Foreign Account Holder Says Their Mobile Banking Was Hacked: How Can This Be Proven in a Turkish Criminal Case? (2026 Updated Guide)

A foreign account holder says unauthorized transfers were made after their mobile banking was hacked. Learn which digital, banking, IP, device and telecom evidence can be important in a Turkish criminal investigation.

A foreign national may suddenly become involved in a Turkish criminal investigation because money connected with fraud, unauthorized transfers or another suspected offense passed through their bank account. The account holder may respond that they did not perform the transactions and that their mobile banking account, phone, SIM card or credentials were compromised. In such a case, merely telling the police or prosecutor “my account was hacked” may not be enough. The defense should seek objective digital and banking evidence capable of establishing who accessed the account, from which device, through which connection, how authentication occurred and what happened to the money afterward.

Why Can the Account Holder Become a Criminal Suspect?

Investigators frequently begin with the financial trail. If money obtained from an alleged fraud is transferred into a particular account, the account holder can become relevant to the investigation even when another person actually controlled the transaction.

The important legal question is not simply whose name appears on the bank account. Investigators should also examine whether the account holder knowingly participated in the alleged criminal activity.

Being the Account Owner Does Not Automatically Prove the Transaction Was Personally Made

A bank account is registered to an identifiable customer, but electronic banking credentials can potentially be compromised.

Account ownership and actual digital control at the time of a disputed transaction are therefore separate factual questions.

The Hacking Claim Should Be Supported With Objective Evidence

The defense should move beyond a general denial and reconstruct the incident technically.

Potentially important evidence may include login records, device information, IP data, transaction authentication records, telecom records, suspicious password changes, SIM-related events, malware evidence and communications with the bank.

Obtain the Bank’s Login Records

One of the first questions should be: When and how was the mobile banking account accessed?

Relevant bank records may help establish login times and other technical information retained by the bank concerning the relevant session.

These records should be requested and preserved before ordinary retention practices make historical reconstruction more difficult.

IP Address Evidence Can Be Important

Where technically available, IP information associated with disputed access can help investigators analyze the connection used during the transaction.

However, an IP address should not automatically be treated as conclusive identification of an individual. Dynamic addresses, shared networks, VPN services and other technical circumstances can complicate attribution.

Device Information Can Be Even More Important

Banks may retain information capable of distinguishing devices or sessions used to access online banking.

If the account holder normally used one device but the disputed transaction originated from a previously unknown device, that difference may materially support the defense.

Compare Normal Banking Behavior With the Disputed Session

A useful forensic approach is to compare historical legitimate activity with the allegedly unauthorized transactions.

Investigators can examine whether there was a sudden change in device, connection pattern, transaction size, beneficiary, transaction time or other relevant behavior.

A dramatic departure from the account holder’s established pattern may support further investigation into unauthorized access.

Authentication Records Should Be Examined

How was the transaction approved?

Depending on the banking system and transaction, authentication may involve passwords, mobile approval, one-time codes or other security mechanisms.

The defense should determine exactly which authentication process was used rather than assuming that successful authentication proves the account holder personally approved the transfer.

SMS Records May Become Relevant

If a verification code was supposedly sent to the account holder’s telephone number, determine whether the message was actually delivered and what was happening with the relevant mobile line at that time.

The surrounding telecom evidence may become important where SIM compromise is alleged.

Investigate Possible SIM-Swap Activity

If the account holder unexpectedly lost mobile service around the time of the transactions, this should be documented.

Relevant questions can include whether a replacement SIM was issued, whether there was an unusual operator transaction and whether the account holder reported loss of service.

Preserve the Phone

A person claiming unauthorized mobile-banking access should be extremely careful about resetting, replacing or disposing of the relevant phone.

The device may contain evidence concerning banking applications, malicious software, suspicious messages, browser activity, downloads or other events surrounding the incident.

Digital Forensic Examination Can Be Critical

Where appropriate, forensic examination may help determine whether the device contains evidence of malware, malicious applications, remote-access software or other compromise.

