CRIMINAL LAW · DIGITAL RECORDS
Legal support in examining digital records, protecting victims’ rights, criminal defense and account measures.
Scope of the service
Legal practice in cybercrime covers the investigation of offences committed against information systems and of fraud carried out with digital tools, the protection of victims’ rights, and the defense of suspects and accused persons. A screenshot, an IP address or a bank account does not by itself explain the whole incident.
Güneş & Güneş Law Firm examines together deceptive communication, the use of accounts and devices, money movements, intent, loss and the way records were obtained. The scope of representation for the victim, complainant, intervening party, suspect, accused and legal entity is determined separately. Where the parties have conflicting interests, the firm does not undertake joint representation in the same file.
Contact the bank or the relevant payment provider immediately through a verified channel. Preserve the transaction information; do not reset the device or delete messages. Do not wait for a reply from the firm before making a criminal report.
See the urgent steps and the record checklistAreas of practice
The scope is determined by your status as a party and the stage of the file. You can review the 42 topics in the six groups below and select those that apply to you.
Legal characterization of the offence, criminal reports, representation of victims and complainants, and defense of suspects and accused persons, from the investigation to legal remedies.
Review the scope of representation and filingOrigin, integrity and lawfulness of device, IP, session, email and platform records.
View the record review topicsUnauthorized access, data deletion, ransomware, misuse of cards and theft committed through information systems.
Review the scope by type of offenceFake listings, phishing, corporate email, remote access, crypto investment and SIM or line takeover incidents.
Review the types of fraudApplications and defense concerning personal data, private content, threats, blackmail and the protection of children.
View the privacy and protection scopeClaims concerning the making available of accounts, account suspension, seizure, bank records, refunds and private-law claims.
Review the account and refund processes6 topics in this group
The technical form of the incident, the status of the parties, the method of deception or unauthorized access, the loss, the interest and the accounts used are examined. The correct legal distinction is drawn between TCK Articles 142, 157, 158, 243, 244, 245 and 245/A and the provisions on private life and personal data.
A criminal report is prepared together with the timeline of events and the payment and communication records. Requests to obtain records at risk of deletion, account and asset measures, the identification of suspects, and joinder and compensation processes are followed.
The legal elements of the charge, intent, control over accounts and devices, disposal of funds, communications and technical records are each examined separately. Against claims based on abstract account ownership, an incomplete IP identification or a one-sided technical report, a defense grounded in the concrete facts of the file is built.
Where a company system, a commercial account, customer data or corporate email is affected, the loss and the representative capacity of the legal entity are determined. The criminal file is managed in line with insurance, contract, employee, supplier and compensation processes.
The risk that transaction, account, platform, operator and device data may be lost is assessed. In the first application to the Chief Public Prosecutor’s Office (Cumhuriyet Başsavcılığı) or to law enforcement, it is specified which record should be requested, with which date, time and user information, and from which institution.
The indictment, hearing, expert report, discussion of digital records, judgment and confiscation or return orders are followed. Insufficient investigation, a record obtained unlawfully, lack of reasoning, access to the defense and problems with legal remedies are addressed by appeal, cassation and, where the conditions exist, individual application. The effect of Law No. 7589 on files at the stage of legal remedies and enforcement, the deferral of the announcement of judgment and any applicable more favorable provisions are examined separately.
10 topics in this group
The conditions of the decision to search, copy and seize computers, programs and computer files are examined, together with the scope of the decision, the procedural record, technical copies, backup and return processes. Objections and defense options against a disproportionate examination or one that exceeds the decision are assessed.
The question for the technical examination, the data source, the limits of authority, the method and the output of the report are determined according to the legal needs of the file. The firm does not carry out technical device examinations itself; it coordinates the work of a competent technical service provider within the limits of confidentiality, personal data and criminal procedure.
The separation of the original source from the examination copy, the recording of the file hash values, and the consistency of the minutes and access information are checked. The usability as a basis for judgment of missing copies, changed files, unclear times or outputs whose source is not explained is discussed.
