Employee Uses Company Bank Account Without Authorization in Turkey: Criminal Remedies 2026

Employee transferred or withdrew money from a company bank account without authorization in Turkey? Learn how foreign companies can preserve banking evidence, trace stolen funds, file a criminal complaint, investigate digital access and pursue asset recovery in 2026.

Discovering that an employee has accessed or used a company’s Turkish bank account without authorization can create an immediate financial and criminal-law emergency. The employee may have transferred money to a personal account, withdrawn cash, paid fictitious suppliers, redirected company funds to relatives, changed payment instructions, used internet banking credentials without permission or transferred money after their banking authority had been revoked.

For a foreign-owned company, the first question should not simply be:

“Did the employee take money?”

The investigation should determine:

Who accessed the account? What authority did that person have? How was access obtained? Which transactions were made? Where did the money go? What was the stated business purpose? Who benefited? What banking and digital evidence can prove the transaction chain?

Depending on these facts, Turkish criminal law may raise different issues, including breach of trust, fraud, offences involving unauthorized access to information systems or other property-related offences. Turkish judicial materials specifically caution that computer-related conduct may overlap with fraud, theft and breach of trust, and that the correct criminal characterization depends on how the conduct occurred.

For the company, the immediate strategy should usually be:

Secure the bank account → Preserve evidence → Identify unauthorized transactions → Trace the money → Preserve digital access records → Determine individual responsibility → File a structured criminal complaint where appropriate → Pursue recovery in parallel.

What Does Unauthorized Use of a Company Bank Account Mean?

There is an important difference between an employee who had legitimate access but allegedly misused company money and an employee who never had authority to access the account in the first place.

Possible scenarios include:

• Employee transfers company money to a personal account.
• Finance employee sends money to a relative.
• Former employee continues using internet banking credentials.
• Employee secretly obtains another manager’s password.
• Employee uses a company phone to approve transfers.
• Employee makes unauthorized cash withdrawals.
• Accountant creates payments to fictitious suppliers.
• Employee changes supplier bank details.
• Employee transfers money to a controlled company.
• Employee sends funds to a cryptocurrency exchange.
• Employee redirects customer refunds.
• Employee exceeds a transaction limit or internal authority.
• Employee uses another director’s banking credentials.
• Employee makes transfers after dismissal or resignation.

These scenarios should not automatically receive the same criminal classification.

First Step: Secure the Company Bank Account

If unauthorized activity is continuing, the company should immediately contact its bank through official channels.

Consider reviewing:

• Internet banking users
• Authorized signatories
• Mobile banking devices
• Payment limits
• Dual-approval requirements
• Registered telephone numbers
• Corporate cards
• Automatic payments
• Beneficiary lists
• API or accounting integrations

The objective is to prevent additional unauthorized transactions without destroying evidence of what already occurred.

Do Not Delete the Employee’s Banking Profile Before Preserving Evidence

A common mistake is immediately deleting every user account associated with the suspected employee.

Access may need to be suspended, but first preserve available records showing:

• Username
• Authorization level
• Device
• Transaction history
• Approval history
• Date and time
• Changes to beneficiary information

The company’s bank may hold additional technical records that the company itself cannot access.

Identify Every Suspicious Transaction

Create a transaction schedule rather than making a general accusation.

Date	Amount	Recipient	Initiated By	Approved By	Description	Concern
12.02.2026	€45,000	Employee	User A	User A	Advance	No authorization
18.02.2026	€90,000	Supplier X	User A	User B	Consulting	Supplier unknown
03.03.2026	€30,000	Third Party	User A	User A	Expense	No documents

This schedule can become the foundation of the internal investigation and criminal complaint.

Trace the Money Beyond the First Account

Suppose an employee transfers TRY 5 million from the company account into their own account.

The investigation should not stop there.

Trace:

Company → Employee → Relative → Cash withdrawal

or:

Company → Employee → Cryptocurrency exchange → Digital asset

or:

Company → Employee → Genuine supplier payment

The final destination can materially change the legal assessment.

Transfer to the Employee’s Personal Account

A transfer to an employee’s personal bank account is important evidence, but it does not automatically prove criminal conduct.

Possible legitimate explanations can include:

• Salary
• Bonus
• Expense reimbursement
• Travel advance
• Company purchase advance
• Repayment of an employee receivable

The company should compare the transfer with:

• Employment agreement
• Payroll
• Expense documents
• Management approval
• Accounting entries
• Correspondence
• Subsequent use of funds

A personal transfer without genuine corporate purpose presents a very different evidentiary picture.

