Foreign Company Victim of Invoice Manipulation in Turkey: Criminal Complaint and Recovery Options (2026 Updated Guide)

A foreign company suffers losses through invoice manipulation in Turkey. Learn about criminal complaints, fake invoices, changed bank details, evidence preservation, account freezes and recovery options.

Foreign companies doing business in Turkey may suffer significant losses when legitimate invoices are altered, false invoices are created, payment instructions are manipulated or fraudsters substitute their own bank account details for those of the genuine supplier. Invoice manipulation may occur through compromised corporate email accounts, dishonest employees, fake suppliers, forged documents or sophisticated payment-diversion schemes. When money has already been transferred, speed becomes critical. The foreign company should simultaneously consider criminal complaint procedures, preservation of digital and banking evidence, tracing of transferred funds, protective measures and civil recovery claims rather than treating the incident merely as a commercial payment dispute.

What Is Invoice Manipulation?

Invoice manipulation can take several forms. A genuine invoice may be altered before reaching the payer, a completely false invoice may be issued, the amount may be changed or genuine supplier bank details may be replaced with an account controlled by another person.

The legal analysis depends on how the manipulation occurred and who participated.

Fake Bank Account Details Are a Common Risk

A typical case begins with a legitimate commercial relationship. The foreign company receives an email apparently coming from its Turkish supplier stating that the supplier’s bank account has changed.

Payment is then made to the substituted account.

The company later discovers that the genuine supplier never requested the change.

Business Email Compromise Should Be Investigated

The fraud may involve unauthorized access to the supplier’s email, the foreign company’s email or both.

Another possibility is the creation of a visually similar email address designed to impersonate a legitimate employee.

The complete email chain should be preserved immediately.

Do Not Delete Suspicious Emails

Preserve the original electronic messages, attachments, headers and account information. Screenshots alone may not capture all technically relevant information.

The company’s IT department should preserve available server and security records.

Preserve the Original Invoice

Keep both the allegedly manipulated invoice and any genuine version obtained from the supplier.

Compare invoice numbers, dates, amounts, logos, signatures, bank details and document metadata.

Obtain Written Confirmation From the Genuine Supplier

Ask the legitimate supplier to confirm whether it issued the disputed invoice or requested the bank-account change.

This can become important evidence when demonstrating that the payment instructions were fraudulent.

Contact the Bank Immediately

If payment has recently been transferred, the foreign company should contact its bank immediately and request available recall, fraud-reporting and correspondent-bank procedures.

International transfers can move rapidly through multiple accounts.

Contact the Recipient Bank Where Appropriate

The Turkish recipient bank may need to be informed through appropriate legal and banking channels that the account is allegedly being used to receive fraud proceeds.

A private complaint to a bank, however, should not be confused with a judicial freezing order.

Can the Recipient Account Be Frozen?

Potentially, depending on the circumstances and the measures ordered during the criminal investigation.

The criminal complaint should therefore clearly explain the urgency where funds remain traceable in a particular account.

File the Criminal Complaint Quickly

Where the evidence indicates criminal conduct in Turkey, a complaint can be submitted to the competent Turkish prosecution authorities.

The complaint should explain the commercial relationship, genuine invoice, manipulated document, communications, payment and discovery of the fraud in chronological order.

What Evidence Should Accompany the Complaint?

Useful evidence can include contracts, purchase orders, genuine and manipulated invoices, emails, messaging records, bank transfer documents, account information, corporate records and correspondence with the genuine supplier.

For a foreign company, relevant corporate authorization and representation documentation may also need to be organized.

Build a Payment Timeline

Prepare a simple chronology showing when the genuine transaction began, when the invoice was received, when bank details changed, when payment was instructed, when the money arrived and when the fraud was discovered.

Minutes or hours can sometimes matter in tracing transferred money.

Preserve SWIFT and Bank Transfer Information

For international payments, obtain the complete available transfer documentation rather than relying solely on an internal accounting screenshot.

Transaction references and intermediary-bank information may assist the investigation.

Fraudulent Invoice Cases May Involve Multiple Accounts

Funds may be moved rapidly after reaching the first account. The initial recipient may transfer money to other Turkish accounts, withdraw cash or route funds elsewhere.

This is why immediate investigation can be important.

The Account Holder May Not Be the Main Fraudster

Some fraud schemes use accounts belonging to intermediaries or persons who permit others to use their banking facilities.

The identity of the recipient account holder therefore does not necessarily identify the person who designed the entire scheme.

IP and Digital Evidence May Become Important

Where legally obtainable during the investigation, digital records may assist in identifying how communications were manipulated and who controlled relevant accounts.

The foreign company should preserve its own technical evidence so it remains available if requested.

Check Whether the Company’s Own Email Was Compromised

Do not assume automatically that the Turkish supplier was hacked.

Review login history, forwarding rules, mailbox permissions, suspicious sessions and password changes on the foreign company’s systems.