The static or dynamic nature of an IP address, CGNAT use, source port, date, time and time zone, subscription and session data are examined together. The link between the subscriber and the actual user is not accepted automatically without confirmation from device, location, communication and other records. Where a shared IP address is used, carrier-grade network address translation (CGNAT) records, source and destination port information and the time zone are matched specifically.
The completeness and retention arrangement of server, application, security, authentication, administrator and transaction logs are assessed. Clock synchronization, gaps, repetitions, user identity and the event timeline are tied to a legal question together with the technical teams.
The apparent sender name is separated from the real email source. Through the full header, routing information, domain records, SPF/DKIM/DMARC results, the reply chain and links, forgery, account takeover or corporate email fraud is investigated. SPF, DKIM and DMARC are authentication checks on the source of an email; on their own they do not prove who wrote the message.
Together with the username, the profile URL or ID, the date of the content, the platform’s response, any linked phone number or email, and the IP and device records, the requests are included in the plan. The relationship between the imitation account, the advertisement, the messages and the flow of money is established.
The completeness, participants and dates of WhatsApp, Telegram, Signal, SMS or similar communications, the export format, the device source and claims of deleted messages are examined. Instead of cropped screenshots, the most complete and verifiable record possible is sought.
The ownership of the device, its actual user, user profiles, remote access, backups, synchronization and cloud account links are investigated. Keeping data unrelated to private life outside the scope and carrying out the examination within the limits set by the decision are observed.
In cases of fake sites, marketplaces, payment pages or corporate imitation, the domain name records, DNS, hosting, access logs, content and change dates are determined. Where a foreign service provider is involved, protection and mutual judicial assistance needs are planned separately.
6 topics in this group
Whether access was unauthorized, the limits of consent or of authority arising from employment, staying in the system, the effect on data, and paid system connections are examined. Facts such as former employees, shared accounts, shared passwords and test authority are assessed on the basis of concrete records.
It is examined whether there is a technical link between a malfunction of the system and the suspect’s conduct. Claims of data deletion, alteration, making data inaccessible, sending it elsewhere and unjust gain are addressed together with the backups, logs, commands and user authorizations.
Malicious files, command-and-control connections, encryption, ransom messages, wallet addresses and service interruption records are turned into a legal file. Corporate notification and criminal investigation are run in parallel without being confused. Distributed denial of service (DDoS) means making a system unusable through traffic from many sources.
How the card or card information was obtained, consent, transaction verification, the device, the merchant, and the links between money and benefit are examined. Transactions made with a genuine card, a counterfeit card or card data are separated according to the specific paragraph and conduct.
The conditions for producing, holding, selling or transferring a device, program, password or security code, or for making or creating one for the purpose of committing certain offences under TCK Article 245/A, are examined. Claims of legitimate testing, research and business activity are assessed on the basis of concrete authorization, purpose and use records.
Whether economic value was taken without the consent of the possessor, the function of the information system, and the access and transfer orders are examined. The distinction from fraud and card offences is drawn by how the victim’s will was influenced and by who initiated the transaction.
8 topics in this group
Under TCK Article 158/1-f and (l), it is examined how the deceptive conduct misled the victim, how the information system was used as a tool, the false status of an institution or employee, and the loss and benefit. The change of competence of 25 December 2025 and the exception for pending files, and the provision of TCK Article 158/4 introduced on 31 July 2026, are also examined according to the stage of the incident and of the file.
Where a fake product or service listing, a deposit, an imitation of secure payment, a shipping link or a sale that is never delivered is involved, the listing, store, messages, payment and account records are brought together. A commercial dispute is distinguished from fraudulent intent that existed from the outset.
In cases where information and payment were obtained through fake bank, courier, e-Government, tax, criminal or membership messages, the link, domain, redirection, session, device and the route of the money are investigated. The victim’s own approval of a transaction does not by itself remove the existence of deception.
In cases where an executive’s, supplier’s or business associate’s account is imitated and IBAN details are changed, the email header, the account session, the invoice, the approval procedure and the banking transaction are examined. The conduct of employees, the bank, the supplier and the attacker is assessed on separate axes of liability.
In cases where an application is installed by phone or message, the screen is shared, a mobile banking transaction is made or a security code is obtained, the remote access application, device permissions, call records and bank records are determined. A distinction is drawn between the victim’s intent to carry out a transaction and technical authority granted as a result of deception.
