

A foreign investor sends money after seeing a fake Turkish property listing. Learn how bank transfers can be traced, fraudulent accounts may be suspended or seized, evidence can be preserved and stolen funds may be recovered.
A foreign investor searching for real estate in Turkey may find an attractive apartment, villa, land parcel, commercial property or investment project through a property website, social media advertisement, messaging application or supposed real estate agent. The property appears genuine, photographs are convincing, a title deed copy is provided and the investor is pressured to send a reservation payment, deposit or even a substantial portion of the purchase price.
After the transfer, the situation suddenly changes.
The alleged seller stops responding. The advertisement disappears. The telephone number becomes unreachable. The buyer discovers that the property belongs to someone else, does not exist in the form advertised, was never for sale or was copied from another legitimate listing.
At this point, one question becomes more important than almost everything else:
Where did the money go?
For foreign victims, speed is critical. Modern property fraud can involve money moving from the first recipient account to additional bank accounts, payment institutions or even crypto-asset platforms within a very short period.
Turkey introduced an especially important criminal-procedure mechanism at the end of 2025. Under the new Article 128/A of the Criminal Procedure Code, where there is reasonable suspicion of specified offences including certain forms of aggravated fraud involving information systems or banking systems, banks, payment service providers and crypto-asset service providers can suspend relevant accounts for up to 48 hours. The provision also establishes mechanisms for following the criminal proceeds when they have already been transferred to another financial institution and for seizure of the criminal proceeds.
For a foreign investor who has just sent money to a fake property seller, the first hours can therefore be extremely important.
A fraudulent property listing can be built from genuine information.
The fraudster may copy:
property photographs,
location information,
project brochures,
floor plans,
title deed images,
agent advertisements,
videos,
or descriptions
from a real property listing.
The advertisement may therefore look convincing even though the person receiving the money has no connection with the property.
A fake listing does not necessarily advertise an imaginary property.
The apartment or villa may be completely real.
The fraud lies in the fact that the person advertising it does not own it and has no authority to sell it.
This distinction is important because a foreign investor may verify that the building exists and mistakenly conclude that the transaction must therefore be legitimate.
A victim may communicate with someone claiming to work for:
a property agency,
developer,
investment company,
property owner,
law office,
or consultant.
The fraudster may use copied logos, photographs, names and business information.
The identity of the person requesting payment should therefore be independently verified.
The fraudster may send a real title deed belonging to the genuine owner.
This does not prove that the fraudster owns the property.
A title deed copy may have been obtained from:
an old advertisement,
previous transaction,
tenant,
broker,
property manager,
or another source.
Current ownership and the seller’s authority must be independently verified before money is sent.
The foreign investor may be told:
“There are three other buyers.”
“The owner needs the deposit today.”
“The price increases tomorrow.”
“Send the reservation payment now.”
“The title appointment cannot be booked until payment arrives.”
The purpose may be to prevent the buyer from conducting independent due diligence.
A legitimate investment opportunity should not require the investor to abandon basic fraud controls.
The first objective is not to argue with the fraudster.
It is to preserve the money and the evidence.
The investor should immediately organize:
bank transfer records,
recipient account details,
IBAN information,
SWIFT information where relevant,
payment reference,
property advertisement,
title deed copies received,
contracts,
WhatsApp conversations,
emails,
telephone numbers,
social-media profiles,
voice messages,
and all identification documents supplied by the supposed seller.
These materials can help trace both the financial flow and the people behind the transaction.
If the transfer was recent, the investor should contact the sending bank without delay and report suspected fraud.
Provide:
transaction date,
amount,
recipient,
IBAN,
transaction reference,
and the circumstances indicating fraud.
The bank should not be given only a general statement such as:
“I changed my mind about the property.”
The issue should be clearly identified as suspected fraudulent inducement where that is what occurred.
Not necessarily.
Once money has been credited and transferred onward, ordinary cancellation may no longer be possible.
However, that does not mean recovery is impossible.
