How can a fake booking be recognized?
A copycat website in the name of a real hotel
A fraudster can copy a hotel’s photos, logo and address and take payment through a domain name that differs by a single letter. The Ministry of Trade drew express attention to this method in its official warning dated 10.08.2020. Before paying, the property’s genuine contact channel should be called independently and it should be confirmed that the booking exists in the hotel’s own system.
A fake bungalow or villa on social media
Photos of a real house on a social media account do not prove that the person posting the listing has the authority to rent it out. A single-use account, a personal IBAN, a refusal to send documents, communication solely over WhatsApp or pressure to pay “a deposit right away” are warning signs; their presence alone is not a conclusive finding of an offence.
How is the link between a forged document, a domain name and an IBAN established?
The following should be investigated: who owns the domain name resembling the real hotel’s name, the domain registration dates, DNS/redirect information, the title/tax number on the forged document, the telephone and e-mail header used, the fake TÜRSAB (Association of Turkish Travel Agencies) certificate, the holder of the IBAN and the chain of accounts to which the payment moved on. The original URL of the web page, the pre-payment screen and, if any, the order ID should be kept. A claim that the suspect is a real hotel employee must be proved not merely by a letterhead document but by authority, an employment relationship and a link to the act. The evidence must be obtained lawfully and the disclosure of personal data beyond what is necessary must be avoided.
A fake agency representative or a former employee
A person may use the letterhead of a tourism company they previously worked for; the business card and the contract format may look genuine. The trade registry, TÜRSAB records, the company’s official website and whether the account that received the payment belongs to the real legal entity should each be checked separately.
What should be done in the first hours after payment?
Notify the bank immediately
In the case of a bank transfer (havale/EFT/FAST) or a credit card transaction, expressly notifying the bank of the suspicion of fraud may lead, depending on the status of the transaction, to a recall, a transaction dispute or a block being considered. Notifying the bank is not a guarantee that the money will definitely be refunded. The time of the transaction, the receipt, the recipient IBAN and the conversations should be preserved.
Disputing a credit card charge
One type of card dispute may arise if the transaction was unauthorized and the tourist did not approve it themselves; a different type may arise if the tourist made the payment but the service was never provided. The rules of the card scheme, the dispute deadline and the bank’s assessment are important. A card claim does not replace the rights to criminal and compensation proceedings.
Separate action within the first 24 hours according to the payment method
If a bank transfer (havale/EFT) was made from an account, the bank should be called immediately; depending on the status of the transfer, a recall, contact with the recipient bank and a suspicious transaction report should be requested. For a card payment, the bank’s charge dispute process and the rules of the card scheme are pursued separately; a chargeback (harcama itirazı) is not an automatic statutory guarantee of a refund. If a payment institution or a virtual POS was used, the transaction reference, the merchant number and the payment recipient details should be kept. At the same time, a report to the public prosecutor’s office/law enforcement, a request that digital evidence not be deleted and, if identity data has leaked, securing the accounts should be considered. This order is adapted to the nature of the act, the payment method and the existing risk; no application means that the money will definitely come back.
Preserving digital evidence in its original form
The domain name, URL, site screen, order page, the PDF “booking document”, WhatsApp correspondence, the payment request, the telephone number, the e-mail header and the account details should be kept. Converting a screenshot alone into a PDF may not preserve the necessary technical metadata; the original file should be retained if possible.
Why does the distinction between TCK Articles 157 and 158 matter?
Not every breach of contract is fraud
A genuine agency that is later unable to provide the service because of financial difficulty is not the same as selling a booking that never existed, by deceit, from the start. The elements of deceptive conduct, the victim being misled, the effect on the victim’s will, the loss and the unjust benefit must be examined on the basis of concrete evidence.
The aggravated form is not automatic
The use of an information system, an act committed in the course of a merchant’s/company’s business and other aggravating circumstances are assessed under TCK Article 158 according to the manner in which the specific act was committed. A definitive accusation under a particular sub-paragraph should not be made without any investigation merely because the transaction took place on the internet.
Multiple victims and suspects
The same fake website may have collected money from different tourists. A common telephone number, IBAN, e-mail address, payment trail and a link to the booking form can be investigated; but the holder of a bank account cannot automatically be presumed to have participated in the offence. Each person’s intent and contribution require separate evidence.
Is the real hotel or travel agency liable?
If the business has no connection at all
Where a fake person has used the hotel’s images without permission, the real hotel is not automatically held liable for every act of the fraudster. Whether the business knew from the outset, whether it gave authority, whether it made the necessary notifications and allegations of security shortcomings are assessed separately.