Where there are fake exchanges, investment panels, high-return narratives, social media advertising or wallet transfers, the route is traced from the entry of fiat money to the crypto transfer. For the exchange account, wallet address, transaction ID, network and foreign providers, protection and information requests are planned.
In advertisements published under the appearance of a public figure, company, bank or institution, the advertisement library, the account ID, the redirection site and the payment chain are examined. Removal of the content, preservation of account data and the steps of a criminal report are carried out together.
The issuance of a new SIM, number porting, identity verification, device change and SMS approval records are examined. The operator, bank, remote access and money transfer timelines are combined in an attempt to determine the actual user.
5 topics in this group
Claims that identity, customer, health, location or account information was recorded, obtained, given or disseminated unlawfully, or was not destroyed within the required period, are examined in connection with TCK Articles 135–140 and the KVKK. The criminal file and the administrative data breach process are managed under separate powers and time limits.
Obtaining, recording or disclosing correspondence, telephone calls, voice, images and private life content is assessed by consent, lawful defense, purpose and the manner of dissemination. A need to prove something lawfully does not confer an unlimited authority to record or disclose.
Where an account is taken over, private images are threatened with publication, money is demanded, or a corporate system is threatened with shutdown, the content, identity, account and payment records are preserved. Removal of the content, protective measures, a criminal complaint and the safety of the victim are planned together.
Where private images or audio are shared without consent, fake content is produced, or the content is used as a threat, the source of the content, the URL or account, the publication date and the extent of dissemination are determined. Criminal, access, personality right and compensation routes are used together according to the file. For audio and images created or altered with artificial intelligence, the original file, source, version and dissemination records are investigated; a conclusion of identity or consent is not drawn merely from the realistic appearance of the image or audio.
In cases of online abuse of a child, obscene content, threats, blackmail, identity impersonation or fraud, the best interests and privacy of the child are the guiding principles. Judicial authorities, platforms and protective services are coordinated without causing the records to be circulated again. A request to re-download, reproduce or send through ordinary communication channels any private or criminal-subject content of a child is not made; a secure reporting route is determined.
7 topics in this group
Claims concerning accounts, electronic money, crypto transfers, advertising, intermediation and organization are examined under the relevant special laws, the TCK and payment records. Merely receiving money into an account is distinguished from organization, knowing intermediation or a relationship of gain.
The account holder’s intent, knowledge and actual control over the account, the consideration received, the number of transactions, communications, and money withdrawal or transfer conduct are investigated. The identity of the account holder alone does not prove that they set up the deceptive communication; however, the concrete circumstances in which the account was lent may give rise to liability separately. Cases where participation under TCK Articles 157–158 is limited to providing an account or payment instrument, or the mandatory information or intermediary needed to use it for unlawful gain, are assessed separately under TCK Article 158/4 and the transitional provisions of Law No. 7589.
The suspension of a bank, payment or crypto-asset account for up to 48 hours; notice to the Chief Public Prosecutor’s Office; the account holder’s application for removal; the seizure order and the periods for judicial approval are monitored. The proportionality of the measure to the offence, the amount and the account link is assessed for both the victim and the account holder. A time-limited suspension by a financial institution and a seizure ordered by a judge or prosecutor are not the same act.
Under CMK Article 128/A and other applicable provisions, the attribution of the seized amount to the victim, the chain of transactions and the rights of ownership are documented. A return within the criminal file does not by itself resolve in full any additional loss, interest, bank liability or compensation claims. Examination of a return or of active repentance does not remove the need to assess the elements of the offence and liability separately.
It is determined from which authority the records of account opening, identity verification, device, IP, session, transfer, withdrawal, recipient and objection should be requested. The period for providing information under CMK Article 128/A and the procedure for other judicial requests are followed according to the rule in force on the date of the file.
Where a foreign social network, email service, cloud service, domain name, crypto platform or bank is involved, the type of data, the retention practice, the country and the competent authority of the provider are determined. Preservation requests, international criminal mutual assistance requests and the channels of the Budapest Convention are assessed according to the specific need.
