Foreign Company Discovers Payroll Fraud in Turkey: Criminal Liability and Evidence Preservation (2026 Updated Guide)

A foreign company discovers suspected payroll fraud in Turkey. Learn how to preserve digital and financial evidence, investigate employees and managers, pursue criminal complaints, recover losses and avoid evidence mistakes.

A foreign-owned company operating in Turkey may discover that salaries, bonuses, overtime payments, severance amounts or other payroll-related funds have been manipulated or diverted. The suspected scheme may involve fictitious employees, unauthorized salary increases, false overtime, altered bank-account information, duplicate payments, forged documents, payroll-system manipulation or cooperation between employees and outside parties. When this occurs, the company must act quickly but carefully. An internal suspicion should not automatically be treated as proven criminal conduct. The company should secure evidence, restrict continuing financial exposure, identify who had access to payroll systems and bank accounts, preserve lawful digital records and determine whether a criminal complaint and parallel civil or employment-law measures are appropriate.

What Is Payroll Fraud?

Payroll fraud is not necessarily a single criminal offense with one uniform legal classification. The criminal characterization depends on how the scheme was carried out.

Depending on the facts, conduct may potentially raise issues involving fraud, breach of trust, forgery, unauthorized use or manipulation of information systems, unlawful financial transfers or participation by multiple individuals.

The exact offense should therefore be determined from the evidence rather than assumed at the beginning of the investigation.

Common Payroll Fraud Schemes

A foreign company may encounter fictitious employees added to payroll, salary payments redirected to another person’s bank account, unauthorized bonuses, false overtime, duplicate salary payments, manipulated expense reimbursements, fictitious severance payments, altered payroll records or unauthorized changes to employee bank details.

The scheme may be entirely internal or may involve an outside accountant, consultant, bank account holder or former employee.

First Priority: Stop Continuing Losses

If the suspected fraud is ongoing, the company should immediately review who can authorize payroll changes, upload bank-payment files, approve transfers and modify employee information.

Access may need to be restricted while the investigation proceeds.

However, changes should be documented carefully so that investigators can later determine who had access before the restriction was imposed.

Preserve Evidence Before Confronting the Suspect

One of the biggest mistakes is confronting a suspected employee before securing evidence.

Once a person learns that an investigation has started, emails, messages, documents or other information may disappear.

The company should first identify and preserve relevant evidence lawfully.

Preserve the Payroll Database

Create a reliable record of payroll information for the relevant period. Preserve employee names, identification information where lawfully held, salaries, bonuses, overtime, bank-account details, changes made to those details and payment histories.

Historical versions can be especially important.

Audit Bank Account Changes

A common warning sign is a sudden change in the bank account receiving an employee’s salary.

Determine when the account was changed, who requested the change, who entered it into the system and who approved it.

Compare the receiving account holder with the legitimate employee.

Review Ghost Employees

A fictitious or “ghost” employee may exist in payroll records even though no genuine employment relationship exists.

Check employment contracts, attendance records, personnel files, social-security records, workplace access information, corporate email accounts and salary-payment records.

Look for Duplicate Bank Accounts

Analyze whether multiple employees’ salaries were paid into the same bank account or accounts connected with a payroll administrator, manager or related person.

Unusual account concentration can provide an important investigative lead.

Preserve Bank Transfer Records

Bank statements, payment instructions, bulk payroll files, authorization records and transfer confirmations should be preserved.

The company should be able to reconstruct the path from payroll calculation to actual payment.

Identify Who Approved Each Payment

Do not focus solely on the employee who entered information into the system.

Determine who prepared, reviewed and approved the payroll and who had final authority over the bank payment.

This can reveal whether the incident resulted from one employee or coordinated conduct.

Digital Evidence Can Be Crucial

Payroll fraud frequently leaves digital traces.

Relevant evidence may include emails, corporate messaging records, accounting-system logs, payroll-system audit trails, access logs, spreadsheets, document metadata and bank-authorization records.