Breach of Trust May Be Relevant

Turkish Criminal Code Article 155 addresses situations involving property belonging to another person that was entrusted for safekeeping or a particular use and is subsequently disposed of contrary to that purpose for the benefit of the person or another.

Official Ministry of Justice training material explains the important distinction between breach of trust and theft: in breach-of-trust situations, possession was initially entrusted to the person, whereas theft involves obtaining possession that the offender did not previously have.

This distinction can be especially important for employees who legitimately controlled company money as part of their employment.

Example: Finance Manager With Banking Authority

Assume a finance manager is authorized to make supplier payments up to TRY 2 million.

The manager transfers TRY 1.5 million to a company secretly owned by a relative and records the payment as:

“Technical consultancy.”

No consultancy service exists.

The relevant questions include:

• Was company money entrusted to the manager?
• What was the permitted purpose of the authority?
• Was the recipient genuinely providing services?
• Was the relationship concealed?
• Who ultimately benefited?
• Was the accounting description genuine?

Having banking authority does not necessarily mean the employee was entitled to use company money for personal purposes.

Authorized Access Does Not Mean Authorized Use

This is one of the most important distinctions in internal-fraud cases.

An employee may be technically authorized by the bank to make payments.

But that does not necessarily mean every payment is authorized by the company.

For example:

Bank authority: Employee can transfer up to TRY 3 million.

Internal authority: Employee can transfer only against approved supplier invoices.

If the employee transfers money to themselves, the existence of banking authority does not automatically establish a legitimate corporate purpose.

What If the Employee Had No Banking Authority?

The analysis can be different where the employee allegedly obtained access without authorization.

Examples include:

• Stealing another employee’s password
• Using another person’s authentication device
• Secretly accessing a logged-in computer
• Taking a corporate banking phone
• Using credentials after employment ended

Turkish judicial training materials recognize that unauthorized computer-based transfers can require analysis under specific information-system or property offences rather than being automatically treated as ordinary fraud.

The exact access method should therefore be documented.

Preserve Login Evidence

Potentially relevant technical evidence may include:

• Login timestamps
• IP information
• Registered device
• Device identifier
• Authentication method
• SMS verification
• Mobile approval
• Password reset
• Beneficiary creation
• Transfer initiation
• Second approval
• Failed login attempts

Ask the bank what records exist and how long they are retained.

Do Not Assume an IP Address Identifies the Employee

Technical evidence should be interpreted carefully.

A corporate office may use:

• Shared internet connection
• Shared workstation
• VPN
• Remote desktop
• Common banking terminal

Therefore:

Account + IP address ≠ automatic identification of the human user.

Combine technical evidence with device, access, timing and workplace records.

Two-Step Approval Cases

Many companies require two employees to approve large transfers.

If a suspicious transaction passed through two approvals, determine:

Who initiated?

Who approved?

What information did the second approver see?

Was the supporting invoice fake?

Were credentials compromised?

The second approver should not automatically be treated as a participant merely because their credentials appear in the transaction.

Employee Uses the Manager’s Password

Suppose a finance employee knows the managing director’s password and uses it to approve a transfer.

Preserve evidence concerning:

• How the password was obtained
• Whether password sharing was common
• Device used
• Authentication messages
• Manager’s location
• Employee’s location
• Previous login practices

Do not fabricate a cybersecurity explanation after discovering the transaction.

Manager Was Abroad When Transfer Occurred

Travel records can become useful evidence.

If a disputed payment was supposedly approved from a Turkish office computer while the manager was abroad, preserve:

• Passport/travel records
• Flight records
• Hotel records
• Corporate calendar
• Device information

Travel evidence may be significant, although it does not alone prove who actually initiated the transaction.

Cash Withdrawals

Cash transactions can be particularly difficult to trace.

Preserve:

• Withdrawal slip
• Branch information
• ATM details
• Authorization
• Cash-account records
• Expense documentation

Where relevant and legally available, investigators may seek additional banking or surveillance evidence.

Act quickly because some records may not be retained indefinitely.

Payments to a Relative

Suppose the employee transfers company money to:

• Spouse
• Sibling
• Parent
• Friend
• Company controlled by a relative

The relationship can be relevant, but it does not by itself prove criminal participation by the recipient.

