Business Email Compromise Causes Payment to a Fraudulent Bank Account in Turkey: Can the Money Be Recovered? 2026 Updated Guide

A company sends money to a fraudulent Turkish bank account after a business email compromise attack. Learn about emergency bank action, criminal complaints, account freezes, evidence preservation and recovery options in Turkey.

Business Email Compromise (BEC) is one of the most financially damaging forms of commercial fraud affecting international companies. A foreign buyer may receive what appears to be a genuine email from its Turkish supplier stating that the supplier’s bank account has changed. The invoice, employee name, email history and payment instructions may appear legitimate. The company transfers the money, only to discover later that the email account was compromised or impersonated and the funds were sent to a fraudulent bank account in Turkey.

When this occurs, speed is often the most important factor in recovering the money. The victim company should immediately contact the sending bank, notify the receiving bank where possible, preserve digital evidence and coordinate a criminal complaint in Turkey. If funds remain in the recipient account or can still be traced through subsequent transfers, legal measures may potentially prevent further movement and support recovery.

What Is Business Email Compromise?

Business Email Compromise is a fraud technique in which criminals manipulate legitimate commercial communications to redirect payments.

The fraud may involve hacking an email account, creating a nearly identical domain, impersonating a supplier employee, intercepting an invoice or changing bank details contained in genuine correspondence.

The objective is usually simple: convince the victim to transfer a legitimate commercial payment to an account controlled directly or indirectly by the fraudsters.

How Does Invoice Fraud Usually Occur?

A foreign company may have an established commercial relationship with a supplier. Shortly before payment, the buyer receives an email stating that the supplier has changed its banking information.

The message may contain the correct invoice number, contract information and employee signatures because the criminals have obtained access to previous correspondence.

The buyer then sends the payment to the substituted account.

Can Money Sent to a Fraudulent Turkish Bank Account Be Recovered?

Potentially, yes, but recovery is highly dependent on timing and the movement of the funds.

If the money remains in the first recipient account, the chances of preserving it may be significantly better than where the funds have already been transferred through multiple accounts, converted into other assets or moved abroad.

There is therefore no benefit in waiting for an internal corporate investigation to finish before initiating emergency measures.

Contact the Sending Bank Immediately

The victim company should notify its own bank as soon as the fraud is discovered.

Provide the transfer date, amount, currency, beneficiary name, recipient bank, account information and transaction reference.

The company should ask the bank to initiate the available fraud-reporting, recall and interbank communication procedures immediately.

A SWIFT Recall Does Not Guarantee Recovery

For international transfers, the sending bank may attempt to recall the payment or communicate urgently with the receiving bank.

However, a recall request should not be confused with a court-ordered or prosecutorial freeze. If the money has already been withdrawn or transferred, an ordinary banking recall may be unsuccessful.

Banking action and Turkish legal action should therefore proceed simultaneously.

Identify the Turkish Receiving Bank

Determine exactly which Turkish bank received the fraudulent transfer.

Preserve the IBAN, account holder information appearing on the payment instruction, SWIFT records and beneficiary details available to the victim.

This information will be important for the criminal complaint and tracing process.

Notify the Receiving Bank About the Fraud

Where procedurally possible, the receiving bank should be alerted urgently that the transfer is disputed as fraudulent.

The victim should provide sufficient transaction information for the bank to identify the payment.

The bank’s ability to restrict an account independently will depend on the applicable legal and compliance framework, so the victim should not rely solely on informal bank correspondence.

File a Criminal Complaint in Turkey Quickly

Where the fraudulent funds entered a Turkish bank account, a criminal complaint in Turkey can become central to the recovery strategy.

The complaint should explain the commercial relationship, fraudulent communication, genuine payment obligation, manipulated bank details, transfer and discovery of the fraud.

Which Crimes May Be Relevant?

The legal characterization depends on the facts. Conduct involving deceptive electronic communications and banking systems may potentially raise fraud and other criminal-law issues.

Unauthorized access to email accounts or information systems may also create separate cybercrime questions.

The precise offences should be determined from the evidence rather than assumed from the label “BEC.”

Request Urgent Preservation of the Funds

One of the principal objectives of the criminal complaint is to prevent dissipation of traceable proceeds where the legal conditions for protective measures are satisfied.

The application should clearly explain why urgency exists and identify the relevant account and transaction as precisely as possible.

What If the Money Has Already Left the First Account?

The investigation should not necessarily stop there.

Fraud proceeds may move from the first recipient account to second- and third-level accounts. Bank transaction records can become essential in reconstructing this chain.

The recovery strategy should therefore focus on the flow of funds, not merely the account originally supplied to the victim.

Money Mule Accounts Are Common

The Turkish recipient account may belong to a person who did not personally communicate with the foreign victim.

Fraud networks may use individuals or companies as intermediary account holders.

The role and knowledge of each account holder must therefore be investigated separately.

Can the Account Holder Claim They Were Unaware?

They may make such a defense, but its legal effect depends on the evidence.

Investigators may examine why the funds entered the account, whether they were immediately withdrawn, whether commissions were received, who controlled online banking and whether similar transactions occurred previously.