Alongside the criminal investigation, private-law avenues are examined, such as claims under a banking or payment service, contract, tort, unjust enrichment, a consumer transaction or a personality right. Jurisdiction, time limits, burden of proof and the conditions for interim measures are assessed separately from the criminal file.
Matters to be addressed without delay
“The first 48 hours” is not a waiting period before filing. Bank notification, account security, preservation of records and a criminal report to the police or the Chief Public Prosecutor’s Office proceed at the same time, depending on the needs of the incident. The stages below are not an instruction to wait for hours to pass.
Where active access or an attack is continuing, technical intervention to limit the damage is not delayed; the time, the person carrying it out and its scope are recorded. The return of money depends on the identification of the accounts, the current balance, the timing of the measure and the review of ownership.
Current legislation
31 July 2026 · Law No. 7589
Read the text of the law (opens in a new tab)TCK Article 158/4 provides that where participation in fraud is limited to lending a bank account or payment instrument, or to providing the mandatory information or intermediary needed to use it for unlawful gain, the penalty is reduced by half. This provision does not mean acquittal or an automatic reduction for everyone; the scope of each person’s conduct is determined.
Law No. 7589, Provisional Article 1, paragraphs 6 and 7, lays down separate rules for certain files at the stage of legal remedies and enforcement. For a limited group at the enforcement stage, where TCK Article 168 has not previously been applied, effective repentance is considered on condition that the loss is fully repaired within six months of the court’s warning. Under this provision, the enforcement cannot be deferred or suspended before the loss has been fully repaired.
25 December 2025 · Law No. 7571
Read the amendment (opens in a new tab)CMK Article 128/A regulates the temporary suspension of accounts used in certain offences, their seizure and the procedure for return to the victim. A change of competence has also been made for aggravated fraud. Files heard by the High Criminal Court on the date of entry into force, or pending in legal remedies, are not sent to another court merely because the competence has changed; the earlier rules of competence continue to apply until a final judgment.
31 July 2026 · Law No. 7590
Read the authority and transitional provisions (opens in a new tab)In the relevant duties and powers under Law No. 5651, provision has been made for the Cyber Security Presidency; for traffic information, the source and destination ports are distinguished. In applications concerning internet publications and private life, the applicable provision and the current competent authority are determined separately. These administrative routes do not replace a criminal complaint to law enforcement or to the Chief Public Prosecutor’s Office.
Source review: 4 October 2026. The date of the act, the stage of the file and the transitional provisions are considered together. The preparation of this text and the source review do not constitute a legal opinion on a specific file.
CMK Article 128/A
The start of time limits and the authority competent to decide should be kept separate. Conclusions such as “the block has been lifted” or “the money has come back” are not drawn before the transaction document has been seen.
CMK Article 128/A is a special procedure for accounts used in offences under TCK Articles 142/2-e, 158/1-f and (l), and 245. It is not a general power to block accounts for every offence or every money movement. The reasonable suspicion and the link to the account is concretized.
| Stage | Authority and time limit | Legal control |
|---|---|---|
| Suspension by the financial institution | The bank, payment or crypto-asset service provider, for up to 48 hours | Reasonable suspicion, the offence covered and the link to the account or transaction |
| Notification to the Chief Public Prosecutor’s Office | By the financial institution, immediately | Submission of the account movements and related information |
| Notice to the account holder | The suspension is notified separately | Whether the reason and the transaction information are sufficient for an effective application |
| Application for removal of the suspension | The account holder may apply to the Chief Public Prosecutor’s Office | The prosecutor decides on the application within 24 hours |
| Seizure | A judge’s decision within the suspension period; where there is a risk in delay, the prosecutor’s written order | A seizure without a judicial decision is submitted for approval within 24 hours. The report requirement in CMK Article 128 is not applied in this special procedure. |
| Judicial approval | A judge’s decision within 48 hours of the seizure | If no decision is made within the time limit, the seizure lapses automatically. |
| Return to the victim | If ownership is established, during the investigation or prosecution | The proceeds of crime, the chain of transactions and the rights of ownership |
| Institutional request for information | Records requested by a judicial authority to be sent within 10 days | The scope of the request, a complete answer and the current procedure |
This does not promise a refund within 48 hours. A financial institution’s suspension, a judicial seizure and the determination of the victim’s ownership of the money are separate processes. Where the money has been transferred to another institution, timely notice to that institution and an assessment of a new measure are needed. Removal applications on behalf of the account holder and the review of proportionality are also followed.