If the hotel or agency really gave authority
Where a company employee or an authorized sales representative carried out the transaction, a corporate account was used or a company contract was drawn up, liability is assessed differently. The company’s contractual obligations, and its liability for representation and for auxiliary persons, are examined.
The role of the booking platform
A platform merely sharing a link, collecting the sale price or offering the customer its own booking guarantee each produce different legal consequences. Full liability cannot automatically be derived from a single fact such as “there is a platform” or “the platform took a commission”.
Liability of the bank account or the payment infrastructure
The bank is not automatically liable to compensate in every fraud transaction
An unauthorized transaction, a breach of the bank’s security obligations, the way a payment system operates and a transfer made on the customer’s own instruction are distinct from one another. It cannot be said that the whole amount can be claimed from the bank unless the bank’s fault in the specific act and the causal link with the loss are shown.
Payment institutions and intermediary service providers
The payment infrastructure’s transaction records are important evidence for identifying the suspicious transaction. Retaining these records and identifying the suspicious merchant and the fake order flow may be necessary. Data requests must be handled in line with the Personal Data Protection Law (KVKK), payment legislation and the procedure of the criminal investigation.
Applying to the criminal investigation and preserving evidence
A complaint to the Office of the Chief Public Prosecutor (Cumhuriyet Başsavcılığı) should include the account movements showing the payments, the fake contract, the URL, the telephone number, the user name, the communication with the account holder and the hotel’s confirmation. To verify digital evidence and to preserve IP/log records, bank account movements and internet infrastructure records, the necessary letters of request and examination requests to the investigating authority may come into play. The victim’s sensitive personal data should not be carried into publicly accessible posts.
Yargıtay (Court of Cassation) 11th Criminal Chamber decision on tourism fraud
Court of Cassation 11th Criminal Chamber (Yargıtay 11. Ceza Dairesi), E.2022/10449, K.2024/13902, dated 25.11.2024
In a case in which booking fees for hotel reservations were taken through a company holding a travel agency licence, but some reservations were not made and some were not paid for, the Court of Cassation, proceeding from the finding that the defendant obtained an unjust benefit in the course of commercial activity, explained the significance of the characterization under TCK Article 158/1-h and ultimately upheld the judgment, apart from a critical remark. The decision does not create a general presumption that every failed tourism booking is an offence; deceit, intent and the established facts of the case are what matter. Full text: https://app.dejure.ai/dokuman/dedb366b-f160-462a-8281-28bcb0831a70
Court of Cassation 15th Criminal Chamber (Yargıtay 15. Ceza Dairesi), E.2017/36537, K.2021/6804, dated 09.06.2021
In a case in which a former employee sold holidays using another tour company’s form and no real booking existed, the Court of Cassation upheld the acquittal of one defendant and reversed the acquittal of the other defendant, who was said to have carried out the deceit personally. The decision is important because it shows the need to prove, person by person, the link to the bank account and the actual contribution to the deceptive communication. Full text: https://app.dejure.ai/dokuman/644d40d5-b362-4355-9468-767a35924d42
When are consumer law and a private-law action appropriate?
Where the real party to the contract is identifiable and a service commitment was made, a refund or compensation may be considered under Law No. 6502 and the liability provisions of the Turkish Code of Obligations (TBK). Where fraud was committed in the name of a company that does not actually exist, the proper defendant and the competent judicial authority differ. A claim for pecuniary and non-pecuniary damages based on tort by the person harmed by the offence, and the evidence in the criminal file, are assessed separately. The categorical advice “apply to the Consumer Arbitration Committee (Tüketici Hakem Heyeti) for every fake hotel” is wrong.
A criminal investigation and a claim for a refund do not replace each other
In an allegation of fraud, a complaint to the public prosecutor is important for investigating the perpetrator and the flow of money; but the mere opening of an investigation does not automatically secure a refund of the loss. Tort, unjust enrichment, contract and payment-service liability may be examined on separate legal bases in a specific case. The standing to be sued and the burden of proof are not the same for the natural person/company concerned and for the bank/payment institution. The asset-related measures in a criminal investigation and the conditions for precautionary attachment/injunction (ihtiyati haciz/tedbir) in a civil action are assessed separately; the same loss cannot be recovered twice.
