How is an unauthorized card transaction distinguished from a payment dispute?
The cardholder never approved the transaction
Physical theft of the card, copying of card details, a payment made online without the cardholder's knowledge, an unauthorized cash withdrawal from an ATM, or money leaving the account although no transaction was made with the merchant may give rise to a claim of an unauthorized payment. The appearance of a payment on the account statement does not, on its own, prove that the transaction was lawfully approved by the genuine cardholder. The bank's transaction records, the authentication method used, and device and session information must be examined.
An authorized but defective or wrongly priced payment
A tourist who pays of their own volition at a hotel, restaurant or tour sales point and is later dissatisfied with the service has not always made an unauthorized payment. Withdrawal of a wrong amount, a double charge, failure to refund despite a promise to do so, an unreleased deposit and a service that does not conform to the contract are separate consumer or payment disputes. Accordingly, in the dispute lodged with the bank, the claims "I did not approve the transaction", "the amount was different", "the service was not provided" and "no refund was made" must be chosen to match the actual facts; no untrue statement that the transaction was unauthorized should be made.
Different evidence for POS and ATM
For a POS transaction, the merchant agreement, terminal ID, merchant, payment slip, authorization, card read mode and transaction time are examined. For an ATM transaction, the device ID, the cash dispensing record, the relevant cameras, whether the card was used by contact or contactless, and PIN verification may matter. A private individual does not always have direct access to the raw footage of ATM cameras; a preservation request should be addressed to the relevant institutions and, where necessary, to the judicial authorities.
What should be done in the first hours?
Blocking the card and reporting through a secure channel
The card should be blocked through the issuing bank's official mobile app, call centre or another secure channel and, where necessary, additional protection should be requested for the account and digital payment tokens. No password, CVV or one-time code should be entered on links received by phone or message whose origin with the bank cannot be verified. The date and time of the report, the reference number, a summary of the call and the types of transaction for which the card was closed should be recorded. Blocking the card does not always remove the need for a separate dispute of the spend for a suspicious transaction that has already taken place.
A written dispute to the bank
The dispute should be made with the date and amount of the transaction, the currency, the merchant or ATM ID, the statement entry, where the tourist was at the time of the transaction, a statement that they did not give approval, and the available evidence. Where there is more than one suspicious transaction, each is placed on a list. The bank may be asked for transaction documents, authentication records, risk alerts, the relevant explanations of the payment service provider and the outcome of its assessment. Once it becomes clear that the transaction is suspicious, unnecessary delay increases the risk of losing the right.
Reporting to the police, the gendarmerie or the Chief Public Prosecutor's Office
Where theft or cloning of the card, a fake POS terminal, social engineering or organized fraud is suspected, application may be made to the police or the gendarmerie, or to the public prosecutor's office. A payment dispute with the bank and a criminal investigation do not replace one another. In the criminal application, the real course of events, the place and time, the person's intent, messages, the merchant's address, preservation of camera footage and, if any, details of fake links should be provided.
Law No. 5464 Art. 12: liability in the case of lost and stolen cards
The 24 hours before notification and the statutory monetary limit
Article 12 of Law No. 5464 on Bank Cards and Credit Cards (Banka Kartları ve Kredi Kartları Kanunu) provides that, where the card or the information referred to in Article 16 is lost or stolen, the cardholder bears liability limited to TRY 150 for loss arising from unlawful use in the 24 hours before the notification. The exceptions set out in the Law, and whether the transaction claimed actually falls within this regime, must be examined. This limit does not mean unconditional automatic refunds for every kind of internet fraud, every payment and cards issued in all countries.
Gross negligence, intent and failure to give notification
Where the unlawful use is based on the cardholder's gross negligence or intent, or where the notification required by the Law has not been made, the liability limit in Article 12 does not apply. The mere fact that a password or one-time code was entered in the system does not mean that gross negligence has been proven in the case as a whole. The way in which the transaction was authorized, interference such as phishing or a SIM swap, the bank's security measures and the customer's conduct are each examined separately.
