Fake Email Sent in a Foreigner’s Name in Turkey: How Can Digital Evidence Prove Impersonation? (2026 Updated Guide)

A fake email is sent using a foreigner’s name in Turkey. Learn how email headers, IP records, device evidence, account data and forensic examination can help prove impersonation.

A foreign national in Turkey may suddenly discover that an email was sent in their name even though they never created, authorized or sent the message. This can become particularly serious when the email contains threats, fraudulent instructions, commercial commitments, false statements or information connected with a criminal investigation.

The central legal question is not simply whose name appears in the email. The investigation should establish who actually controlled the email account, which device or connection was used, when the message was created and transmitted, and whether the foreigner had any connection with the digital activity.

Turkish criminal proceedings allow digital evidence to play an important role in establishing these facts. For a foreigner accused of impersonation, the immediate priority should therefore be preservation and forensic examination of the original digital evidence rather than relying only on a denial.

A Name in an Email Does Not Automatically Prove Who Sent It

An email can contain another person’s name in the sender display field, signature or message body without actually being sent from that person’s account.

For example:

Display name: Foreign Investor

Actual email account: different account

Signature: Foreign Investor

The visible name alone is therefore not enough to establish authorship.

The investigation should examine the underlying technical information.

What If the Attacker Used the Foreigner’s Real Email Account?

This is more serious because the message may appear to have originated from an account genuinely associated with the foreigner.

Even then, account ownership does not automatically establish that the account holder personally sent the message.

Possible explanations may include:

• Password compromise;
• Unauthorized login;
• Stolen session credentials;
• Malware;
• Phishing;
• Unauthorized access by another person;
• Access from a previously logged-in device.

The relevant question becomes who controlled the account at the time of transmission.

Email Headers Can Be Important Evidence

The complete email header may contain technical information concerning the transmission of the message.

Depending on the email system and available records, investigators may examine:

• Sending servers;
• Routing information;
• Message identifiers;
• Timestamps;
• Authentication results;
• Originating infrastructure;
• Mail-server logs.

A screenshot of the email is substantially weaker than preserving the original electronic message and its technical metadata.

Do Not Delete the Original Email

A foreigner who discovers a fake email should preserve the original message.

Avoid forwarding it repeatedly in a way that changes or loses technical information.

Preserve:

• Original email;
• Full headers;
• Attachments;
• Metadata;
• Date and time;
• Sender information;
• Recipient information.

The original electronic evidence can later be examined by a qualified forensic expert.

Email Authentication Records May Help

Modern email systems may use authentication mechanisms such as SPF, DKIM and DMARC.

These mechanisms can help investigators understand whether a message was transmitted through an authorized mail infrastructure or whether the sender information was manipulated.

They do not independently prove the identity of the human who typed the message, but they can contribute to the technical analysis.

IP Address Evidence Can Be Relevant

If investigators can lawfully obtain relevant service-provider records, IP information may help establish the network connection used to access an account or transmit a message.

However, an IP address does not automatically identify a specific individual.

A household, office, hotel, public network or shared connection may be used by multiple people.

VPN Use Does Not Automatically Prove Guilt

If an investigation shows a VPN or other intermediary network, that does not automatically establish who used the connection.

The technical investigation may need to examine additional evidence, including account logs, device evidence and provider records.

Public Wi-Fi Creates Additional Identification Problems

A fake email may have been sent from:

• Hotel Wi-Fi;
• Airport Wi-Fi;
• Café network;
• Office network;
• Shared residence;
• University network.

In such cases, an IP address may identify only the network rather than the individual.

Additional evidence becomes particularly important.

Hotel Records Can Become Relevant

If the foreigner was staying at a hotel when the alleged email was sent, the investigation may examine:

• Hotel registration;
• Network logs where lawfully retained;
• Device information;
• CCTV where legally available;
• Access records.

The purpose should be to determine whether the foreigner actually had access to the relevant device or network.

Device Forensics Can Be Critical

A forensic examination of a computer or phone may reveal whether the accused foreigner actually accessed the email account.

Relevant evidence can include:

• Browser history;
• Login sessions;
• Saved credentials;
• Email application data;
• Authentication tokens;
• Malware;
• Deleted files;
• Device timestamps.

The legality and scope of any seizure or examination must be considered separately.

A Foreign Suspect Should Not Destroy Digital Evidence

Deleting the alleged email, wiping a phone or resetting a computer can create unnecessary evidentiary problems.

Even when the person is innocent, destruction of potentially relevant evidence may make it more difficult to establish what actually happened.

Cloud Account Logs May Be Important

Email providers may maintain records concerning account access and security events.

Depending on the provider and applicable legal procedures, investigators may seek information regarding:

• Login times;
• IP addresses;
• Device types;
• Security alerts;
• Password changes;
• Recovery-email changes;
• Multi-factor authentication events.

Password Changes Can Establish a Timeline

Suppose:

08:15 — foreigner’s password changed

08:22 — unfamiliar login

08:30 — fake email sent

This sequence could materially support an unauthorized-access explanation.

The complete account-security history should therefore be preserved.