Preserve the Fraudulent Emails

Do not delete, edit or simply print the emails and discard the electronic originals.

Preserve the original messages, attachments and available technical metadata. The email chain can help determine whether the fraud involved an actual compromised mailbox or a lookalike address.

Email Headers Can Be Important Evidence

Technical header information may assist in identifying the path of a fraudulent message and distinguishing it from genuine correspondence.

The company’s IT team should preserve original electronic evidence before mailbox settings or security systems alter relevant data.

Preserve the Genuine Email History

The investigation should also receive the authentic correspondence preceding the fraud.

This can demonstrate how the criminal message was inserted into an existing commercial relationship and why the payment instruction appeared credible.

Check for a Lookalike Domain

BEC attacks frequently use email addresses that differ from the legitimate address by only one character.

Compare the fraudulent sender’s complete address and domain with the supplier’s genuine domain.

Screenshots alone may make subtle differences difficult to detect.

Determine Whether the Buyer or Supplier Was Compromised

The compromised account may belong to the buyer, supplier or another participant in the transaction.

Both companies should conduct technical investigations rather than immediately accusing the other party.

Preserve Server and Login Records

Where available, preserve login history, IP information, forwarding rules, mailbox access records and security alerts.

Fraudsters sometimes create hidden forwarding rules allowing them to monitor genuine correspondence before changing payment instructions.

Do Not Reset Everything Before Preserving Evidence

Security measures are important, but evidence should be preserved where possible before systems are extensively altered.

The IT response and legal evidence-preservation process should therefore be coordinated.

Secure the Email Environment Immediately

After preservation, compromised passwords should be changed, active sessions reviewed and appropriate multi-factor authentication and security controls implemented.

The company should also investigate whether other invoices or customers were targeted.

Preserve the Invoice

Keep both the genuine invoice and any altered version used in the fraud.

Compare bank details, company information, formatting, payment terms and metadata where available.

Preserve the Payment Records

Collect the payment order, SWIFT confirmation, bank statement and internal payment authorization documents.

The evidence should establish precisely when the payment was instructed and completed.

Create a Minute-by-Minute Timeline

For substantial losses, prepare a chronology identifying when the fraudulent email arrived, when employees reviewed it, when payment was approved, when the transfer was made, when the genuine supplier contacted the company and when the fraud was discovered.

This timeline can be extremely useful when requesting urgent measures.

Foreign Companies Can Pursue Criminal Remedies in Turkey

A company located outside Turkey can still have a substantial interest in Turkish criminal proceedings where the fraudulent funds were transferred into the Turkish banking system.

Representation in Turkey can help coordinate the complaint, evidence submissions and follow-up applications.

Does the Foreign Company Need to Travel to Turkey?

Not necessarily in every case.

Depending on the procedural circumstances, a Turkish lawyer may be able to undertake substantial procedural steps through an appropriate power of attorney.

The exact requirements should be assessed for the particular investigation.

Translation of Foreign Evidence May Be Necessary

Contracts, invoices, foreign bank documents and email records may need to be presented in a form suitable for use before Turkish authorities.

Translations should preserve technical and financial accuracy.

Can the Bank Be Held Liable?

Bank liability is a separate question from criminal recovery and cannot be assumed merely because a fraudulent account was maintained at that bank.

The facts should be examined, including transaction monitoring, warnings, account activity, applicable banking obligations and the circumstances surrounding the transfer.

Can the Company’s Own Bank Be Liable?

Again, liability is fact-specific.

If the payer itself authorized the transfer to the fraudulent account, recovery against the sending bank may present different issues from an unauthorized transaction.

The exact payment mechanism and bank-customer relationship should be reviewed.

Can the Turkish Supplier Still Demand Payment?

This can become a major commercial dispute.

If the genuine supplier never received the contractual price, it may argue that the buyer’s payment obligation remains outstanding.

The answer can depend on the contract, payment instructions, how the fraudulent change was communicated and which party’s systems or conduct contributed to the loss.

Which Party’s Email Account Was Compromised Can Matter

Suppose the Turkish supplier’s genuine mailbox was hacked and the fraudster sent altered payment instructions from the authentic account.

That factual scenario can raise different contractual issues from a case where the buyer received an obvious message from an unrelated fake domain.

The cybersecurity evidence can therefore affect both criminal recovery and the commercial dispute.

Review the Contract’s Payment Clause

Determine exactly where payment was required to be made.

The contract may identify a specific bank account or require written procedures for changes in payment details.

Those provisions can become highly significant.

Review Any Bank-Change Verification Procedure

Many international companies require changes to supplier bank details to be confirmed through a second communication channel.

Determine whether such a procedure existed and whether it was followed.

Do Not Admit Liability Prematurely

The buyer and supplier should cooperate to recover the stolen money, but neither party should make unnecessary admissions about responsibility before the technical and contractual facts have been investigated.

Can a Civil Claim Be Filed Against the Recipient?

Potentially. Depending on the facts and identity of the recipient, civil recovery mechanisms may be considered in addition to criminal proceedings.

The appropriate defendant and legal basis should be determined from the evidence.