Correct legal characterization
In some offences, such as unlawful access to an information system or disruption of a system’s operation, the information system is directly the target or a mandatory element of the offence. In other offences, such as fraud, theft, threat, blackmail, insult, violation of privacy or unlawful transfer of personal data, the digital tool may be the medium in which the act is committed or the instrument used. This distinction changes the applicable provision, the competent court, the complaint requirement, the protective measure and the records to be examined.
| Appearance of the event | Possible legal axis | Matter to be examined |
|---|---|---|
| Unauthorized access to a system or account | TCK Article 243 and related offences | Scope of authority, method of access, session and device records |
| Obstructing the operation of a system or altering data | TCK Article 244 | Technical intervention, damage, link to the perpetrator and intent |
| Unauthorized use of a bank or credit card | TCK Article 245 | Card information, transaction verification, benefit and user |
| Fake listing or obtaining payment through digital deception | TCK Articles 157–158 | Deceptive conduct, deception, loss, benefit and the use of the information system |
| Unauthorized transfer of money from a bank account | TCK Article 142/2-e or another offence, depending on the facts | Account access, transaction order, device and the route of the money |
| Fake bank, public official or institutional employee narrative | TCK Article 158/1-l and related provisions | How the person presented themselves, the call record and the payment link |
| Private correspondence or dissemination of images | The relevant offences in TCK Articles 132–140 | Nature of the content, method of obtaining or disseminating, complaint and consent |
| Attack on an institution’s system and data leak | The intersection of the TCK, the CMK, Law No. 7545 and the KVKK | Technical event, personal data, corporate notification and criminal investigation |
Aggravated fraud, after the amendment of 25 December 2025, generally falls within the jurisdiction of the criminal court of first instance; the exception for pending files is explained in the update section above. Related offences and special jurisdiction rules are examined separately.
Not all offences connected with information technology are subject to a complaint. For offences that require a complaint, the six-month period in Article 73 of the TCK is assessed under the rules on the time from which the act and the perpetrator became known. This period is not a common waiting period for every cyber fraud file.
A criminal report is not the same as a bank dispute of a transaction, a payment service request, a content removal application or a damages action. The jurisdiction, time limit, burden of proof and preliminary application requirements of each are assessed separately.
For a private-law claim, the consumer or commercial nature of the transaction, the competent body and, where needed, mediation as a condition precedent to litigation are determined separately. A pending criminal investigation does not justify acting on the assumption that it automatically preserves the time limit of another application.
Record review
Screenshots, IP addresses, accounts, lines, devices and money movements are examined together. The source, completeness, time information, whether the record was altered, and whether it was obtained lawfully matter as much as its content.
| Type of record | What it does not answer on its own | Supporting examination |
|---|---|---|
| Screenshot | The real user of the account and the completeness of the content | Platform record, device, complete conversation, URL or ID |
| IP address | The actual user and the device | CGNAT and port, date and time, subscription, session, device |
| Bank account | Who set up the deceptive communication, and the intent | Account access, device, cash withdrawal, messages, benefit |
| Telephone line | Who made the call or sent the message | SIM operation, IMEI and device, cell and application session |
| Whether the apparent sender is a genuine source | Full header, domain, session and routing | |
| Crypto wallet address | The real owner or manager of the wallet | Exchange KYC, deposits and withdrawals, network transaction and currency conversion |
| Camera footage | The legal connection to the account or digital process | Time of the transaction, ATM, branch or device record and identification |
| Expert report | Whether the examination is complete and the method correct | Raw record, scope of the decision, technical copy, explanation of method |
| Messaging transcript | Whether any part has been deleted, cut or changed | Device source, export, backup and the counterpart’s device |
| Location data | Whether the person actually used the device | Device identity, session, time and other movement records |
Terms: A log is the record of a system’s events and operations. CGNAT is a network arrangement in which many users can share the same public IP address. A hash value is a digest of a file used to compare the integrity of copies; it does not on its own prove that the content is correct or who carried out an action. A transaction ID (TXID) identifies a specific network transaction; customer identification (KYC) records may be used to investigate the link between a person and an account.