Preserve System Logs Immediately

Some IT systems retain logs only for limited periods.

The company should therefore preserve available login records, user IDs, timestamps, IP information where lawfully available, change histories and approval logs before ordinary system processes overwrite them.

Do Not Alter the Original Digital Evidence

Investigators should avoid opening, editing and resaving important files unnecessarily.

Where forensic examination may become necessary, preservation of original files, metadata and system information can be critical.

Consider Forensic Imaging

For serious cases involving computers or corporate devices, professional forensic preservation may be appropriate.

The objective is to preserve the state of the relevant data and allow later analysis without unnecessarily altering the original evidence.

Corporate Emails Should Be Preserved Lawfully

Relevant business emails can be important evidence, but access and processing should comply with applicable privacy, employment and data-protection requirements.

The company should distinguish corporate records from purely private communications.

WhatsApp and Messaging Evidence

Business-related messaging may become relevant if employees used messaging applications to coordinate payroll changes or transfers.

Screenshots alone may not always provide the strongest evidence. Original devices, message context, timestamps and other supporting information may become important when authenticity is disputed.

Do Not Secretly Manipulate an Employee’s Account

The desire to investigate does not give a company unlimited authority to access personal accounts or private devices.

Evidence obtained unlawfully can create separate legal risks and complicate later criminal proceedings.

Preserve Physical Documents

Payroll fraud may also involve signed forms, bank-account change requests, employment contracts, overtime sheets, expense documents or payment instructions.

Original documents should be secured and access to them documented.

Forged Signatures Should Be Examined

If an employee claims not to have requested a bank-account change or salary adjustment, examine the relevant signature or authorization.

Where necessary, forensic document examination may become relevant.

Interview Relevant Personnel Carefully

After evidence is secured, the company may interview payroll staff, HR personnel, finance employees, supervisors and other individuals with relevant knowledge.

Prepare a chronology and record factual explanations accurately.

Avoid Leading Internal Interviews

The purpose of an internal investigation is to establish facts, not merely obtain confirmation of an initial theory.

Ask who performed each action, when it occurred and which records support the explanation.

Build a Transaction Timeline

For each suspicious payment, record the payroll period, legitimate amount, manipulated amount, receiving account, system change, responsible user, approval and bank-transfer date.

A clear timeline can substantially improve a later criminal complaint.

Calculate the Company’s Actual Loss

Distinguish suspicious transactions from proven financial loss.

Prepare a transaction-by-transaction calculation and retain accounting evidence supporting each amount claimed.

Criminal Liability Depends on the Method Used

A payroll employee who diverts company funds through deception may face a different criminal analysis from an employee who manipulates an information system, forges a document or abuses assets entrusted to them.

Lawyer Fırat Fesih Kaya evaluates the actual transaction structure before determining which criminal provisions may be relevant.

Fraud May Be Relevant

Where company personnel are intentionally deceived through false records or representations and the perpetrator obtains an unlawful benefit, fraud-related provisions may need to be considered.

The precise elements must be established from the facts.

Breach of Trust May Be Relevant

Where an individual lawfully controls company assets or funds but subsequently uses them contrary to the purpose for which they were entrusted, breach-of-trust issues may arise depending on the circumstances.

Forgery May Create Separate Exposure

False payroll instructions, fabricated employment documents, altered approvals or forged signatures can create issues separate from the underlying financial loss.

Preserve the original documents wherever possible.

Information-System Conduct May Be Important

If the suspected person manipulated payroll software, online banking, accounting systems or other electronic systems, the method of access and manipulation should be investigated carefully.

Digital logs can become central evidence.

Participation by Multiple Employees

Payroll fraud sometimes requires cooperation between HR, payroll, finance or management personnel.

Criminal responsibility is personal. The role, knowledge and actions of each person should therefore be established separately.

A Manager Is Not Automatically Criminally Liable

The fact that a person is a director, country manager or finance manager does not automatically make that individual criminally responsible for fraud committed by another employee.