The legal strategy may shift from attempting to reverse the original transfer to:
identifying the recipient account,
following onward transfers,
suspending relevant accounts,
obtaining seizure measures,
and seeking return of criminal proceeds.
A major development took effect through Article 128/A of the Criminal Procedure Code.
For specified offences including aggravated fraud under Article 158/1-f and 158/1-l of the Turkish Criminal Code, where reasonable suspicion exists, a bank, payment service provider or crypto-asset service provider can suspend an account involved in the transaction for up to 48 hours.
This creates an important emergency mechanism in qualifying fraud cases.
This is one of the most significant aspects of the 2026 framework.
Article 128/A specifically addresses onward transfers.
If the criminal proceeds have already been transferred to another financial institution before the suspension is completed, the first institution must notify the relevant institution without delay so that the suspension mechanism can be applied there as well.
This is particularly relevant to property scams involving rapid movement of funds.
A typical transaction chain may look like:
Foreign investor → Account A → Account B → Payment institution → Account C
The fraudster may believe that moving the funds through several accounts makes recovery impossible.
It does make tracing more complex.
But bank records can establish:
where the funds entered,
when they moved,
which accounts received them,
and where they went next.
The investigation should therefore follow the entire chain rather than focusing only on the first IBAN.
The person whose name appears on the bank account may not necessarily be the person who created the fake property advertisement.
Fraud networks can use third parties whose accounts receive and forward money.
The investigation should distinguish between:
the advertiser,
person communicating with the investor,
account holder,
person controlling the account,
ultimate recipient,
and other participants.
The statement:
“That was only my bank account; I did not know anything”
does not automatically resolve criminal or civil responsibility.
The investigation may examine:
why the account was used,
who controlled online banking,
who withdrew funds,
who received transfers,
communications between participants,
and whether the account holder knew the purpose of the transactions.
The evidence should determine the person’s role.
Yes, where the applicable criminal-procedure requirements are satisfied.
Article 128 of the Criminal Procedure Code permits seizure of bank and other financial accounts in qualifying circumstances where the statutory evidentiary requirements concerning criminal proceeds are met.
For the qualifying technology/banking fraud offences covered by Article 128/A, the new provision provides a faster targeted mechanism for suspension and seizure of the proceeds involved in the transaction.
This distinction matters.
Suspension temporarily prevents activity involving the relevant account or transaction under the Article 128/A mechanism.
Seizure is a criminal-procedure measure placing the relevant criminal proceeds under judicial/prosecutorial control under the statutory conditions.
Article 128/A provides that funds in an account suspended by the financial institution or upon a prosecutor’s written instruction can be seized by judicial decision or, in urgent circumstances, by written order of the prosecutor subject to subsequent judicial review.
This is particularly important for victims.
Article 128/A expressly provides that where the seized criminal proceeds are determined to belong to the person harmed by the offence, they are returned to their owner during the investigation or prosecution stage.
This means that successful tracing and seizure can potentially lead directly to recovery of identifiable criminal proceeds.
There is a major practical difference between:
money still sitting in the first recipient account
and
money already withdrawn in cash or dissipated.
If the funds remain identifiable within financial institutions, preservation can be considerably easier.
If they have already been:
withdrawn,
spent,
converted,
distributed among numerous people,
or moved outside the immediately traceable financial chain,
recovery can become substantially more difficult.
This is why rapid reporting matters.
The 2026 Article 128/A mechanism expressly refers not only to banks and payment service providers but also to crypto-asset service providers.
Accordingly, movement of fraud proceeds into a regulated crypto-service environment does not automatically end the tracing analysis.
The investigation should determine:
which platform was used,
which account received the funds,
transaction dates,
amounts,
and the subsequent movement of assets.
If the fraudster requested payment through:
crypto exchange,
wallet address,
stablecoin,
or another digital asset,
preserve the exact:
wallet address,
transaction hash,
exchange information,
screenshots,
messages,
and payment instructions.