The examination should focus on technically relevant evidence rather than merely producing a general statement that the phone appears normal.

Remote-Access Applications Should Be Investigated

Some fraud schemes involve persuading a victim to install software that allows another person to control or observe a device.

If such software was installed near the time of the unauthorized banking activity, installation and usage records may become important.

Phishing Messages Should Be Preserved

Fraudulent SMS messages, emails, messaging-app communications and fake banking pages may explain how credentials were compromised.

Do not delete suspicious messages simply because they are embarrassing or appear irrelevant.

Screenshots Alone May Not Be Enough

Screenshots can help identify suspicious communications, but original digital records and device-level evidence may be more valuable.

Where authenticity becomes disputed, investigators may need more than an image of a message displayed on a screen.

Check Whether the Password Was Changed

A password change shortly before disputed transfers may be significant.

The defense should determine when the password changed, how the change was authenticated and whether the account holder initiated it.

Check Whether a New Device Was Registered

If a new mobile device was added shortly before the transaction, this can become a major investigative issue.

The bank should be asked to preserve information relating to device registration and authentication where available.

Beneficiary Accounts Should Be Investigated

The investigation should not stop at the hacked account.

Where did the money go next?

If funds were immediately transferred to unrelated third parties, withdrawn elsewhere or moved through multiple accounts, the subsequent financial trail may help identify who actually controlled the criminal proceeds.

Follow the Money Beyond the Foreign Account Holder

A foreign suspect should request investigation of downstream accounts rather than allowing the case to focus exclusively on the first account that received money.

Beneficiary ownership, withdrawal records, ATM information and subsequent transfers can become highly relevant.

ATM Camera Evidence May Be Important

If disputed money was withdrawn in cash, investigators should determine where and when the withdrawal occurred.

Available ATM or surrounding surveillance evidence may potentially help establish whether the account holder personally withdrew the funds.

Because video evidence may not be retained indefinitely, preservation requests should be considered promptly.

Was the Account Holder in the Same Place?

Location-related evidence can sometimes support or contradict the hacking defense.

For example, if a disputed physical transaction occurred in one location while reliable evidence places the account holder elsewhere, that inconsistency may be significant.

The reliability and lawfulness of each type of location evidence should nevertheless be assessed carefully.

International Travel Records Can Matter

For a foreign national, passport and travel records may provide useful context.

If the disputed activity occurred in Turkey while the account holder was demonstrably abroad, this may support further investigation into who controlled the account.

It does not automatically resolve remote electronic access, but it can be important evidence.

Employment and Hotel Records May Also Help

Depending on the facts, workplace access records, hotel records, flight records or other contemporaneous documents may help reconstruct the person’s location and activities.

The strongest defense generally combines digital evidence with independent real-world evidence.

Reported Hacking Before the Criminal Investigation Can Be Powerful Evidence

If the account holder contacted the bank immediately after noticing unauthorized access, that contemporaneous complaint can be significant.

Preserve call records, complaint numbers, emails, branch applications and any fraud-reporting documentation.

A Complaint Made Only After Becoming a Suspect Will Be Scrutinized

This does not mean a later hacking allegation is necessarily false.

However, investigators may ask why the account holder did not report suspicious activity earlier. The explanation should be accurate and supported where possible.

Bank Notifications Should Be Preserved

Keep transaction alerts, security warnings, login notifications and communications concerning blocked or suspicious transactions.

Their timing may help reconstruct the sequence of events.

Account Freezing Does Not Establish Criminal Guilt

A bank account may be restricted during an investigation or compliance review, but the existence of a freeze should not itself be treated as proof that the account holder knowingly participated in fraud.

Criminal responsibility requires examination of the individual’s conduct and mental element under the alleged offense.

The Prosecutor Should Investigate Evidence Supporting Both Sides

The defense can request collection of evidence capable of demonstrating unauthorized access rather than merely responding to accusations.

A properly structured petition may identify specific banking, telecom, device and financial evidence that should be obtained.