Criminal liability generally requires examination of the individual’s own conduct, knowledge, participation and intent.

Foreign Directors Should Avoid Premature Admissions

A foreign director asked to explain suspicious payroll transactions should distinguish between corporate responsibility, supervisory issues and personal criminal liability.

They should not speculate about transactions they did not personally conduct.

When Should the Company File a Criminal Complaint?

Once sufficient facts indicate possible criminal conduct, the company can evaluate submitting a complaint to the competent prosecution authorities.

The complaint should present a coherent factual chronology supported by available evidence rather than simply accuse several employees of “fraud.”

What Should Be Included in the Complaint?

The file may include suspicious payroll records, bank transfers, accounting information, internal audit findings, relevant emails, system logs, authorization records, employee documentation and a transaction-based loss calculation.

The exact evidence depends on the scheme.

Prosecutors Can Obtain Additional Evidence

A company does not necessarily need to possess every piece of evidence before approaching authorities.

Depending on the investigation, prosecutors may obtain banking, digital or other evidence through legally available criminal-procedure mechanisms.

Bank Account Evidence Can Be Critical

Where money was diverted to particular accounts, identify those accounts accurately and preserve transfer records.

The investigation may then examine account ownership and subsequent movement of the funds through lawful procedures.

Follow the Money

The initial receiving account may not be the ultimate destination.

Funds may be transferred rapidly to additional accounts, withdrawn or used for other transactions.

Early identification of the financial trail can therefore be important.

Can Assets Be Frozen?

Depending on the alleged offense, evidence and procedural requirements, criminal proceedings may permit protective measures concerning certain assets.

Such measures are not automatic merely because the company alleges payroll fraud.

Can the Company Recover the Money?

Potentially. Criminal proceedings and private-law recovery should be considered as separate but coordinated issues.

The company should identify the persons who received the funds, the legal basis for recovery and available assets.

Employment Termination Must Be Handled Separately

Suspected criminal conduct may also create employment-law consequences.

However, the company should not assume that filing a criminal complaint automatically resolves dismissal procedure, employment receivables or evidentiary requirements.

Avoid Destroying Evidence When Terminating Access

When an employee leaves or is suspended, IT personnel should preserve relevant corporate data before wiping, reassigning or reformatting company devices.

Routine offboarding can otherwise destroy valuable evidence.

Personal Data Rules Still Apply

An internal fraud investigation does not eliminate data-protection obligations.

The company should limit collection and review to information reasonably relevant to the investigation and maintain appropriate security over sensitive personnel and financial records.

Foreign Headquarters Should Coordinate With the Turkish Entity

International groups often involve headquarters compliance, internal audit and legal departments.

The Turkish company should coordinate evidence preservation with the foreign parent while considering applicable confidentiality and personal-data requirements.

Do Not Send Original Evidence Abroad Without Planning

Where headquarters requests all investigation data immediately, determine whether originals should remain preserved in Turkey and how electronic copies can lawfully be shared.

Evidence-management decisions should anticipate possible Turkish criminal proceedings.

Preserve the Chain of Custody

Record who collected important evidence, when it was collected, where it was stored and whether copies were made.

This can help address later allegations that documents or digital evidence were altered.

Conduct a Wider Payroll Audit

Once one fraudulent transaction is discovered, examine whether the same method was used previously.

Review earlier payroll periods, bank-account changes, unusual bonuses, duplicate payments and terminated employees.

Do Not Assume Every Irregularity Is Fraud

Payroll systems also produce ordinary accounting and administrative mistakes.

The investigation should distinguish negligence, incorrect data entry and genuine contractual disputes from intentional criminal conduct.

Review External Payroll Providers

If payroll processing is outsourced, determine what information was provided to the service provider and whether it followed the agreed authorization procedures.

Contractual liability may arise separately from criminal responsibility.

