a telephone number, investigators may examine whether that number belongs to the defendant.

This can be useful, but again, registration of a telephone number does not automatically prove who controlled the account at the precise time of the alleged conduct.

Email Addresses May Also Be Relevant

Account registration or recovery information may connect a social media account with a particular email address.

The defense should determine whether the email account was:

• Actually controlled by the defendant;
• Shared with another person;
• Compromised;
• Created using stolen information;
• Accessible from another country or device.

Device Evidence Can Be Particularly Important

If investigators seize a mobile phone, tablet or computer, digital forensic examination may potentially establish whether the relevant account was installed, accessed or authenticated on that device.

Turkish judicial materials recognize the importance of investigating digital devices and technical records in online criminal investigations.

What If the Defendant’s Phone Contains No Evidence?

That may become an important defense point, depending on the circumstances.

If the prosecution alleges that a particular phone was used to operate the account, the absence of relevant account information, authentication traces or other expected evidence may require explanation.

However, the absence of evidence on one device does not automatically prove that the defendant did not operate the account, particularly where another device may have been used.

What If the Account Was Hacked?

A hacked-account defense should be supported with evidence.

Possible evidence may include:

• Security notifications;
• Password-reset emails;
• Login alerts;
• Unrecognized-device notifications;
• Messages to the platform;
• Two-factor authentication records;
• Recovery requests;
• Screenshots of unauthorized access;
• Reports made shortly after the incident.

A general statement that “my account was hacked” is much weaker than a documented chronology.

What If Someone Created a Fake Account Using the Foreigner’s Name?

This is a common issue in identity-related social media disputes.

The defense should identify:

• When the account was created;
• Which email or telephone number was used;
• Which IP addresses accessed it;
• Which devices were used;
• Whether the defendant ever controlled the account;
• Whether the account contained copied photographs or information;
• Whether the defendant reported the impersonation.

Profile Photographs Do Not Automatically Prove Ownership

A photograph may be copied from another account or from a public source.

The defense should distinguish:

“The account contains my photograph”

from

“I controlled the account.”

These are different factual propositions.

Messages Can Help Establish the Real User

If the account communicated with other people, investigators may examine the conversations.

Language, personal knowledge, timing, previous conversations and references to private information may potentially support or undermine attribution.

However, the authenticity and origin of those communications should also be established.

Location Evidence May Be Relevant

Where technically and legally available, access information may reveal whether the account was used from a location associated with the defendant.

For a foreign defendant, this can be particularly important.

For example, if the defendant was demonstrably outside Turkey when the alleged publication occurred, relevant travel and immigration records may potentially contradict the attribution.

Passport and Travel Records Can Become Defense Evidence

Consider a situation in which an allegedly criminal social media post was made in Ankara on a particular date, while the foreign defendant was demonstrably outside Turkey.

That does not automatically resolve the case, but it can create a significant factual issue requiring investigation.

Travel records, entry-exit records, airline tickets and accommodation records may therefore be relevant depending on the allegation.

Foreign Residence Can Create Additional Technical Questions

A foreign defendant may regularly use:

• Turkish mobile networks;
• Foreign SIM cards;
• VPN services;
• Corporate networks;
• Hotel Wi-Fi;
• Home internet in another country.

The technical circumstances should be reconstructed rather than assuming that the apparent geographic origin of an IP address identifies the actual person.

VPN Use Requires Careful Analysis

A VPN can make attribution more complicated because the visible IP address may belong to the VPN provider rather than the user’s ordinary internet connection.

This does not prove innocence or guilt.

It means investigators may need additional technical information to determine the underlying connection and device.

Shared Wi-Fi Can Also Complicate Attribution

A hotel, office, university, restaurant or residential network may be used by many people.

If the account activity originated from a shared connection, the prosecution may need additional evidence connecting the activity to the particular defendant.

What If the Account Was Used by an Employee?

