

Foreign Employee Accused After Receiving Suspicious Money in Turkey: Criminal, Banking and Work Permit Risks
Did a foreign employee in Turkey receive suspicious or fraud-related money? Learn what happens during the criminal investigation, how bank transfers, WhatsApp messages, employer instructions and digital evidence are examined, and whether the case can affect a work permit or immigration status in 2026.
A foreign employee working in Turkey may suddenly discover that money received into their Turkish bank account has been identified as proceeds of an alleged online fraud.
The payment may initially have appeared legitimate. It may have been described as salary, reimbursement, commission, customer payment, repayment of a debt, payment for goods or money that the employee was instructed to receive on behalf of another person.
Later, the employee may receive a police call, discover that the bank account has been restricted or learn that a criminal investigation has been opened.
The situation can quickly become serious because the investigation may involve not only the suspicious transfer but also the employee’s bank account, mobile phone, WhatsApp conversations, employer communications, ATM withdrawals, cryptocurrency transfers and relationship with other suspects.
For a foreign employee, there may also be a separate concern:
Can the criminal investigation affect the employee’s work permit or immigration status in Turkey?
The criminal, employment and immigration consequences must be examined separately. Receiving suspicious money does not automatically establish fraud, and the existence of a criminal investigation does not itself automatically establish that the foreign employee must be removed from Turkey.
Turkish authorities are paying particular attention to third-party bank-account and IBAN use in 2026. Official prosecutorial warnings describe schemes in which individuals are offered commissions or temporary payments for allowing other people to use their accounts, which may subsequently place them in aggravated-fraud or money-laundering investigations.
Consider this example.
A foreign employee works for a company in Turkey.
A colleague says:
“Our company account has a temporary problem. A customer will send 200,000 TRY to your personal account. Transfer it to this other account when it arrives.”
The employee receives the payment and follows the instruction.
Two weeks later, police contact the employee.
The supposed “customer” says the money was obtained from them through fraud.
The financial trail now appears as:
Victim → Foreign employee’s account → Third-party account
The employee may therefore become a suspect.
But that bank statement alone does not answer the critical questions:
Why did the employee receive the money? What did the employee know? Who instructed the employee? Who communicated with the victim? Who ultimately benefited from the funds?
No automatic conclusion should be drawn merely from the fact that suspicious money entered an employee’s account.
The investigation should distinguish between situations such as:
knowingly participating in a fraudulent payment chain
and
receiving money while genuinely believing the transaction was legitimate.
This distinction can determine the entire defense strategy.
Suppose an employee receives 50,000 TRY.
There are several possible explanations.
The employee may believe the money represents:
Alternatively, the employee may knowingly be allowing their account to receive money from unknown people in exchange for a commission.
These situations should not be treated as factually identical.
The prosecution should examine what the employee actually knew and intended.
The investigation may begin after:
The authorities may then obtain banking information and investigate the transaction chain.
A March 2026 prosecution announcement concerning an alleged organized banking-fraud scheme demonstrates the multi-source approach that may be used: prosecutors referred to victim statements, bank-account movements, communications records and digital evidence being evaluated together.
Police may ask:
The employee should avoid guessing.
If a transaction occurred months earlier, bank statements and communications should be reviewed before attempting to reconstruct events from memory.
This can be one of the most important questions.
Suppose the fraud victim receives this WhatsApp message:
“Send the payment to this IBAN.”
The IBAN belongs to the foreign employee.
That establishes a connection to the employee’s account.
But it does not necessarily prove that the employee personally sent the message.
Investigators should determine who controlled the telephone number, messaging account and device used to communicate with the victim.
This can be important evidence.
Investigators should identify:
If another person conducted the entire fraudulent communication, the employee’s individual role must still be established.
Lack of direct victim contact does not automatically end the investigation, because participation or assistance may still be alleged depending on the facts.
But it can be highly relevant to determining what the employee actually did.
This requires careful examination.
Preserve:
Suppose the employer wrote:
“Receive this customer payment into your account and send it to our supplier.”
That message may be highly relevant to what the employee believed.
Employees should also understand the limitation.
An employer’s instruction does not automatically make an illegal transaction lawful.
If the circumstances were obviously suspicious, investigators may still examine the employee’s knowledge.