Legal safeguards
Under CMK Article 134, the strong suspicion based on concrete evidence, the absence of any other means of obtaining the evidence, the authorized decision, its scope and the procedural records are examined. Technical copies, backups, examination and return processes are kept distinct.
A disproportionate examination of unrelated personal data, output whose source is not explained, or an unverifiable technical report are assessed for the defense, for objections and for whether the records can be relied on in judgment. An unlawfully obtained record does not become lawful merely because it appears accurate.
The criminal investigation is planned together with the technical incident response, the obligations under Law No. 7545, personal data breaches, contractual notification and insurance processes. The competent technical team limits the damage; the legal work defines the framework of applications, notifications and liability.
For the data controller, notice to the Personal Data Protection Board (Kurul) is made without undue delay and at the latest within 72 hours of becoming aware of the breach. Notice to affected persons is given as soon as reasonably possible after those persons have been identified. A criminal application does not count as having fulfilled these obligations.
Technical examination and legal assessment are conducted separately. The firm does not claim to carry out a forensic IT examination of a device itself. The work of a competent technical service provider is coordinated in terms of authorization, confidentiality, personal data, examination questions and the rules of criminal procedure.
How we handle the file
We do not automatically move from the account holder to the actual offender. We weigh the records favorable and unfavorable to each person together with time gaps, the possibility of another user, the commercial relationship, benefit, control of the account and cash withdrawals. We keep the findings of the technical report separate from the legal characterization.
We determine when the incident was noticed, whether it is continuing, the risk to money, accounts or private content, the party’s status, and the current status of any application. The initial consultation does not require a broad device copy, a complete archive of correspondence or a list of personal data.
The scope of the service, the status of representation, the need for a power of attorney, the urgent steps and the secure method of sharing records are set out in writing. Passwords, access keys and device backups are not collected through ordinary email or a web form.
Deceptive communication, account or system access, money transfer, and device and platform links are brought together in a single timeline. Verified facts, a party’s account, technical findings and matters requiring investigation are shown separately.
The offences that may apply, the requirement of a complaint, jurisdiction and competence, limitation, CMK Article 128/A, CMK Article 134 and other protective measures are determined. It is taken into account that the victim and the suspect or accused in the file have different priorities and burdens of proof.
A criminal report or a defense is submitted, and the collection of records from banks, payment providers, crypto platforms, operators, platforms and devices is followed. The question, data basis, method, connection to the raw record and the legal limits of any expert or forensic IT report are examined.
The indictment, hearing, discussion of the records, participation, return, confiscation, compensation and judgment processes are carried out. Where there is an incomplete investigation or a legal error, appeal, cassation and the relevant extraordinary or international remedies are assessed according to the file.
The scope of the work, the authorization and the secure sharing method are determined at the outset. Clients are informed about applications, institutional responses, hearings and the effect of new records on the file. The examination is not limited to selected records that merely confirm one party’s account.
Secure preparation
At the first consultation, the criminal characterization, the scope of work, missing information and any urgent need for action are clarified. A detailed archive of devices or accounts does not need to be sent.
Do not share passwords, security codes, private keys or recovery words. Information and documents relating to the file are used in confidence, only for legal assessment and the agreed service. A secure method for sharing extensive records is determined separately.
Corporate working arrangements
Founded in Kemer on March 18, 1999 by Attorney Umut Güneş, Güneş & Güneş Law Firm manages cybercrime investigations and cases from its physical office in Antalya. Depending on the nature of the matter, work can be carried out remotely or on site in the 81 provinces of Türkiye and their districts, including filings with law enforcement and prosecutors, hearings and the follow-up of legal remedies.
Where needed, coordination is set up with local colleagues and competent technical service providers. This arrangement does not mean that the firm has a permanent branch or an established team in other provinces.
Representation in respect of offences and losses connected with Türkiye is separated from any local legal proceedings to be carried out in a foreign country. For records held by foreign platforms and banks, the competent authority, the type of data, the retention conditions and the possibilities of judicial cooperation are assessed.