A screenshot alone should not replace the underlying transaction data where it can be preserved.
Foreign investors may send funds from a bank outside Turkey.
In that situation, preserve:
SWIFT documentation,
sender bank records,
correspondent bank information,
recipient bank,
IBAN,
currency,
transaction reference,
and value date.
The sending bank should be informed immediately that the transfer is connected with suspected fraud.
Cross-border recovery can involve additional procedural steps, but the financial trail should still be preserved as quickly as possible.
If fraud becomes apparent, do not wait several days merely to see whether the seller responds.
A delay gives the recipient additional time to move the funds.
The buyer can preserve communications and continue verifying the facts while simultaneously notifying the relevant financial and legal authorities.
Online advertisements can disappear within minutes.
Save:
full-page screenshots,
property photographs,
listing number,
URL information,
account name,
publication date,
advertised price,
telephone numbers,
agent profile,
and platform messages.
Where possible, preserve the original digital material rather than only cropped screenshots.
The fraud may have developed over several weeks.
Save complete:
WhatsApp chats,
emails,
SMS messages,
Telegram conversations,
voice notes,
video-call information,
documents,
and attachments.
The full conversation can establish how the investor was induced to transfer the money.
Fraud victims sometimes delete messages because they feel that the scam should have been obvious.
That can destroy valuable evidence.
Even messages that appear unimportant may establish:
false representations,
payment instructions,
identity claims,
ownership claims,
or links between participants.
These may include:
fake title deeds,
valuation reports,
passports,
powers of attorney,
company documents,
bank receipts,
reservation agreements,
and supposed government documents.
Retain the original electronic files where possible.
The documents may contain information linking the fraud to other participants.
Create a simple table containing:
name used,
telephone number,
email,
social-media account,
bank account,
IBAN,
company name,
property listing account,
and role claimed by the person.
Fraudsters may use multiple identities during the same transaction.
A fake listing platform may have information concerning:
account registration,
listing history,
communications,
and other technical records.
Availability and disclosure depend on applicable legal procedures and the platform involved.
The important point is to identify the listing precisely before it disappears.
Turkish Criminal Code Article 157 defines fraud generally, while Article 158 regulates aggravated forms of fraud. Among the aggravated circumstances, Article 158/1-f concerns use of information systems or banks or credit institutions as instruments of the offence.
A fake online property advertisement combined with banking transactions may therefore require careful analysis of the precise method used.
The criminal classification should follow the facts rather than simply the amount lost.
The complaint should explain the entire fraud sequence.
It should identify:
how the listing was found,
what property was advertised,
what representations were made,
which documents were supplied,
who communicated with the investor,
when payment was requested,
which account received it,
what happened afterward,
and why the investor discovered the transaction was fraudulent.
The banking trail should be presented clearly.
If the money has only recently been transferred, the complaint should make the urgency apparent.
The investigation may need immediate information concerning:
recipient account balance,
onward transfers,
payment institutions,
other recipient accounts,
and potential conversion into crypto assets.
The objective is to locate the proceeds before they disappear.
The 2026 Article 128/A framework also provides that, during an investigation or prosecution, information or documents requested from banks, payment service providers or crypto-asset service providers by the prosecutor, judge or court must be provided within the statutory period.
Financial tracing therefore should not depend solely on information voluntarily available to the victim.
The foreign investor may be unable personally to obtain the recipient’s complete banking history.
That does not mean the records are unavailable to investigating authorities.
Appropriate criminal procedures can be used to obtain relevant financial information.
The first account may contain almost nothing by the time the fraud is discovered.
That should not end the investigation.
The critical questions become:
Where did the money go next?
Was it transferred to another bank?
Was it divided among several accounts?
Was it withdrawn?
Was it transferred to a payment institution?
Was it converted into crypto assets?
The investigation should follow the proceeds rather than stop at the first account holder.
If the money was withdrawn from an ATM or branch, the investigation may potentially involve:
withdrawal time,
location,
account activity,
and other available records.