For example:
“Customers will send money to your personal account. Withdraw everything in cash, give it to me and do not tell the bank.”
That instruction creates a very different evidentiary situation from an apparently ordinary business reimbursement.
The complete context matters.
Company communication systems may contain crucial evidence.
Preserve relevant:
Do not rely solely on the assumption that the employer will preserve everything.
If important employer communications disappear, other evidence may still exist.
Potential sources include:
The employee should preserve existing copies rather than altering them.
Investigators should determine who actually controlled the account.
Questions may include:
Registered ownership and actual operational control can be different factual questions.
This can create substantially greater criminal exposure.
Official prosecutorial warnings published in 2026 describe arrangements where individuals are told that their accounts will be used temporarily and are offered commissions. Authorities warn that such arrangements frequently appear in aggravated-fraud and laundering investigations.
Investigators may ask:
Repeated commission-based transactions can significantly alter the evidentiary picture.
Transaction patterns matter.
Suppose Employee A receives one unexpected transfer and immediately contacts the bank.
Employee B receives payments from 40 unrelated people over six months, keeps 5% and transfers the remainder to cryptocurrency wallets.
These situations are not factually equivalent.
Investigators may examine:
This is another possible scenario.
A foreigner may already have employment but accept an online side job such as:
“Payment Processing Assistant.”
The supposed company tells the employee:
“Customers will transfer funds to your Turkish account. Forward them and keep 5%.”
Official 2026 prosecutorial warnings specifically identify job seekers and people offered easy income as targets of account-use schemes.
Preserve:
Potentially, depending on the alleged method and evidence.
Technology- and banking-related fraud schemes may fall within the aggravated-fraud framework where the statutory conditions are established.
A March 18, 2026 prosecution announcement described an alleged scheme involving persons impersonating bank employees, obtaining verification codes and transferring victims’ money through different accounts. The prosecution stated that banking movements, communications records and digital evidence were evaluated together before an indictment was prepared under the aggravated-fraud provision cited in that case.
The foreign employee’s individual participation still has to be determined from the evidence.
Potentially.
A person does not necessarily have to make the fraudulent statement personally for participation questions to arise.
The investigation may examine whether the employee knowingly facilitated another person’s fraud.
Relevant evidence can include:
The exact criminal characterization depends on the proven facts.
Depending on the facts, additional financial-crime issues may arise.
Risk may increase where suspicious funds are:
Official 2026 prosecutorial warnings expressly connect third-party bank-account use with both aggravated-fraud and laundering risks.
A separate offence should not, however, be assumed merely because money moved through an account. Its statutory elements and the employee’s knowledge must be evaluated.
Preserve the exact chronology.
For example:
10:12 — 120,000 TRY received
10:14 — Employer sends transfer instruction
10:17 — 120,000 TRY transferred to supplier account
This timeline can be important.
The instruction explaining why the employee made the transfer should also be preserved.
Investigators may ask:
ATM CCTV may become important.
If the employee claims that another person made the withdrawal, footage may help establish who physically used the card.
Investigators may examine:
Preserve the instructions that explain why the cryptocurrency transaction was performed.
Unauthorized access presents a different factual scenario.
Preserve:
Contact the bank through an official channel promptly.
A hacking claim supported by contemporaneous technical records is stronger than an unsupported assertion made only after police questioning begins.
Potentially.
If the account becomes restricted, determine:
A frozen bank account is not itself proof of guilt.
A phone can become important evidence because it may contain:
The legal authority, scope and technical method used for any forensic examination should be evaluated under the criminal-procedure rules applicable to the case.
Do not delete relevant information after learning about the investigation.
Potentially relevant company devices may also become part of an investigation.
But company ownership of a device does not automatically establish which employee performed a particular action.
Relevant questions may include:
IP-related records may help investigate banking sessions, online accounts or fraudulent communications.
However:
IP address ≠ automatic human identification.
Investigators may need to consider shared networks, corporate internet connections, VPNs, dynamic allocation, CGNAT, timestamps and device information.
This can be particularly important in workplaces where many employees share the same external internet connection.
CCTV may show:
But presence at work does not itself prove fraudulent intent.
Footage should be interpreted together with the complete evidentiary record.
A criminal investigation and employment termination are separate legal issues.