Investigate:

Why was the payment made?

Was there a genuine commercial relationship?

What happened to the money afterward?

Fictitious Supplier Scheme

An employee may create or use a supplier to extract money from the company.

Investigate:

• Supplier ownership
• Address
• Employees
• Website
• Tax and corporate information
• Contract
• Purchase order
• Invoice
• Delivery
• Service evidence
• Bank account
• Relationship with employee

Do not assume every unfamiliar supplier is fictitious.

Employee Changes Supplier IBAN

Another common scheme involves altering legitimate supplier banking details.

Example:

Real supplier invoice → Employee changes IBAN → Company pays fraudster-controlled account.

Preserve:

• Original invoice
• Altered invoice
• Email headers
• Supplier correspondence
• ERP changes
• Beneficiary-change logs
• Approval records

Determine whether the change originated internally or through an external cyberattack.

Internal Fraud or Business Email Compromise?

This distinction is critical.

A suspicious transfer may result from:

Dishonest employee

or

External attacker compromising the employee’s email

or

External attacker working with an insider.

Do not accuse the employee solely because their account was used.

Investigate the technical evidence.

Former Employee Uses the Account

A company may discover transactions made after an employee:

• Resigned
• Was dismissed
• Was suspended
• Lost financial authority

Determine:

When did employment end?

When was bank authority revoked?

When were credentials disabled?

When was the transaction made?

This chronology can be central to both criminal and internal-control analysis.

Customer Money Diverted Before Reaching the Company

An employee may send customers unauthorized payment instructions.

Example:

“Our bank account has changed. Please pay this new IBAN.”

The account belongs to the employee.

Preserve:

• Customer emails
• Messages
• Invoices
• Bank transfer receipts
• Company account records
• Employee email records

Identify all customers who may have received altered instructions.

Employee Claims the Transfer Was a Bonus

Do not accept or reject the explanation automatically.

Check:

• Employment agreement
• Bonus plan
• Payroll
• Board or management approval
• Tax/accounting treatment
• Historical practice

The question is whether the claimed entitlement genuinely existed at the time.

Employee Claims the Company Owed Them Money

An employee may say:

“The company owed me expenses, so I paid myself.”

Even if an underlying receivable existed, unilateral use of company banking authority may raise separate questions.

Determine:

• Was the debt genuine?
• Was the amount correct?
• Was payment due?
• Did the employee have authority to self-pay?
• Was the transaction concealed?

Fraud May Also Be Relevant

Where the employee allegedly uses deceptive conduct to cause another person to authorize or execute a payment, fraud provisions may become relevant depending on the precise facts.

The classification should follow the evidence.

Do not automatically label every unauthorized company transfer as fraud.

Information-System Offences May Be Relevant

Where an employee accesses banking or company systems without authority, alters data or uses technical access to move funds, information-system offences may also require analysis.

Ministry of Justice judicial materials specifically note that computer-related offences can be confused with or coexist with fraud, theft and breach of trust.

This makes the access method legally significant.

Do Not Assume Account Ownership Proves Criminal Responsibility

The reverse scenario can also occur.

Suppose company money is transferred to Employee A’s bank account, but Employee A claims someone else controlled the account.

Recent official prosecutorial warnings demonstrate the serious criminal risks associated with allowing third parties to use bank accounts and explain that accounts used for fraud can lead to investigations involving fraud and money-laundering allegations.

Nevertheless, in a criminal case, the evidence should still establish the individual’s actual role rather than relying solely on a bank-account name.

Preserve Company Emails and Messages

Relevant communications may include:

• Payment instructions
• Supplier discussions
• Requests for approval
• Messages about cash
• Instructions to accountants
• Attempts to conceal transfers

Preserve complete conversations.

Do not rely only on cropped screenshots.

Preserve the Employee’s Company Device Lawfully

If the employee used a company laptop or phone, relevant corporate data may need preservation.

Consider:

• Banking browser history
• Corporate email
• ERP records
• Files
• Corporate messaging
• Authentication records

Evidence collection should respect applicable criminal, employment, privacy and personal-data rules.

Never Hack the Employee’s Personal Accounts

Do not attempt to obtain evidence by:

• Guessing personal passwords
• Secretly entering personal email
• Accessing private cloud accounts without authority
• Installing spyware

Preserve evidence the company lawfully controls and identify additional evidence for investigators to obtain through lawful procedures.