Where relevant evidence is time-sensitive, preservation should be considered promptly.
The person receiving the first transfer may be only one participant.
The broader investigation can include:
property advertiser,
fake agent,
account provider,
document preparer,
telephone user,
money mule,
and ultimate beneficiary.
Identifying the entire network can improve recovery prospects.
Criminal proceedings can be essential for tracing and seizure, but the investor should also consider the civil basis for recovering money from responsible persons.
Potential claims depend on the facts and can involve:
restitution,
repayment,
damages,
contractual claims,
or other civil remedies.
The criminal and civil strategies should be coordinated.
Turkish civil procedure permits interim protection where changes in the existing situation could make realization of a right substantially more difficult or impossible or where delay may cause serious harm. In urgent circumstances, the court may decide without first hearing the opposing party, provided the statutory requirements are met.
Whether an injunction is the appropriate mechanism depends on the asset and claim involved.
Where the investor has an identifiable monetary claim against a responsible party, ihtiyati haciz, or interim attachment, may need to be considered under the Enforcement and Bankruptcy Law if its requirements are satisfied.
Current appellate jurisprudence reiterates that the applicant must provide evidence sufficient to approximately establish the relevant monetary claim and the statutory conditions for interim attachment.
This can become important where the fraudster owns other identifiable assets even though the original transferred money has already disappeared.
These mechanisms should not be confused.
Criminal seizure focuses on assets and proceeds within the criminal investigation framework.
Civil interim attachment is designed to secure satisfaction of a monetary claim under the applicable civil-enforcement conditions.
A serious fraud-recovery strategy may need to consider both, depending on the evidence and assets available.
If a responsible person is identified and owns:
real estate,
vehicles,
company shares,
bank assets,
or other property,
the investor should consider whether civil preservation measures are available.
Recovery should not focus exclusively on locating the exact banknotes originally transferred.
Suppose the investor sends EUR 100,000.
The recipient immediately withdraws or transfers the entire amount.
If the original proceeds cannot be directly returned, the investor may still have claims against persons legally responsible for the loss.
The recovery analysis therefore has two levels:
Can the actual criminal proceeds be traced and returned?
and
If not, against whose assets can the financial claim ultimately be enforced?
Victims sometimes assume that because a Turkish bank received the fraudulent transfer, the bank must reimburse it.
That is not automatically the case.
Bank liability depends on the specific facts, including:
the transaction,
authentication,
instructions,
warning signs,
applicable duties,
and the bank’s conduct.
The recipient bank’s mere existence in the payment chain does not itself establish liability.
Where there are specific grounds suggesting failures in the handling of the transaction or suspicious account activity, the relevant banking conduct may need to be examined.
This is a fact-specific issue.
It should not distract from the immediate priority of locating and preserving the funds.
Property scams often involve an investor personally instructing the bank to make the transfer.
The fact that the investor authorized the payment does not necessarily mean no fraud occurred.
The allegation may be that the payment authorization was obtained through deception concerning:
property ownership,
seller identity,
authority,
or existence of the transaction.
The distinction between an unauthorized bank transaction and an authorized payment induced by fraud is legally important.
Verify whether the company:
exists,
was actually involved,
owns the recipient account,
has real directors,
operates at the stated address,
and has any relationship with the property.
Fraudsters may misuse the name of a genuine company or create a company structure as part of the scheme.
If the supposed seller provides:
tax certificates,
trade registry documents,
signature circulars,
company brochures,
or invoices,
preserve them.
They may be genuine, altered or stolen from another business.
Each should be independently verified.
Do not contact the developer using the telephone number supplied by the suspected fraudster.
Locate the genuine business independently and verify whether:
the listing is theirs,
the salesperson works for them,
the bank account belongs to them,
and the project unit is actually available.
Impersonation of legitimate businesses can make fake listings particularly convincing.
A professional-looking reservation contract does not prove that the person signing it owns the property.