Recovery Email and Phone Number Evidence Matters

An attacker may change the account’s recovery information before sending the fake email.

Records showing when recovery details changed can help establish when unauthorized control may have occurred.

Multi-Factor Authentication Records May Be Relevant

If the foreigner’s account used two-factor authentication, investigators may examine authentication events where legally available.

Evidence showing that a login required a device or authentication method unavailable to the accused person may be particularly relevant.

The Foreigner’s Physical Location Should Be Examined

Location evidence can sometimes help test the allegation.

For example, if the email was allegedly sent from a device or network in Ankara while the foreigner was demonstrably abroad, that discrepancy may be significant.

Travel records, passport records, hotel documentation and other lawful evidence can help establish physical presence.

Do Not Rely on Location Evidence Alone

A person’s physical location does not necessarily prove that they did not send an email.

Remote access and account compromise are possible.

Location evidence should therefore be combined with technical evidence.

Time Zones Can Create Confusion

Email systems may display timestamps according to different time zones.

Investigators should establish the correct timestamp before drawing conclusions from the apparent time of transmission.

Examine the Language of the Email

Linguistic evidence can sometimes support or weaken an impersonation allegation.

For example, the message may use terminology, language or writing patterns inconsistent with the foreigner’s ordinary communications.

This should generally be treated as supporting evidence rather than conclusive proof.

Examine the Recipient

The recipient may have important information concerning the origin of the message.

Ask:

• How did the recipient know the alleged sender?
• Was the message expected?
• Did the sender use a known account?
• Was there a previous conversation?
• Did the sender request money or confidential information?
• Did the recipient respond?

The entire communication chain may be more informative than the disputed email alone.

Check Whether the Email Was Spoofed

Email spoofing can make a message appear to come from another address.

A spoofed message may use a familiar sender identity even though the message did not originate from the genuine account.

Technical analysis of the complete headers and authentication results can help distinguish different scenarios.

Fake Email Accounts Can Also Be Created

An attacker may create an address resembling the foreigner’s name.

For example:

genuine.account@example.com

versus

genuine.account.tr@example.com

A recipient may incorrectly assume that the second address belongs to the foreigner.

The exact address should therefore be preserved.

Corporate Email Systems Require Additional Investigation

If the foreigner works for a company, the email may have passed through corporate systems.

The company may have:

• Microsoft 365 logs;
• Google Workspace logs;
• Exchange records;
• Endpoint security records;
• Firewall logs;
• Identity-management logs.

These records can be highly valuable in identifying unauthorized access.

Corporate IT Teams Should Preserve Logs Quickly

Log retention periods can be limited.

A company investigating suspected impersonation should preserve relevant records before they are automatically deleted or overwritten.

Turkish Police or Prosecutors May Obtain Digital Evidence Through Legal Procedures

Where a criminal investigation exists, prosecutors and courts may use legally available procedures to obtain relevant digital records.

The foreign suspect should therefore coordinate the defense with counsel rather than attempting to obtain another person’s private account records independently.

Digital Evidence Must Be Assessed for Reliability

Not every screenshot or exported email has the same evidentiary value.

The defense should ask:

• Where did the evidence originate?
• Who collected it?
• When was it collected?
• Was the original preserved?
• Has it been altered?
• Can the metadata be verified?
• Can the evidence be connected to the accused?

Screenshots Are Not Always Enough

A screenshot can show what appeared on a screen.

It may not establish:

• Which account transmitted the message;
• Which device generated it;
• Who controlled the device;
• Whether the content was altered;
• Whether the displayed sender identity was genuine.

Original electronic evidence should therefore be preserved whenever possible.

Chain of Custody Matters

Where digital evidence is seized or collected during a criminal investigation, the circumstances of collection, preservation and examination may become important.

The defense should review how the evidence entered the case file.

What If the Foreigner’s Phone Was Seized?

The defense should examine the legal basis for the seizure and subsequent examination.

The fact that a device belonged to the accused does not automatically establish that every activity found on it was performed by that person.

Malware Can Provide an Alternative Explanation

A compromised device may contain malicious software capable of:

• Stealing passwords;
• Accessing email sessions;
• Reading messages;
• Sending communications;
• Recording credentials.

A forensic examination may therefore need to investigate compromise indicators.

Examine Other Devices

The alleged sender may have used:

• Laptop;
• Desktop;
• Tablet;
• Smartphone;
• Corporate computer.

A complete timeline should consider all relevant devices rather than focusing on the device most recently used by the foreigner.

Evidence of Account Sharing Can Complicate the Case

If multiple employees or family members had access to an account, the defense should identify that fact clearly.

Shared credentials can make simple attribution unreliable.

The Foreigner Should Build an Alternative Digital Timeline

A useful defense timeline might show:

Foreign national leaves hotel at 18:00

→ Unknown login at 18:12

→ Password changed at 18:15

→ Fake email transmitted at 18:18

→ Foreign national’s device contains no corresponding activity

A properly supported timeline can be much stronger than a general denial.