What Should the Criminal Complaint Contain?

A useful complaint should be transaction-specific.

For each transaction explain:

1. Date.
2. Amount.
3. Company account.
4. Recipient.
5. Employee’s authority.
6. Why the transaction appears unauthorized.
7. Supporting banking evidence.
8. Relevant communications.
9. Subsequent movement of funds if known.
10. Evidence that authorities may need to obtain.

Avoid vague statements such as:

“Our employee stole everything.”

File the Complaint With a Clear Chronology

A chronology can show:

Employment begins → Banking authority granted → Suspicious supplier created → Transfers begin → Internal audit discovers issue → Access suspended → Complaint filed.

This is often more useful than hundreds of unsorted attachments.

Identify the Directly Injured Company

Where money was taken from a Turkish subsidiary’s bank account, the subsidiary itself will ordinarily be central to the loss analysis.

A foreign parent company should therefore review:

• Shareholding
• Representation
• Board authority
• Signature authority
• Who can appoint counsel
• Whether suspected management has a conflict

Do not assume parent-company ownership automatically eliminates the subsidiary’s separate legal position.

What If the Suspected Employee Is Also a Director?

The case becomes more complex where the person is both:

Employee + Director + Authorized signatory.

Banking authority may have been broad.

The investigation should separate:

Technical authority to make the transaction

from

lawful corporate purpose for making it.

What If the Employee Is the Finance Director?

Position alone does not prove guilt.

The company should determine:

• Who initiated the payment
• Who selected the recipient
• Who approved the invoice
• Who controlled the banking credentials
• Who benefited

Individual responsibility matters.

Bank Records Can Exonerate Employees Too

Suppose management initially believes an employee stole €100,000.

Further investigation reveals:

Company → Employee → Supplier

and the employee had been instructed to make an emergency supplier payment using an approved advance.

Bank records can therefore prove innocence as well as wrongdoing.

Criminal Complaint Does Not Automatically Recover the Money

Even a strong criminal complaint does not guarantee immediate repayment.

The company should consider a parallel recovery strategy.

Depending on the circumstances, this may involve:

• Civil claims
• Enforcement proceedings
• Employment-related claims
• Corporate remedies
• Protective measures where legally available

Criminal proceedings and financial recovery should be coordinated rather than treated as identical.

Asset Tracing

Identify whether suspected proceeds may have moved into:

• Personal bank accounts
• Relative accounts
• Vehicles
• Real estate
• Company shares
• Cryptocurrency
• Foreign accounts

Do not make unsupported allegations about assets.

Build the trace from evidence.

Evidence Held by the Bank

The company may possess its own statements, but additional evidence may be held by the bank.

Potentially relevant records may include:

• Login records
• Approval logs
• Device records
• Beneficiary creation
• Authentication history
• Branch records
• Transfer documentation

The criminal complaint can identify the importance of these records so that investigators can consider obtaining them under applicable procedures.

2026: Banking Evidence Is Increasingly Important in Financial Crime Investigations

Official Turkish prosecutorial authorities have continued issuing warnings in 2026 concerning misuse of bank accounts in fraud schemes. A February 2026 prosecutor’s announcement specifically warned that third-party use of bank accounts can expose account holders to investigations involving aggravated fraud and laundering allegations.

For companies, this reinforces a practical point: banking authority, actual account control, transaction purpose and the identity of the ultimate beneficiary should be documented carefully.

Digital Attribution Must Be Investigated Properly

Recent 2026 Court of Cassation decisions also demonstrate the continuing importance of completing the evidentiary investigation rather than reaching conclusions from incomplete records. In one February 2026 decision involving alleged aggravated fraud and a disputed cheque, the Court required additional investigation into signature authority, the cheque’s origin, genuine comparison signatures and the parties’ commercial relationship.

The same evidence-driven approach is important in internal banking cases:

Do not stop at the account name.

Determine who actually performed, authorized and benefited from the transaction.

What Should Foreign Companies Change After an Incident?

After containing the immediate case, review internal controls.

Consider:

• Dual authorization
• Lower transaction limits
• Independent beneficiary verification
• Alerts for new beneficiaries
• Mandatory leave for finance personnel
• Segregation of duties
• Periodic access review
• Immediate revocation after termination
• Supplier verification
• Related-party declarations
• Audit-log monitoring

A criminal complaint addresses past conduct. Better controls reduce the next loss.