An employer may react to allegations concerning workplace conduct, but the legality of any dismissal depends on the employment circumstances, contractual position, applicable labor-law rules and stated reason for termination.
A criminal accusation does not automatically resolve every employment-law issue.
The employee should preserve:
This requires a separate analysis.
A valid work permit generally functions as a residence permit under Article 27 of Law No. 6458. The Presidency of Migration Management confirms that a work permit or work-permit exemption confirmation document replaces a residence permit for this purpose.
Therefore, loss or termination of employment can have immigration consequences independent of the criminal case.
No automatic cancellation should be assumed merely because the foreign employee becomes a suspect.
The work-permit system has its own administrative procedures.
The Ministry of Labour’s current guidance explains that employers and certain foreign permit holders have notification obligations concerning commencement and termination of employment and circumstances that may require cancellation of a work permit.
Accordingly, three different events should not be confused:
criminal investigation
employment termination
work-permit cancellation or termination
They may interact, but they are legally distinct.
This can create a practical immigration issue.
The employer has notification obligations concerning termination of work connected to a foreign employee’s permit, and work-permit termination procedures are processed through the official permit system.
The foreign employee should therefore determine immediately:
Do not assume that the criminal investigation itself answers these questions.
The Ministry of Labour’s current guidance states that decisions concerning rejection, cancellation or termination of work permits can be challenged administratively within 30 days from notification, and administrative judicial review may follow if the objection is rejected.
This deadline is different from deadlines that may apply to criminal or removal proceedings.
Foreign employees should therefore identify exactly which decision has been served.
A criminal investigation does not itself equal a removal decision.
Removal is governed separately by Law No. 6458. Current Migration Management guidance explains that removal decisions are issued by governorates where a statutory ground under Article 54 exists, subject to the statutory framework and protections.
Article 54 includes, among other grounds, foreigners considered to pose a threat to public order or public security.
Whether such a ground legally applies in an individual fraud case requires a separate administrative assessment. The mere fact that police are investigating an employee should not be confused with the existence of an actual removal decision.
For a foreign employee, these stages must be kept separate:
Suspicious transfer → Criminal investigation → Possible prosecution → Possible criminal judgment
and, separately:
Immigration assessment → Possible removal decision → Administrative/judicial challenge
A person may be under criminal investigation without having an immigration removal decision.
Similarly:
Work permit termination ≠ automatic criminal guilt.
Criminal investigation ≠ automatic work permit cancellation.
Work permit cancellation ≠ automatically the same legal act as removal.
The foreign employee should obtain each actual administrative decision rather than relying on assumptions or verbal information.
The employee should promptly examine both employment and immigration consequences.
Preserve:
If the employer’s own instructions caused the disputed financial transaction, those records may also be important to the criminal defense.
This can substantially change the case.
A foreign employee may have been used by:
The employee should preserve evidence showing the hierarchy and instructions.
Do not alter corporate records or secretly fabricate evidence.
An employer may tell the employee:
“Just say the money was yours.”
or:
“Delete our messages.”
or:
“Tell the police you acted alone.”
These instructions can create serious risks.
Do not destroy evidence or give a knowingly false account merely to protect another person.
A foreign employee may communicate with an employer or colleague in English, Arabic, Russian, Persian or another language.
Translation can materially affect:
The original-language communication should be preserved.
Everyday Turkish proficiency does not necessarily mean that a foreign employee can adequately understand a detailed criminal interview involving banking, digital evidence and legal terminology.
If necessary, interpretation safeguards should be used.
The employee should not sign a statement whose meaning they do not fully understand.
Potentially important evidence includes:
The strongest defense often comes from reconstructing the complete transaction rather than relying on a short verbal denial.
For every suspicious payment, identify:
Who sent it?
When?
Why did you believe it was being sent?
Who told you about it?
What happened next?
Where did the money go?
Did you receive any benefit?
This can expose the difference between account ownership and knowing criminal participation.
Do not:
Some of the material that appears embarrassing may actually help establish what happened.
If an employer, colleague or friend is also under investigation, do not create a common false story.
Preserve the existing evidence.
Individual criminal responsibility should be determined from the actual facts.
A foreign employee connected to suspicious money should promptly:
The defense should investigate:
Bank-account misuse remains an active enforcement concern in Turkey in 2026. Prosecutorial authorities have issued specific warnings concerning individuals who allow bank accounts or IBAN numbers to be used by others in return for commissions or supposed easy income.