Internal Employee Involvement Should Also Be Considered

Invoice fraud can sometimes involve insiders with access to payment procedures or supplier information.

Internal investigations should be conducted carefully so that relevant evidence is preserved.

Do Not Accuse Employees Without Evidence

Suspicion should be separated from established facts. Preserve access records, communications and approval history before reaching conclusions about individual involvement.

Invoice Manipulation Can Involve Forgery Issues

Where documents, signatures or corporate records were falsified, the criminal investigation may extend beyond the underlying payment fraud.

The precise criminal characterization depends on the facts and evidence.

Fraud and Forgery Should Be Analyzed Separately

A false document may be used as the instrument through which the payment fraud is carried out. The prosecution authorities determine the applicable criminal characterization based on the evidence.

The complainant should focus on presenting the facts accurately.

What If the Invoice Was Genuine but the Bank Account Was Changed?

The manipulation can still be significant even if every other part of the invoice is genuine.

A comparison between the authentic and altered versions may reveal that only the IBAN or beneficiary information was replaced.

Can the Foreign Company Recover the Money Through the Criminal Case?

Criminal proceedings can assist in identifying suspects, tracing assets and preserving evidence, but a foreign company should not assume that filing a criminal complaint automatically guarantees reimbursement.

Civil and enforcement remedies may need to be evaluated in parallel.

Civil Recovery Claims May Be Necessary

Depending on the parties and facts, claims may potentially be pursued against persons who received or retained the funds or against other parties legally responsible for the loss.

The appropriate cause of action depends on the factual relationship between the parties.

Unjust Enrichment May Become Relevant

If money was transferred to a person with no legal entitlement to receive it, restitution principles may become relevant depending on the circumstances.

The existence of further transfers can complicate recovery.

Precautionary Measures Should Be Evaluated

Where an identifiable defendant has assets in Turkey, available interim protective measures should be considered promptly.

The requirements depend on the particular remedy sought.

Criminal Seizure and Civil Attachment Are Different

A measure imposed during a criminal investigation serves criminal-procedure purposes. A civil precautionary attachment or other protective measure has a different legal basis and procedural requirements.

Companies should not assume that one automatically substitutes for the other.

What If the Money Has Already Been Withdrawn?

Recovery becomes more difficult but is not necessarily impossible.

The investigation may examine subsequent transfers, withdrawals and persons who received the proceeds.

The company should still preserve and submit all available tracing information.

Cryptocurrency Transfers Can Complicate the Case

Fraud proceeds may sometimes be transferred through digital-asset platforms.

Where there is evidence of such movement, the information should be included in the criminal complaint rather than based on speculation.

What If Several Turkish Companies Were Victims?

Similar complaints involving the same account, email infrastructure or suspects can become important.

The authorities may identify a broader fraud pattern.

Foreign Companies Can File Criminal Complaints in Turkey

Being incorporated abroad does not by itself prevent a company from reporting alleged criminal conduct affecting it in Turkey.

Corporate representation and authorization documents should be prepared properly.

A Turkish Lawyer Can Coordinate the Process

For foreign companies, local representation can be particularly useful where rapid applications, evidence submissions and follow-up with investigative authorities are required.

Fırat Fesih Kaya Law Office assists foreign corporate victims in coordinating criminal and asset-recovery procedures in Turkey.

Translation of Foreign Documents May Be Required

Contracts, invoices, corporate records and bank correspondence issued abroad may need to be presented in an appropriate form during Turkish proceedings.

Companies should preserve the originals as well as translations.

Do Not Alter Digital Evidence During Translation

Where emails or electronic records are translated, maintain the original electronic material separately.

The translated version should not replace the source evidence.

What If the Turkish Supplier Is Also a Victim?

Both companies may have been targeted by the same fraudster.

For example, criminals may compromise the supplier’s email account and impersonate its employees without the supplier receiving any of the stolen money.

Cooperation between the companies can strengthen the factual reconstruction.

What If the Supplier’s Cybersecurity Failure Enabled the Fraud?

This raises a separate potential civil-liability question.

The answer depends on the contractual relationship, security obligations, negligence, causation and conduct of both parties. Liability should not be assumed solely because one party’s email account was compromised.

Examine Payment Verification Procedures

Determine whether the company had a procedure requiring telephone confirmation when supplier bank details changed.

The absence or circumvention of internal controls may become relevant to the factual and contractual dispute.

Review the Supply Contract

Examine provisions concerning payment instructions, designated bank accounts, notification procedures, cybersecurity obligations, fraud allocation and dispute resolution.

A contract may specify how bank-account changes must be communicated.

A Fake Email May Not Satisfy Contractual Notice Requirements

If the contract requires formal written notification through specified channels before payment details can change, an email sent by a fraudster may not comply with that mechanism.

This can become important in disputes between buyer and supplier over whether the underlying invoice remains unpaid.