Timing Is Extremely Important

Some digital records may become difficult to obtain as time passes.

A defense lawyer should therefore identify potentially relevant records early in the investigation rather than waiting until trial.

The Foreign Suspect Should Not Guess During Their Statement

If the person does not know how the compromise occurred, they should not invent a technical explanation.

Statements such as “someone definitely cloned my phone” can damage credibility if forensic evidence later establishes something different.

It is better to distinguish clearly between what the person personally knows and what requires technical investigation.

Interpreter Rights Are Important

A foreign suspect who cannot adequately understand Turkish should ensure that they understand the questions and their recorded answers.

A technical mobile-banking investigation can involve terminology that is particularly easy to misunderstand.

Do Not Sign an Incorrect Police Statement

Before signing, the foreign national should ensure that the statement accurately records the hacking allegation, disputed transactions and important factual details.

Translation errors or oversimplification can create serious problems later.

Can a Statement Given Without a Lawyer Be Challenged?

The legal effect of a statement depends on the circumstances under which it was obtained and the applicable criminal-procedure rules.

If the statement was mistranslated, incomplete, improperly obtained or misunderstood, those issues should be raised promptly and supported with available evidence.

Expert Examination May Be Necessary

Complex digital evidence often requires specialist analysis.

Questions may include whether the account was accessed from another device, whether malware existed, whether authentication records are consistent with the account holder’s account and whether technical evidence supports unauthorized access.

Bank Records and Phone Forensics Should Be Compared

The strongest analysis often comes from connecting multiple evidence sources.

For example, bank records may identify a new device at a particular time while phone examination shows the account holder’s normal device was not being used for the disputed banking session.

No single data point should automatically be treated as decisive.

What If the Account Holder Shared Their Banking Credentials?

This can materially change the legal analysis.

Investigators may examine why credentials were shared, with whom, what the account holder knew and whether the person anticipated or accepted that the account would be used for suspicious transactions.

The defense must address the actual facts rather than presenting every case as hacking.

What If the Account Was Intentionally Given to Another Person?

Allowing another person to use an account can create substantially different criminal issues from genuine unauthorized hacking.

The prosecutor may investigate knowledge, intent, financial benefit and the account holder’s relationship with the person who controlled the account.

Receiving a Commission Can Be Significant

If the account holder received money for allowing use of the account, investigators may treat that fact as important evidence when assessing whether the person knowingly participated.

The source and purpose of every payment should therefore be explained accurately.

Absence of Financial Benefit Can Support the Defense

If the account holder received no commission, retained none of the disputed funds and had no relationship with the downstream beneficiaries, these facts may support the overall defense.

They are not automatically conclusive, but they can be important when combined with technical evidence.

Communications With the Alleged Fraudsters Matter

Police may examine WhatsApp, Telegram, SMS, email or other communications.

Messages showing that the account holder was themselves deceived can support the defense, while messages showing deliberate coordination can have the opposite effect.

Deleted Messages May Still Become Relevant

Deleting communications after learning of an investigation can create additional evidentiary concerns.

Relevant material should be preserved and reviewed with counsel.

Multiple Victims Require Careful Transaction Analysis

If several complainants transferred money to the same account, prosecutors may examine whether the account functioned as part of a systematic fraud operation.

The defense should create a transaction-by-transaction chronology rather than respond with a single general denial.

Create a Precise Timeline

The timeline should include legitimate account use, suspicious communications, loss of mobile service, password changes, new-device registration, disputed logins, transfers, bank notifications, complaints to the bank and subsequent police contact.

A detailed chronology can reveal inconsistencies that are otherwise invisible.

Evidence Preservation Checklist

The defense should consider preserving the relevant phone, bank statements, security notifications, suspicious messages, telecom records, bank complaint records, travel documentation and information concerning downstream beneficiaries.

The exact evidence required depends on the case.

Can the Bank Be Asked to Preserve Technical Logs?