Before payment, verify:
seller identity,
property ownership,
authority,
refund terms,
recipient account,
and the relationship between the reservation agreement and eventual title transfer.
If the investor is asked to pay for Turkish real estate directly in cryptocurrency to a private wallet, enhanced caution is warranted.
Crypto transfers can move quickly and may be difficult to reverse.
Where fraud occurs, preserve every technical identifier immediately.
The 2026 Article 128/A framework’s express inclusion of crypto-asset service providers is especially relevant where identifiable proceeds enter covered service providers.
The location of the fraudster does not necessarily end the Turkish investigation if relevant:
bank accounts,
victims,
transactions,
property representations,
or participants
are connected with Turkey.
However, cross-border evidence and asset recovery may require international cooperation.
The precise jurisdictional analysis depends on the facts.
The victim does not necessarily need to remain physically in Turkey for every stage of the case.
Depending on the required procedures, representation can be organized through an appropriately drafted power of attorney.
The investor should preserve original evidence and remain available for necessary procedural steps.
After the investor discovers the scam, the fraudster may change tactics.
The victim may receive messages claiming:
“Your refund is ready, but you must pay tax.”
“Your money has been frozen.”
“Pay a legal release fee.”
“Send a security deposit.”
“Pay the bank charge.”
This may be a second-stage recovery scam.
No additional payment should be made without independent verification.
Fraud victims can become targets again.
A supposed:
lawyer,
bank investigator,
government official,
cyber specialist,
or asset recovery company
may contact the investor and claim that the money has been found.
Verify the identity and authority of anyone requesting additional payment.
Where the transfer has just occurred, the foreign investor should prioritize:
notifying the sending bank,
preserving all payment information,
preserving the fake listing and communications,
identifying the recipient account,
preparing an urgent criminal complaint,
and
requesting investigation of onward transfers.
The objective is to reach the financial trail while the funds may still be identifiable.
The 48-hour period is particularly significant under the new Article 128/A mechanism because qualifying financial institutions can suspend accounts involved in specified technology/banking fraud offences for up to 48 hours where the statutory reasonable-suspicion threshold is met.
The investor should therefore avoid losing these critical early hours in prolonged negotiations with the fraudster.
The next stage should reconstruct the complete scheme.
Prepare:
a chronological fraud narrative,
financial-flow chart,
participant list,
bank-account list,
telephone-number list,
property-document file,
and evidence archive.
Determine whether the proceeds remain traceable and whether responsible persons have other identifiable assets.
A useful recovery chart may look like:
Investor’s foreign bank → Turkish Bank Account A → Account B → Payment Provider C → Crypto Platform D
Add:
dates,
times,
amounts,
account holders,
transaction references,
and known participants.
This allows the investigation to focus on the actual movement of funds.
The fake property itself remains important evidence.
The investor should preserve proof showing:
the property was advertised,
the alleged seller claimed ownership or authority,
the investor relied on those representations,
payment was made because of them,
and the representations were false.
This connects the money transfer to the alleged fraudulent conduct.
A foreign investor who sends money after a fake Turkish property listing should treat the matter as an urgent asset-tracing case, not simply as a failed real estate purchase.
The first priority is immediate financial notification and evidence preservation. The sending bank should be informed of the suspected fraud, and the investor should preserve the transfer confirmation, recipient account, SWIFT or IBAN information, advertisement, documents and complete communication history.
Second, the criminal complaint should request rapid investigation of the financial trail. This is particularly important under the new Article 128/A of the Criminal Procedure Code, introduced at the end of 2025. For qualifying aggravated fraud offences involving information systems or banking mechanisms, banks, payment service providers and crypto-asset service providers can suspend relevant accounts for up to 48 hours where reasonable suspicion exists.
Third, the investigation should follow onward transfers, not stop at the first account. Article 128/A expressly provides for notification to another financial institution where the criminal proceeds have already been transferred onward, enabling the suspension mechanism to follow the money through the financial chain.