The Supplier May Still Demand Payment

A difficult commercial dispute can arise where the buyer sent money to a fraudster while the genuine supplier never received it.

The supplier may argue that the contractual debt remains outstanding.

Who ultimately bears the loss requires analysis of the contract, payment instructions, security failures and surrounding facts.

Do Not Ignore the Underlying Commercial Claim

The criminal fraud case and the contractual payment dispute are separate issues.

The company should evaluate both simultaneously.

Notify Insurers Promptly

Cyber, crime, fidelity or other insurance policies may potentially respond depending on the wording and circumstances.

Notice requirements should be checked immediately.

Preserve Evidence of the Company’s Loss

Keep payment records, investigation expenses, professional fees and other financial documentation relevant to the loss.

Do not rely on reconstructed figures months later.

Avoid Direct Negotiations With Suspected Fraudsters

If a suspect contacts the company promising repayment, preserve the communication and coordinate the response carefully.

Do not surrender evidence or waive rights in exchange for unsupported promises.

Beware of Secondary Recovery Scams

Victims of invoice fraud can later be approached by persons claiming they can recover the money for an advance payment.

Any recovery proposal should be independently verified.

Review Other Supplier Payments Immediately

Once invoice manipulation is discovered, review recent payments to determine whether the same method was used in other transactions.

A fraudster with access to an email account may target multiple invoices.

Notify Internal Finance Teams

Finance personnel should be instructed to verify any pending supplier bank-account changes.

Further payments should not continue under compromised instructions.

Reset Compromised Credentials

Where an email or corporate system compromise is suspected, preserve evidence first and then implement appropriate cybersecurity containment measures.

Technical specialists should coordinate preservation and remediation.

Create a Dual Legal Strategy

A serious invoice-manipulation case generally requires two parallel tracks: criminal investigation and asset tracing, together with civil or enforcement measures aimed at recovering the financial loss.

Focusing exclusively on punishment can allow recoverable assets to disappear.

Immediate Action Plan

A foreign company discovering invoice manipulation involving Turkey should immediately preserve emails and invoices, obtain confirmation from the genuine supplier, contact the sending bank, identify the recipient account, preserve transfer records, prepare a chronological evidence file, file the appropriate criminal complaint, request consideration of urgent asset-preservation measures, investigate possible email compromise, notify insurers, review the underlying contract and evaluate civil recovery proceedings without waiting for the criminal investigation to finish.

Frequently Asked Questions

Can a foreign company file a criminal complaint in Turkey?

Yes. A foreign corporate victim can pursue appropriate Turkish criminal procedures where the circumstances fall within Turkish jurisdiction.

What should be done first after discovering the fraud?

Contact the bank immediately, preserve all evidence and begin the legal process quickly. Delay can reduce the possibility of tracing funds.

Can a Turkish bank account receiving the money be frozen?

Potentially, where the legal requirements for an investigative or judicial measure are satisfied. A private request to the bank should not be confused with a formal judicial freezing measure.

Is the recipient account holder automatically the fraudster?

No. The account may belong to an intermediary. The investigation should identify the wider chain.

Can manipulated emails be used as evidence?

Electronic communications can be important evidence. Original emails, metadata and technical records should be preserved rather than relying only on screenshots.

Can the money be recovered through the criminal investigation?

Asset tracing and protective measures during the investigation may assist recovery, but reimbursement is not automatic. Civil remedies may also be necessary.

What if the supplier’s email was hacked?

The supplier may also be a victim. The contractual allocation of the resulting loss requires a separate analysis.

Can the genuine supplier demand payment again?

Potentially. If it never received the contractual payment, a dispute may arise over whether the buyer’s payment obligation was discharged and which party bears the fraud loss.

Should the foreign company start a civil case before the criminal case ends?

Potentially. There is no universal reason to wait for completion of the criminal proceedings before evaluating urgent civil or enforcement remedies.

What is the most important practical rule?

Move quickly on both evidence and assets. Invoice-manipulation cases can become much harder once bank funds are transferred onward, digital records disappear and the parties begin disputing who was responsible for the compromised payment instructions.

Client-Focused Legal Support for Foreign Companies Facing Invoice Fraud in Turkey

Invoice manipulation can expose foreign companies to fraud losses, compromised bank transfers, forged documents, cyber incidents, criminal proceedings and complex recovery disputes. Fırat Fesih Kaya Law Office assists foreign companies and international investors that become victims of invoice manipulation and payment-diversion fraud involving Turkey. Lawyer Fırat Fesih Kaya provides legal assistance in preparing criminal complaints, preserving banking and digital evidence, pursuing urgent asset-protection measures, coordinating investigations and evaluating civil and enforcement proceedings for recovery of transferred funds.

Phone: +90 312 434 22 22
Mobile: +90 532 769 22 22
Email: info@firatfesihkaya.av.tr
Address: Mevlana Boulevard No:221, Yıldırım Tower, Office No:148, 06520 Balgat, Çankaya, Ankara, Turkey