Protecting the tourist’s identity and payment data
A passport photo, an identity document, a card number or a residence permit document may have been uploaded to the fake website. Measures such as renewing the bank card, changing passwords/session details, the suspicion of a second transaction and unauthorized account access should be considered. “Evidence” is not collected by circulating the leaked documents; the complaint is made through the proper procedure.
Preventive verification checklist
Before booking, the property’s official domain name should be searched for independently, the trade registry and the agency’s authorization status should be checked, the room should be confirmed with the genuine reception, the name on the account to be paid should be compared and no transaction should be made under pressure to “pay a deposit within a very short time”. The official records of TÜRSAB and the Ministry of Culture and Tourism can help the consumer in their review. The presence of a legal entity in an official record does not, on its own, verify a particular listing or IBAN.
Rights of a foreign tourist in Türkiye and applying from abroad
In fraud directed at persons operating in Türkiye, jurisdiction, the place of the offence, the payment account, the place where the perpetrator is located and the foreign element are significant. The translation of the complaint, a power of attorney issued abroad and the procedural requirements of the banks are handled separately. The tourist’s departure from Türkiye does not in itself remove the possibility of preserving evidence and pursuing legal action.
Related articles: No Room at the Hotel (Overbooking): A Tourist's Rights to Equivalent Accommodation and Compensation After a Confirmed Reservation
Conclusion
In a fake booking, the first aim is to preserve the money trail and the digital evidence before they disappear. Next, the existence of a real contract, the deceptive conduct, the liable natural person/company and the specific role of the bank/payment institution should be separated out. Presenting every booking dispute as fraud, and every fraud as an automatic bank refund, creates legal risk. A timely written notice to the bank and a comprehensive complaint file strengthen the possible routes to recovery.
Frequently Asked Questions
I made a bank transfer to a fake hotel website; will I definitely get my money back?
No. Notifying the bank without delay and applying to the public prosecutor’s office are important; a refund depends on the status of the transaction and on the evidence.
Is the hotel liable for a fake website that uses the real hotel’s name?
Not automatically. The hotel’s authority, knowledge, representation and fault must be examined in the specific case.
I paid by card; do I have a chargeback right?
A charge dispute may be possible depending on the card scheme and the type of transaction, but the deadline and acceptance are not automatic.
If no booking was made, is there always the offence of fraud?
No. The elements of initial deceit, intent, misleading and unjust benefit are assessed; a mere breach of contract is not enough.
I saw a TÜRSAB certificate; can I trust the listing?
The authenticity of the certificate, and whether the listing was actually made by the company holding the certificate, must be verified independently.
Is it sufficient evidence that they sent a fake form with the company’s letterhead?
It is important evidence; it is assessed together with the sender’s identity, the payment account, the authority of the real company and the correspondence.
I shared a copy of my passport on a fake website; what should I do?
The risk of misuse of the personal data should be assessed and banking and identity security measures should be taken; where necessary, the competent authorities should be notified.
Can I start a complaint in Türkiye while I am abroad?
Yes, subject to examining the specific jurisdiction and representation requirements, it can be pursued through a lawyer.
Sources and legal bases
- Law No. 5237 Turkish Criminal Code (Türk Ceza Kanunu) Arts. 157–158; Law No. 5271 Code of Criminal Procedure (Ceza Muhakemesi Kanunu), relevant investigation and evidence provisions.
- Law No. 6502 on Consumer Protection (Tüketicinin Korunması Hakkında Kanun); Law No. 6098 Turkish Code of Obligations (Türk Borçlar Kanunu) Art. 49 et seq. and the provisions on breach of contract.
- Republic of Türkiye Ministry of Trade (T.C. Ticaret Bakanlığı), “Warning on Hotel Bookings Through Fake Websites” (Sahte İnternet Siteleri Üzerinden Otel Rezervasyonu Uyarısı), 10.08.2020. ticaret.gov.tr
- Republic of Türkiye Ministry of Trade (T.C. Ticaret Bakanlığı), “Fraud Attempts on Social Media and Digital Platforms” (Sosyal Medya ve Dijital Mecralardaki Dolandırıcılık Girişimleri), 29.07.2025. ticaret.gov.tr
- Court of Cassation 11th Criminal Chamber (Yargıtay 11. Ceza Dairesi), E.2022/10449, K.2024/13902, dated 25.11.2024, anonymized full text. app.dejure.ai
- Court of Cassation 15th Criminal Chamber (Yargıtay 15. Ceza Dairesi), E.2017/36537, K.2021/6804, dated 09.06.2021, anonymized full text. app.dejure.ai