Communication can be conducted in Turkish, English, German and Russian. Representation in a foreign country is undertaken by a lawyer authorized in that country; the choice of lawyer, the scope of work, the contract, the document flow, follow-up, liability and the coordination fee are determined separately.
Working conditions
Advice, criminal complaints, follow-up of the investigation, defense, prosecution, legal remedies and private-law proceedings are assessed as separate matters. The fee is determined by contract, taking into account the work undertaken, the stage of the file, the volume of records and any foreign connection.
Sending a consultation request does not by itself mean that the matter has been accepted or that a time-limited step has been taken on.
Expert fees, independent technical examination, notary, translation, service, travel and litigation expenses may be separate from the attorney’s fee. Which expense is borne by whom is explained in the scope and expense arrangements before the need arises.
Carrying out the service or making a quick application does not create an undertaking to refund money or to achieve any particular outcome in the proceedings.
Clarity before applying
An offence in which an information system is directly the target or a mandatory element is not the same as an offence in which a digital tool is used to commit the act. Legal characterization is made according to the elements of the offence in the TCK and the special laws.
Review the related explanationThey should contact the bank or payment or crypto provider immediately through a verified channel; record the transaction and recipient information; not delete devices or messages; and promptly consider a report to law enforcement or the Chief Public Prosecutor’s Office.
Review the related explanationA report can be made to the Chief Public Prosecutor’s Office, to a police station or to the relevant law enforcement unit. Jurisdiction and competence are assessed according to the type of offence, the victim, the transaction and the connection to the perpetrator; it is important that the report includes precise requests for records.
No. Some offences are prosecuted ex officio; others are subject to a complaint or carry a specific condition. A general complaint period should not be assumed before the offence has been characterized.
Review the related explanationAfter the change of 25 December 2025, the general competent court is the criminal court of first instance. Files that were before the High Criminal Court on the date of entry into force, or are in the course of legal remedies, continue to be heard under the earlier competence rules until a final judgment. Related offences and special competence rules are examined separately.
Review the related explanationNot always. A screenshot may be the starting data of the incident; to establish the real user of the account, the completeness of the content and the date, platform, device, session, bank or operator records may be needed.
Review the related explanationNo. A reset may remove the relevant records. Immediate security risks should be contained by the competent technical team, and the action taken, its date and its scope should be recorded.
Correspondence lawfully obtained may be evaluated in the file. Completeness, the parties, the source of the device and the context matter; where possible, a complete and verifiable record should be submitted instead of selected screenshots.
No. A recording may give rise to offences of communication and of privacy of private life. Judicial criteria for sudden attacks, or for situations where no other means of proof exists, are interpreted narrowly on the facts of the case; a planned and continuous recording cannot be treated in the same way.
No. An IP address is a technical datum about a connection at a specific date and time. The CGNAT and port, subscription, device, session, shared network, remote access and the actual user should be investigated together.
Review the related explanationNo. Criminal liability is personal; intent, knowledge, actual control, communication, benefit and the disposal of the money are examined. However, knowingly lending an account or taking part in the transfer of money may give rise to liability depending on the facts. Participation limited to lending an account is assessed separately under TCK Article 158/4.
Not automatically. Intent and the scope of participation are determined from real records. Where the conduct is limited to giving information, or an intermediary role needed to use a payment instrument or account for unlawful gain, TCK Article 158/4 may arise; this is not a general amnesty.
Review the related explanationA single money transfer is not in itself an offence. The source of the money, the instruction given, the person’s knowledge and intent, the benefit they obtained and the link to the deceptive process should be determined. Active transactions other than lending an account may also affect whether the provision on limited participation applies.
It is a special mechanism for the suspension and seizure of bank, payment or crypto-asset accounts used in offences under TCK Articles 142/2-e, 158/1-f and (l), and 245. It does not apply to every offence or every account.
Review the related explanationUnder CMK Article 128/A, a suspension decision by the financial institution may last up to 48 hours. Afterwards, the judge’s and prosecutor’s decisions and the approval periods set out in the law apply to any seizure that follows; the conformity of the particular step with the current provision is examined separately.