Fourth, seizure should be considered where the statutory conditions are met. Article 128/A allows seizure of the criminal proceeds in the suspended account under the applicable judicial or urgent prosecutorial procedure, and it expressly provides for return of the seized proceeds to the victim when they are determined to belong to that victim.
Fifth, do not limit recovery to the original funds. If the proceeds have been dissipated, identify legally responsible participants and investigate other assets against which civil recovery may be pursued. Depending on the claim and evidence, interim attachment or other provisional protection may also need to be evaluated.
Finally, coordinate criminal tracing and civil recovery from the beginning. The best-case scenario is locating and preserving the actual transferred funds before they disappear. If that is no longer possible, the strategy must shift toward identifying responsible persons, preserving their assets and obtaining enforceable civil remedies.
Lawyer Fırat Fesih Kaya can review the fake property listing, payment records, recipient accounts, communications and transaction documents to structure an urgent financial-tracing strategy and determine which criminal, civil and asset-preservation measures should be pursued.
Contact the sending bank immediately, preserve the complete transfer record and report the suspected fraud. At the same time, preserve the fake listing, communications, property documents and recipient account details and evaluate an urgent criminal complaint.
Potentially. Under the 2026 framework in CMK Article 128/A, banks, payment service providers and crypto-asset service providers can suspend relevant accounts for up to 48 hours where reasonable suspicion exists concerning specified offences, including qualifying aggravated fraud.
The investigation should follow the onward transfer. Article 128/A specifically provides for notification to the next financial institution when the proceeds have already been transferred before suspension is completed.
Where the statutory requirements are met, criminal proceeds in the relevant account may be seized under the applicable criminal-procedure mechanisms. Article 128/A provides a specific procedure for qualifying cases.
Article 128/A states that where seized criminal proceeds are determined to belong to the victim, they are returned to the owner during the investigation or prosecution stage.
The investigation should trace where the money went. An empty first account does not necessarily mean the financial trail has ended. Onward transfers, withdrawals, payment institutions and crypto-service providers may need to be investigated.
A voluntarily authorized transfer can still have been induced by fraud. The legal issue may be that the investor authorized payment because of false representations concerning the property, seller or transaction.
Bank liability is not automatic merely because the transfer passed through a bank. Whether a bank has separate liability requires analysis of the particular transaction, applicable duties and the bank’s conduct.
Depending on the facts, available evidence and legal basis, criminal seizure or civil provisional measures such as interim attachment may need to be considered for identifiable assets. The requirements of each mechanism are different.
Preserve the bank transfer and SWIFT records, IBAN and recipient information, original property advertisement, title deed or other property documents received, complete WhatsApp and email conversations, telephone numbers, social-media accounts, reservation or sale agreements, payment instructions, voice messages and every document identifying the people or companies involved. Most importantly, act quickly so that the financial trail can be investigated before the proceeds are dissipated.
A fake property listing can turn into a cross-border financial recovery case within hours. The first recipient account may only be the beginning of the money trail. Funds may be transferred through several banks, payment institutions or crypto-asset platforms, making rapid tracing and preservation essential.
The 2026 criminal-procedure framework provides important new mechanisms for qualifying fraud cases, including temporary account suspension, tracing of onward transfers, seizure of criminal proceeds and return of identifiable seized proceeds to the victim. Speed and properly organized financial evidence can therefore materially affect the possibility of recovery.
Fırat Fesih Kaya Law Office assists foreign investors with fake property listings, real estate investment fraud, fraudulent bank transfers, money-mule accounts, financial tracing, criminal complaints, asset-preservation measures and civil recovery proceedings. Lawyer Fırat Fesih Kaya can examine the payment chain and fraud evidence to determine how the transferred funds can be traced, which assets may be preserved and which criminal and civil remedies should be pursued.
Phone: +90 312 434 22 22
WhatsApp: +90 532 769 22 22
Email: info@firatfesihkaya.av.tr