Accountant or Consultant Involvement

External accountants or consultants should not automatically be accused merely because they processed payroll information.

Determine what they knew, what instructions they received and whether they participated knowingly in the alleged scheme.

Notify Insurers Where Appropriate

Depending on the company’s insurance program, employee dishonesty, crime, cyber or other coverage may potentially be relevant.

Notification periods and policy requirements should be checked promptly.

Avoid Public Accusations

Publishing allegations against employees before the facts are established can create unnecessary legal exposure.

Internal communications should be controlled and limited to persons who need the information.

Preserve Evidence for Civil Litigation

Even if criminal proceedings are initiated, maintain the documentation required for contractual, employment or compensation claims.

Different proceedings may require the same evidence for different purposes.

Review Internal Controls After the Incident

The company should identify how the suspected scheme bypassed existing controls.

Possible improvements include dual authorization for payroll changes, independent bank-account verification, segregation of duties, automated exception reports and periodic payroll reconciliation.

Immediate Action Plan for Foreign Companies

When suspected payroll fraud is discovered in Turkey, the company should immediately secure payroll and banking records, preserve system logs, restrict unauthorized access, identify suspicious transactions, document bank-account changes, preserve corporate communications lawfully, calculate the potential loss, investigate each participant separately, coordinate employment measures carefully, assess whether a criminal complaint should be filed and preserve evidence for recovery proceedings.

Frequently Asked Questions

Is payroll fraud automatically a specific crime in Turkey?

Not necessarily. Criminal characterization depends on how the money was obtained or diverted and may involve different offenses depending on the facts.

Should the suspected employee be confronted immediately?

Usually the company should first consider evidence preservation and continuing financial risk. Premature confrontation can create a risk that evidence disappears.

Can company emails be used as evidence?

Potentially, subject to the circumstances in which the information was obtained and applicable privacy, employment and procedural rules.

Are WhatsApp screenshots enough?

They can be relevant, but authenticity and context may be disputed. Original digital evidence and corroborating records can strengthen the evidentiary position.

Can a foreign company file a criminal complaint in Turkey?

A foreign-owned company operating in Turkey can pursue available criminal-law remedies where it is affected by suspected criminal conduct, subject to the applicable procedural framework.

Can a director be personally liable because payroll fraud happened under their management?

Not automatically. Personal criminal liability requires analysis of the director’s own conduct, knowledge and involvement.

Can money transferred to the suspect’s bank account be recovered?

Potentially. Recovery options depend on the evidence, recipient, movement of funds, available assets and procedural mechanisms.

Should the employee be dismissed immediately?

Employment-law consequences should be evaluated separately. Evidence preservation and applicable employment procedures should be considered before taking irreversible action.

Should headquarters conduct the investigation from abroad?

Headquarters can participate, but the investigation should be coordinated with Turkish legal, evidentiary, employment and data-protection requirements.

What is the most important first step?

Preserve the evidence before changing the systems or confronting suspected participants. Payroll records, bank transfers, audit logs and digital communications can disappear or be overwritten, making early evidence preservation one of the most important parts of the company’s legal response.

Client-Focused Legal Support for Corporate Payroll Fraud in Turkey

Payroll fraud can expose a foreign company to financial loss, criminal proceedings, employee disputes, digital-evidence problems and difficulties recovering transferred funds. Fırat Fesih Kaya Law Office assists foreign-owned companies, international investors and corporate managers dealing with suspected internal fraud and financial misconduct in Turkey. Lawyer Fırat Fesih Kaya provides legal assistance in evidence-preservation strategy, internal investigation planning, criminal complaints, representation during prosecutor investigations, coordination of digital and financial evidence and legal proceedings concerning recovery of company losses.

Phone: +90 312 434 22 22
Mobile: +90 532 769 22 22
Email: info@firatfesihkaya.av.tr
Address: Mevlana Boulevard No:221, Yıldırım Tower, Office No:148, 06520 Balgat, Çankaya, Ankara, Turkey