Criminal and Civil Strategies Can Proceed Together

The criminal investigation may assist in identifying account holders and tracing funds, while private-law remedies may address recovery and liability.

The two strategies should be coordinated to avoid inconsistent positions.

What If the Funds Were Converted Into Cryptocurrency?

The investigation becomes more complicated but should not automatically be abandoned.

Preserve any evidence concerning transfers from bank accounts to cryptocurrency platforms and provide it promptly to investigators.

What If the Money Was Sent Abroad Again?

Cross-border tracing may require additional cooperation and can substantially increase the difficulty of recovery.

This makes action during the first hours after discovering the fraud especially important.

Can an Injunction or Protective Measure Be Requested?

Depending on the identified assets, parties and procedural route, available protective measures should be evaluated quickly.

The objective is to prevent assets from disappearing before a recovery claim can become effective.

Do Not Focus Only on the Original Amount

Document associated financial losses separately, including bank charges, currency losses and other directly related expenses.

Whether each category can ultimately be recovered is a separate legal question.

Insurance Coverage Should Be Checked

Companies with cybercrime, crime, fidelity or other relevant insurance should review their policies immediately.

Notice periods and cooperation obligations may apply.

Notify the Insurer Without Delaying the Legal Response

Insurance notification should occur alongside bank and legal action rather than instead of them.

The company should preserve proof of when the incident was discovered and reported.

Investigate Other Pending Payments

Once a BEC incident is discovered, suspend or independently verify other payment instructions associated with the compromised relationship.

Fraudsters may have targeted several invoices simultaneously.

Warn Relevant Group Companies

If the attacker gained access to a group mailbox or supplier communication chain, other subsidiaries may also be exposed.

Internal alerts should contain sufficient information to prevent further payments without unnecessarily compromising the investigation.

Preventing Future BEC Losses

Companies should require independent verification of changes to bank details, use trusted telephone numbers already on file, apply multi-factor authentication, restrict payment approval rights and establish dual authorization for significant transfers.

Employees should be trained to treat urgent changes in payment instructions as high-risk events.

Emergency Action Plan: First Hours After Discovery

The victim company should immediately contact the sending bank and request urgent recall measures, identify and alert the Turkish receiving bank, preserve all emails and technical data, secure compromised systems after preserving evidence, collect the invoice and payment records, prepare a detailed timeline, file or coordinate an urgent criminal complaint in Turkey, request tracing and preservation of identifiable proceeds, notify the insurer where applicable and suspend other suspicious payments.

The company should not spend several days debating internally whether the transaction was truly fraudulent while the money continues moving through the banking system.

Frequently Asked Questions

Can money transferred to a fraudulent Turkish bank account be recovered?

Potentially. Recovery prospects depend heavily on how quickly the fraud is detected and whether the funds can still be located and preserved.

Should the company contact the bank or the police first?

Both banking and legal measures should be initiated urgently. They serve different purposes and should generally proceed in parallel.

Is a SWIFT recall enough?

No. A recall request may help but does not guarantee that funds will be returned or legally frozen.

Can Turkish authorities trace money transferred to other accounts?

Bank transaction records may allow investigators to reconstruct subsequent transfers, subject to the applicable criminal procedure.

Should fraudulent emails be deleted after screenshots are taken?

No. Preserve the original electronic messages and available technical information.

Can the account holder be criminally liable even if someone else sent the emails?

Potentially, depending on the account holder’s knowledge, conduct and role in receiving or transferring the proceeds.

Can the genuine supplier demand payment again?

Potentially. Whether the buyer’s contractual payment obligation was discharged requires separate analysis of the contract, payment instructions and circumstances of the fraud.

Can the foreign victim pursue the case without being physically present in Turkey?

Substantial legal steps may potentially be handled through Turkish counsel depending on the procedural circumstances and appropriate authorization.

Can a bank be sued for the loss?

Potentially in appropriate circumstances, but bank liability is not automatic merely because the fraudulent account was held at that institution.

What should the company do first?

Act immediately. Contact the banks, preserve the electronic evidence and initiate the Turkish legal process before the fraud proceeds are withdrawn, transferred through additional accounts or moved outside the banking system.

Client-Focused Legal Support for Business Email Compromise and Bank Transfer Fraud in Turkey

Business Email Compromise cases can involve international wire transfers, fraudulent Turkish bank accounts, cybercrime evidence, urgent asset preservation, criminal complaints, money tracing, contractual payment disputes and civil recovery proceedings. Fırat Fesih Kaya Law Office assists foreign companies, international suppliers and investors facing payment diversion and commercial fraud involving Turkey. Lawyer Fırat Fesih Kaya provides legal assistance in coordinating urgent criminal complaints, preserving digital and banking evidence, tracing fraudulent transfers, pursuing available asset-protection measures and evaluating civil and contractual recovery options.

Phone: +90 312 434 22 22
Mobile: +90 532 769 22 22
Email: info@firatfesihkaya.av.tr
Address: Mevlana Boulevard No:221, Yıldırım Tower, Office No:148, 06520 Balgat, Çankaya, Ankara, Turkey