Foreign companies can face this problem when an employee, consultant or marketing agency controls corporate social media accounts.

The investigation should determine:

• Who had passwords;
• Who had administrative access;
• Which devices were authorized;
• Who managed the account;
• Whether access credentials were shared;
• Who was physically responsible for the disputed publication.

Corporate Account Does Not Automatically Mean Director Liability

If the account belongs to a company, the existence of a corporate account does not by itself establish that the company’s director personally made every publication.

Individual criminal responsibility generally requires attribution of the relevant conduct to the individual.

Can Screenshots Prove Account Ownership?

Screenshots can be evidence, but their evidentiary value depends on what they actually establish and whether their authenticity and context can be verified.

A screenshot may show what appeared on a screen.

It may not independently establish:

• Who controlled the account;
• When the content was uploaded;
• Whether the content was altered;
• Whether the account was compromised;
• Which device was used.

Preserve the Original Digital Evidence

If the defense relies on digital evidence, preserve the original material whenever possible.

Do not rely exclusively on cropped screenshots.

Relevant evidence may include:

• Original device;
• Original messages;
• Exported account data;
• Security emails;
• Login records;
• Platform correspondence;
• Metadata;
• Original files.

Request Technical Investigation

Where account ownership is genuinely disputed, the defense may request investigation of relevant technical evidence rather than simply denying the allegation.

Depending on the case, this can include requests concerning:

• IP records;
• Login dates;
• Subscriber information;
• Device information;
• Platform records;
• Telephone numbers;
• Email accounts;
• Digital forensic examination.

Turkish judicial decisions demonstrate that failure to investigate available technical attribution evidence can lead to findings of insufficient investigation.

What If the Platform Is Located Abroad?

Many social media platforms operate internationally.

Obtaining records from a foreign platform can create procedural and practical difficulties. The relevant authorities may need to use appropriate judicial or official cooperation mechanisms.

The inability to obtain one particular platform record should not automatically end the investigation where other evidence may exist.

Turkish judicial materials have emphasized that investigators should consider additional avenues of evidence rather than simply terminating an investigation because information from a foreign platform was unavailable.

Request a Digital Forensic Examination Where Appropriate

If the defendant’s devices are available, a technical examination may help determine whether the account was actually used from those devices.

The examination should be performed through the appropriate legal procedure and should preserve the integrity of the underlying evidence.

Do Not Delete the Account

A defendant who learns about an investigation should generally avoid deleting, modifying or manipulating potentially relevant evidence.

Deleting an account or wiping a device can create additional evidentiary questions and may make the defense more difficult.

Do Not Change the Story Without Evidence

The defense should establish a consistent chronology.

For example:

“I never controlled the account.”

is materially different from:

“I controlled the account but someone else accessed it on that date.”

These defenses require different evidence.

Build an Account Ownership Timeline

A useful defense chronology can include:

Account creation date

→ registered email/phone

→ first known login

→ devices used

→ relevant IP addresses

→ alleged criminal publication

→ defendant’s location

→ security events

→ account recovery or complaint

→ subsequent account activity

This can reveal inconsistencies that are difficult to see from isolated screenshots.

Compare the Prosecution’s Evidence With Independent Evidence

If the prosecution relies on:

“The account used the defendant’s name.”

the defense can ask:

Who registered the account?

Which email was used?

Which phone number was used?

Which IP address accessed it?

Which device was used?

Where was the defendant at that time?

Was there evidence of account compromise?

Are there independent witnesses or communications connecting the defendant to the publication?

Expert Evidence May Be Important

Complex digital attribution disputes may require examination by a qualified technical expert.

An expert may assist in analyzing:

• IP data;
• Device records;
• Login information;
• Metadata;
• Account activity;
• Digital forensic images.

The legal significance of the technical findings should then be assessed together with the rest of the evidence.

Foreign Defendants Should Consider Translation Issues

Technical reports may contain specialized terminology that is difficult to understand in Turkish.