Recent 2026 fraud investigations also demonstrate that authorities may combine bank movements, victim statements, communications records and digital evidence when assessing the individual roles of suspects.
For foreign employees, however, the legal analysis should proceed through separate tracks:
Criminal: Does lawful and reliable evidence establish knowing participation in fraud or another alleged offence?
Employment: Has the employment relationship been lawfully terminated, and what employment consequences follow?
Work permit: Has the competent authority actually taken action concerning the employee’s work authorization?
Immigration: Has a separate removal, entry-ban or other immigration decision actually been issued?
Current official guidance confirms that a work permit generally replaces a residence permit for its validity period, while removal decisions are separately governed by the statutory immigration framework.
Therefore:
Suspicious payment ≠ automatic fraud conviction ≠ automatic dismissal ≠ automatic work-permit cancellation ≠ automatic deportation.
Each issue requires its own factual and legal assessment.
No. The investigation should examine why the money arrived, what you knew, who controlled the account, what happened to the money and whether evidence establishes knowing criminal participation.
Preserve the complete instruction, including emails, messages, invoices and accounting documents. Employer instructions can be important evidence concerning what you believed, although an employer’s instruction does not automatically make unlawful conduct legal.
That can be significant. Investigators should determine who actually communicated with and deceived the victim. Lack of direct contact does not automatically resolve every participation allegation, but it can materially affect the analysis.
Preserve the transfer instruction and complete transaction history. Investigators should examine who directed the transfer and what you understood its purpose to be.
Employment consequences are legally separate from criminal guilt. The validity of any termination depends on the employment facts, applicable labor-law rules and the employer’s stated grounds.
No automatic cancellation should be assumed solely because you become a suspect. Work-permit procedures are administratively separate, and the actual status of the permit should be checked. Official guidance provides specific procedures concerning termination and cancellation.
Current Ministry guidance states that an objection to decisions concerning rejection, cancellation or termination of a work permit may be filed within 30 days from notification, with administrative judicial review available after rejection of the objection.
A criminal accusation is not itself the same thing as a removal decision. Removal requires a separate decision under the statutory immigration framework. Current official guidance identifies Article 54 grounds and confirms that governorates issue removal decisions.
No. Those communications may be among the most important pieces of evidence showing why you received the money and what you knew at the time.
Preserve your banking and digital evidence, reconstruct the transaction, identify who instructed you, avoid deleting or altering information, determine the status of the criminal investigation and separately verify your employment, work-permit and immigration status.
A suspicious payment can quickly become a complex legal problem for a foreign employee.
The investigation may involve aggravated fraud allegations, bank-account restrictions, employer instructions, WhatsApp communications, seized phones, ATM CCTV, IP records, cryptocurrency transactions and questions concerning who actually controlled and benefited from the funds.
At the same time, termination of employment can create separate work-permit and immigration concerns.
The central criminal questions should remain:
Why did the money enter the employee’s account? Who instructed the employee? Who deceived the victim? Who controlled the account? Where did the money go? What did the employee know?
Fırat Fesih Kaya Law Office provides criminal, employment and foreigners-law assistance to foreign employees, executives and professionals whose Turkish bank accounts become connected to suspicious transfers or online fraud investigations.
Lawyer Fırat Fesih Kaya assists foreign clients with aggravated-fraud investigations, bank-account and IBAN allegations, police and prosecutor statements, frozen accounts, employer-related payment disputes, seized phones, digital evidence, work-permit issues and separate immigration proceedings.
Early legal assistance can be important because banking records, workplace communications, ATM CCTV and digital evidence may need to be preserved promptly, while separate administrative decisions concerning work authorization or immigration status may carry their own challenge periods.
Phone: +90 312 434 22 22
Mobile: +90 532 769 22 22
Email: info@firatfesihkaya.av.tr
Address: Mevlana Boulevard No:221, Yıldırım Tower No:148, 06520 Balgat, Çankaya, Ankara, Turkey
This publication is provided for general informational purposes and does not constitute legal advice. Criminal, employment, work-permit and immigration consequences depend on the individual facts, the employee’s knowledge and intent, the evidence concerning the transactions and any separate administrative decisions issued by competent authorities.