Review the related explanationThe account holder may apply to the Chief Public Prosecutor’s Office for the removal of the suspension; under the regulation, the prosecutor decides within 24 hours. The application should explain, with concrete records, the legitimate use of the account, the source of the transaction and the disproportion of the measure.
Review the related explanationWhere it is understood that the proceeds of an offence under CMK Article 128/A belong to the victim, return is possible at the investigation or prosecution stage. The attribution and the chain of transactions should be documented.
Transaction IDs and address movements can be seen on a public blockchain. However, matching an address to a real person may require the exchange’s customer identification records, session, device, bank and withdrawal records. Judicial cooperation processes may arise with foreign platforms.
The country of the provider, the type of record and the retention policy are important. Requests for preservation, international criminal mutual assistance, the Budapest Convention and the provider’s legal channels are assessed according to the file.
No. The nature of the transaction, authentication, the customer’s conduct, the bank’s security and information duties, the consumer or commercial status and the contract are examined. A criminal investigation and a private-law claim against the bank are not the same.
The decision and its implementation may be examined for conformity with the conditions, scope, technical copy and minutes requirements of CMK Article 134. Requests for the return of seized items, and objections to the disproportionate examination of unrelated personal data, are assessed according to the concrete procedure. The procedural record, the scope of the decision and the technical copy records should be preserved and assessed together with a defense lawyer.
No. Technical inference and forensic IT examination are carried out by competent persons in this field. The firm manages the authority for the examination, its scope, the lawfulness of the records, the questions for the report and the assessment of the results in the criminal file.
No. The account to which the money went, the speed of the transfer, the timing of the measure, the current balance, the perpetrator and the ownership determine the outcome. A prompt application is important, but a refund cannot be promised in advance.
A short summary of the incident, the date and time, the effect on money or accounts, the bank, telephone or platform concerned, applications already made and your status as a party are sufficient for an initial assessment. Detailed records are collected step by step after the engagement and the secure sharing method have been determined.
Review the related explanationNo. It is examined whether the offence, the aim of unlawful gain and the participation are limited to the conduct described in the law. The transitional rules for the stages of legal remedies and enforcement are also different from each other.
Review the related explanationFor certain convicted persons falling under Provisional Article 1, paragraph 7 of Law No. 7589, the period starts from the court’s warning. Conditions such as TCK Article 168 not having been applied earlier and the full repair of the loss are required together; merely making an application does not stop the enforcement.
Review the related explanationNo. A platform application, a content or access measure, a personal data application and a criminal investigation are separate routes. The relevant URL and publication information should be preserved, and the appropriate legal basis and the current competent authority determined according to the act.
Yes, if the conditions are met. Notice to the Board and notice to affected persons are separate obligations. The 72-hour period for the Board runs from awareness of the breach; the completion of the investigation or of the technical report is not awaited.
Review the related explanationRelated services
Corporate incident response and cybersecurity obligations.
Data breaches, the duties of the data controller and applications by data subjects.
Fake accounts, unlawful publications and requests for removal from search results.
Criminal investigation, prosecution and legal remedies.
Payment services, electronic money and the regulation of crypto-assets.
Digital platforms, online sales and internet disputes.
Contracts, access and liability for technology services.
Internal company reviews and corporate criminal files.
Bank transactions, financing and financial liability.
Consumer status and private-law claims.
Representation connected with Türkiye and coordination with foreign countries.
Sources
This page is for general information only. The provision to apply is determined by the date of the act, the capacity of the parties, the records obtained and the stage of the file. The texts as adopted and their subsequent amendments should be read together.
Legal consultation
For victimization, account measures, the examination of digital records or criminal defense, stating your status as a party, the date of the incident and any upcoming step will make the initial assessment easier.
In an active fraud, do not wait for a reply before notifying the bank and making a criminal application. Sending a request does not mean that a time-limited matter has been taken on or that an attorney–client relationship has been established.
Open the consultation request pageInformation and documents shared are kept confidential and used only for legal assessment and the agreed service. At the first contact, do not send sensitive records, passwords, security codes or private keys. You can review the Privacy and Information Security statement.