25 Immediate Steps After Unauthorized Company Bank Activity

1. Contact the bank through official channels.
2. Stop continuing unauthorized access.
3. Preserve transaction records.
4. Preserve online banking users.
5. Preserve approval logs.
6. Identify every suspicious payment.
7. Preserve accounting records.
8. Preserve corporate emails.
9. Preserve complete message conversations.
10. Secure relevant company devices.
11. Identify the employee’s actual authority.
12. Review dual-approval records.
13. Identify recipient accounts.
14. Trace subsequent transfers where evidence permits.
15. Preserve supplier documents.
16. Preserve payroll and expense records.
17. Check related-party relationships.
18. Build a transaction chronology.
19. Do not delete or alter evidence.
20. Do not access personal accounts unlawfully.
21. Review subsidiary representation authority.
22. Obtain Turkish criminal-law advice.
23. Prepare a transaction-specific criminal complaint where appropriate.
24. Consider parallel asset-recovery measures.
25. Strengthen banking controls immediately.

Frequently Asked Questions

1. Is an employee committing a crime by transferring company money without permission?

Potentially. The criminal characterization depends on how the employee obtained control of the funds, the scope of authority, purpose of the transfer, recipient, benefit obtained and other evidence. Breach of trust, fraud or computer-related offences may become relevant depending on the facts.

2. What if the employee was authorized to use the company bank account?

Banking authority does not necessarily authorize use of company money for personal purposes. The permitted corporate purpose and actual transaction should be compared.

3. Can breach of trust apply to an employee?

Potentially. Article 155 concerns entrusted property used contrary to the purpose for which possession was transferred. The exact application depends on the employee’s relationship with the property and the particular conduct.

4. What if the employee stole another manager’s internet banking password?

The method of unauthorized system access becomes important and may require analysis of information-system and property offences in addition to the financial transaction itself.

5. Can the company obtain the employee’s bank records?

The company should use records it lawfully possesses. Additional banking information concerning personal accounts generally requires an appropriate legal basis and may need to be obtained by competent authorities through criminal proceedings.

6. What if the employee says the money was an expense reimbursement?

Check expense records, approvals, receipts, accounting treatment and the amount claimed. The explanation should be tested against contemporaneous evidence.

7. What if company money was transferred to the employee’s spouse?

The relationship is relevant but does not by itself prove criminal participation. Determine the purpose of the transfer, commercial basis and subsequent movement of the money.

8. Should the employee be confronted immediately?

Not necessarily. If evidence or assets could disappear, secure lawful access, preserve records and assess the transaction first.

9. Does filing a criminal complaint automatically recover the money?

No. Criminal proceedings and financial recovery are related but distinct. Civil, enforcement, employment and protective remedies may also need to be considered.

10. What evidence is most important?

The strongest cases usually combine bank records, authorization documents, accounting records, digital access evidence, communications and the ultimate destination of the money rather than relying on one piece of evidence.

Legal Assistance for Unauthorized Company Bank Transactions in Turkey

Unauthorized use of a company bank account can develop rapidly from an internal-control problem into a criminal investigation involving employees, managers, accountants, suppliers, relatives, digital systems and multiple bank accounts.

Fırat Fesih Kaya Law Office provides legal assistance to foreign companies, multinational groups, foreign shareholders and investors dealing with suspected employee fraud and unauthorized banking transactions in Turkey.

Lawyer Fırat Fesih Kaya assists foreign clients with internal investigations, criminal complaints, unauthorized company transfers, breach-of-trust allegations, employee fraud, banking evidence, digital evidence, fictitious suppliers, asset tracing and coordination of criminal and financial recovery proceedings.

Early intervention can be particularly important where the suspected employee still has access to company bank accounts, accounting systems, corporate devices or funds that may be transferred before evidence is secured.

Phone: +90 312 434 22 22
Mobile: +90 532 769 22 22
Email: info@firatfesihkaya.av.tr
Address: Mevlana Boulevard No:221, Yıldırım Tower No:148, 06520 Balgat, Çankaya, Ankara, Turkey

This publication is provided for general informational purposes and does not constitute legal advice. The correct criminal characterization of unauthorized company banking activity depends on the employee’s authority, method of access, purpose of the transaction, recipient, benefit, digital evidence and circumstances of the individual case.