A foreign defendant should receive sufficient explanation of the allegations and evidence so that the defense can respond meaningfully.

Account Ownership and Criminal Responsibility Are Different Questions

Even if a person is shown to have accessed an account, the prosecution may still need to establish the elements of the specific offense alleged.

For example:

Account access

does not automatically equal

authorship of every publication

and

authorship of a publication

does not automatically resolve every element of the alleged crime.

The entire evidentiary chain should therefore be examined.

What If There Is Only a Screenshot?

If the case essentially consists of a screenshot and an account bearing the defendant’s name, the defense should consider whether further technical investigation is necessary.

Recent Turkish judicial decisions have specifically addressed situations in which a defendant denied making a social media publication and the available evidence consisted essentially of a screenshot; the court emphasized the need to investigate account-related IP and subscriber information.

What If the Defendant Is Convicted?

If a conviction rests on an attribution that the defense considers technically unsupported, the available appellate remedies should be evaluated based on the procedural stage and judgment.

The defense should identify whether the court adequately addressed the disputed account ownership evidence and whether relevant technical investigation was performed.

What Should a Foreign Defendant Do Immediately?

A foreign defendant should preserve all devices and account records, avoid deleting or modifying relevant information, obtain the complete investigation file where legally available, identify exactly what evidence connects them to the account, document their location during the alleged activity, identify possible alternative users, request appropriate technical investigation and challenge unsupported attribution.

Frequently Asked Questions

Does having a social media account in a foreigner’s name prove that they own it?

Not necessarily. The investigation may need to establish who actually controlled and used the account.

Can an IP address prove who made the post?

An IP address can be important evidence, but it does not automatically establish which individual physically operated the account.

Can a fake social media account be used to accuse a foreigner?

A fake account can trigger an investigation, but the prosecution should still establish the connection between the defendant and the relevant activity.

What if someone used the foreigner’s photograph?

A photograph alone does not establish account control. Technical and other supporting evidence may be required.

What if the account was hacked?

The defendant should preserve security notifications, login alerts, recovery records and other evidence supporting the unauthorized-access allegation.

Can screenshots alone establish criminal responsibility?

Their evidentiary value depends on authenticity, context and what they actually establish. Where ownership is disputed, additional technical investigation may be important.

Can Turkish authorities request IP information?

Depending on the circumstances and applicable procedure, investigators can seek technical and subscriber information from relevant institutions and service providers. Turkish judicial decisions have emphasized the importance of such investigation in disputed social media cases.

What if the defendant was abroad when the post was allegedly made?

Travel and location evidence may become relevant to challenging attribution, although being outside Turkey does not by itself conclusively determine who operated an account.

What if the social media company is outside Turkey?

Foreign platform records may require appropriate international cooperation or other lawful procedures. The investigation should also consider alternative evidence.

What is the most important defense point?

Do not focus only on the account name. Challenge the entire attribution chain: registration information, IP address, time, subscriber data, devices, platform records, location and independent evidence connecting the defendant to the actual publication.

Client-Focused Legal Support for Foreign Defendants in Social Media Cases

Social media attribution disputes can involve IP addresses, digital devices, subscriber records, platform information, screenshots, account recovery data, location evidence and expert digital analysis. Fırat Fesih Kaya Law Office assists foreign nationals facing criminal investigations and prosecutions in Turkey involving disputed social media accounts, alleged online publications, impersonation, hacked accounts and digital evidence. Lawyer Fırat Fesih Kaya provides legal assistance in reviewing investigation files, challenging unsupported account attribution, requesting technical evidence, coordinating digital forensic analysis and developing defense strategies for foreign defendants.

Phone: +90 312 434 22 22

Mobile: +90 532 769 22 22

Email: info@firatfesihkaya.av.tr

Address: Mevlana Boulevard No:221, Yıldırım Tower, Office No:148, 06520 Balgat, Çankaya, Ankara, Turkey