Preserve Evidence Showing What the Foreigner Was Actually Doing

Potentially relevant evidence may include:

• Travel records;
• Work records;
• Meeting records;
• Hotel records;
• Other communications;
• Device logs;
• Payment records;
• Access-control records.

The evidence should be obtained and presented lawfully.

What If the Fake Email Caused Financial Loss?

The situation may become more serious if the impersonator used the foreigner’s identity to obtain money or cause another person to transfer funds.

The investigation should distinguish the impersonator’s conduct from the innocent person’s identity being misused.

What If the Email Contains a Criminal Threat?

A threatening email sent in the foreigner’s name can expose the innocent person to immediate suspicion.

The defense should promptly preserve the message and establish the technical origin.

What If the Email Was Used to Defraud a Company?

The same principles apply.

The company should preserve its original email and related logs, while the accused foreigner should seek access to the relevant evidence through the appropriate criminal-procedure mechanisms.

Can an Expert Report Help?

Yes. A qualified digital-forensics expert may assist in examining:

• Headers;
• Metadata;
• Device artifacts;
• Login records;
• IP information;
• Authentication records;
• Malware indicators.

Expert analysis should be based on original evidence wherever possible.

What If the Digital Evidence Is Incomplete?

Incomplete evidence does not automatically prove impersonation or innocence.

The defense should identify what is missing and determine whether additional records can lawfully be obtained.

Can the Foreigner Challenge the Allegation?

Yes. If the accusation rests on unreliable attribution, the defense can challenge the evidentiary basis and present evidence showing that the alleged activity cannot reliably be attributed to the foreign national.

The exact procedural route depends on the stage of the criminal investigation or prosecution.

Do Not Contact the Alleged Attacker Recklessly

A foreigner who discovers account compromise may be tempted to confront the suspected attacker.

Preserve the evidence first. Communications with the suspected person can alter evidence or create additional disputes.

Secure the Account Immediately

Where compromise is suspected, the account should be secured through legitimate security procedures.

Depending on circumstances, this may include changing passwords, reviewing active sessions, enabling multi-factor authentication and preserving security notifications.

The timing of these steps should also be documented.

File a Separate Complaint Where Appropriate

If there is evidence that an unknown person accessed the account or impersonated the foreigner, the foreigner may consider making a separate criminal complaint concerning the unauthorized activity.

The two issues should be clearly distinguished:

Who committed the underlying conduct?

and

Was the foreigner’s identity or account misused?

Immediate Legal Strategy for a Foreigner Accused of Sending a Fake Email

The foreigner should preserve the original email, obtain the complete headers, document account-security events, preserve devices without destroying evidence, identify possible unauthorized logins, establish their physical location, collect relevant travel and work evidence, request appropriate digital records through lawful procedures, obtain forensic assistance where necessary and challenge any assumption that a displayed name alone proves authorship.

Frequently Asked Questions

Can someone be convicted simply because an email contains their name?

The name appearing in an email does not by itself establish who actually created or transmitted the message. The evidentiary assessment depends on the complete circumstances.

What is the most important digital evidence?

Depending on the case, original email data, complete headers, provider logs, device evidence, authentication records and other technical records can be highly important.

Can an IP address prove who sent the email?

Not necessarily. An IP address may identify a network connection rather than a specific individual.

What if the foreigner’s real email account was hacked?

Account ownership does not automatically prove that the owner sent every message. Evidence of unauthorized access, password changes, unfamiliar logins and device compromise can become relevant.

Are screenshots sufficient?

They may be useful, but original electronic evidence and technical metadata can provide substantially more information about origin and transmission.

Can a digital-forensics expert examine the email?

Yes. Expert analysis can assist with headers, metadata, account access, devices and other technical evidence.

What if the foreigner was abroad when the email was sent?

Travel and location evidence may support the defense, particularly when combined with technical records, although physical location alone is not necessarily conclusive.

Should the foreigner delete the fake email?

No. The original should be preserved because deleting it may destroy important evidence.

Can the foreigner make a criminal complaint about impersonation?

Potentially, where the evidence supports unauthorized account access, identity misuse or another criminal act. The exact legal characterization depends on the circumstances.

What should the foreigner do first?

Preserve the original email and its technical information, avoid altering or deleting relevant devices, and obtain legal assistance to establish who actually controlled the account or device when the message was sent.

Client-Focused Legal Support for Digital Impersonation Cases in Turkey

A fake email sent in a foreign national’s name can create serious criminal, reputational, commercial and immigration-related risks. Fırat Fesih Kaya Law Office assists foreign nationals and international businesses facing criminal investigations involving email impersonation, unauthorized account access, digital evidence and disputed authorship. Lawyer Fırat Fesih Kaya provides legal assistance in reviewing investigation files, preserving digital evidence, coordinating forensic examinations, challenging unreliable attribution and presenting evidence showing that a foreign national did not create or transmit the disputed communication.

Phone: +90 312 434 22 22
Mobile: +90 532 769 22 22
Email: info@firatfesihkaya.av.tr
Address: Mevlana Boulevard No:221, Yıldırım Tower, Office No:148, 06520 Balgat, Çankaya, Ankara, Turkey