The defense can seek appropriate procedural steps for relevant bank records to be obtained and preserved during the criminal investigation.

The request should identify the relevant period and types of information as precisely as possible.

Can Telecom Records Be Requested?

Where legally relevant, the investigation may seek appropriate telecommunications information capable of clarifying events surrounding the alleged compromise.

The defense should explain why the requested information matters to the specific disputed transactions.

Can the Case End Without Prosecution?

Potentially. If the investigation does not produce sufficient suspicion to justify prosecution, the prosecutor may conclude the investigation without filing a criminal case.

Whether that occurs depends on the complete evidence.

What If Criminal Proceedings Have Already Started?

The defense can still request examination of relevant banking and digital evidence during the court proceedings where procedurally available.

The fact that an indictment has been issued does not mean the hacking allegation should be abandoned.

Can a Conviction Be Based Only on the Account Being in the Foreigner’s Name?

Criminal responsibility should not be reduced mechanically to account ownership. The court must evaluate the evidence concerning the alleged offense and the defendant’s individual conduct and intent.

Where unauthorized access is genuinely alleged, digital attribution can become central.

Immediate Defense Strategy

A foreign account holder who says their mobile banking was hacked should immediately preserve the phone and suspicious communications, obtain bank statements and security notifications, identify every disputed transaction, document any complaint previously made to the bank, request preservation and examination of relevant banking technical records, investigate SIM or device changes, trace downstream transfers and withdrawals, preserve travel or location evidence and avoid speculative statements about technical events that have not yet been established.

Frequently Asked Questions

Is saying “my bank account was hacked” enough to avoid criminal liability?

No. The allegation should be supported with objective evidence wherever possible.

Can bank login records show that someone else used the account?

They may provide important technical information concerning sessions, devices or connections, depending on the records available.

Can an IP address prove who made the transfer?

Not necessarily by itself. IP evidence should be interpreted together with device, banking, telecom and other evidence.

What if a new device was registered before the fraudulent transfers?

That can be highly relevant and should be investigated together with the authentication process used for registration.

Can SIM-swap evidence support the defense?

Potentially. Telecom and banking records surrounding a suspected SIM compromise can be important.

Should the foreigner give their phone to investigators?

The legal and strategic implications depend on the circumstances and procedural basis. The device should in any event be preserved rather than reset or destroyed.

What if the money was immediately transferred to another account?

The downstream financial trail should be investigated. It may help identify who ultimately controlled or benefited from the funds.

What if the foreign account holder was outside Turkey when the transfers occurred?

Travel evidence can be relevant, particularly when combined with technical records, although remote electronic transactions require separate analysis.

What if the account holder voluntarily gave their password to someone else?

The case becomes more complicated. Investigators will examine why access was given, what the account holder knew and whether there was intentional participation.

What is the strongest defense in a genuine hacking case?

A coordinated evidentiary reconstruction combining bank login and authentication records, device evidence, telecom information, financial tracing, contemporaneous complaints and independent evidence of the account holder’s actual conduct is substantially stronger than a simple verbal claim that the account was hacked.

Client-Focused Legal Support for Foreign Nationals in Banking and Cybercrime Investigations

A foreign national accused because their bank account was connected with suspected fraud may face police questioning, account restrictions, digital-device examination, financial tracing and potentially serious criminal proceedings. Fırat Fesih Kaya Law Office assists foreign nationals involved in Turkish criminal investigations concerning unauthorized banking transactions, account misuse, online fraud and disputed digital evidence. Lawyer Fırat Fesih Kaya provides legal assistance in protecting the suspect’s procedural rights, requesting banking and digital evidence, challenging incorrect attribution of electronic transactions and preparing a defense based on the complete financial and forensic record.

Phone:
+90 312 434 22 22

Mobile:
+90 532 769 22 22

Email:
info@firatfesihkaya.av.tr

Address:
Mevlana Boulevard No:221, Yıldırım Tower, Office No:148, 06520 Balgat, Çankaya, Ankara, Turkey