Physical loss of the card and capture of card data
The card may still be in the cardholder's possession while the online card number, expiry date and security code have been learned by someone else. In that case, the claim cannot be rejected on the sole ground that the card is physically with the customer, without establishing that the card data was captured, which payment instrument was used, whether the transaction involved a security check, and which payment legislation applies.
Transactions after notification
If a transaction is made with the card even though the loss/theft notification has been received, the time at which the block took effect, the bank's notification record, the time at which the transaction was authorized and the technical channel through which the later transaction passed are separate subjects of examination. The date on which the transaction is booked and the date on which the card was actually used may not be the same.
Unauthorized transactions under the CBRT payment services regime
Regulation Art. 54: notification without delay and the 13-month correction period
Article 54 of the CBRT's Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers (Ödeme Hizmetleri ve Elektronik Para İhracı ile Ödeme Hizmeti Sağlayıcıları Hakkında Yönetmelik) provides that, in the relevant scope, the customer must report without delay a transaction that was not authorized or was executed incorrectly once they learn of it, and must in any event seek correction within 13 months of the date of the transaction. A special exception applies where the service provider has not given the customer the information specified in the regulation. These 13 months do not mean that notifying the bank may be postponed for 13 months; the rule of notification without delay applies separately. Whether the relevant provision is actually applicable to the card type, the transaction and the institution is examined.
Proving approval, recording and technical security
Under the same Article 54 of the Regulation, where it is alleged that a payment transaction was not authorized or was not correctly executed, the burden of proving that the transaction was approved by the customer, was correctly recorded and posted to the accounts, and was not affected by a technical fault lies with the payment service provider. This does not mean that the bank can never be relieved of liability, or that every dispute by the customer will be accepted automatically; the other obligations and exceptions in the legislation and the concrete evidence are assessed together.
3D Secure, contactless payment and security records
A one-time password, mobile approval, biometric verification, device pairing, the contactless limit and a risky-transaction alert are items of evidence that depend on the nature of the payment system used. The approach that "3D Secure was used, so the transaction certainly belongs to the cardholder" is no substitute for technical and legal examination. The reliability of the bank and payment provider records, possible fake redirection, a change of trusted device and the cardholder's real intent must be reviewed.
Liability among the issuing bank, the merchant and the payment institution
The issuing bank's duty of security and care
The bank that issued the card is assessed within the framework of its own legal obligations as regards management of the payment account, authentication, transaction monitoring and customer notifications. The merchant at which the POS terminal in Türkiye is located and the card's issuer abroad are not the same company. The fact that the card was used in Türkiye does not mean that the Turkish consumer remedies regime applies unconditionally to the liability of every foreign bank. The law governing the card agreement, the bank's place of establishment, the role of service providers in Türkiye and the relevant card scheme rules must be established.
The merchant and the entity providing the POS service
The merchant may have misled the customer, sold a service that did not actually exist, altered the amount, created a fictitious sales record or let another person use the POS terminal. However, the merchant's liability depends on its specific conduct and legal relationship. The fact that a POS transaction appears under a merchant's name alone should not be taken as a claim that every unauthorized use of the card is that merchant's deliberate fraud. The terminal, the slip, the merchant's cameras and the transaction description are compared.
Dispute through the card scheme and chargeback
International card schemes may provide a chargeback mechanism. This is a special process in which the card issuer disputes the relevant transaction within the scope of the scheme's operating rules; it is not a general legal remedy that gives all disputes the same time limit or a guaranteed refund. The type of card, the conditions applicable in the bank's country, the reason code for the transaction and the application dates are checked. Initiating a chargeback does not mean that all rights in a criminal complaint or a consumer action come to an end.
How do the Court of Cassation decisions assess the bank's liability?
Court of Cassation 13th Civil Chamber, E.2014/1527, K.2014/17575
In the decision dated 04.06.2014, a declaration was sought that the cardholder did not owe the internet spending they stated they had not made, and the court of first instance upheld the action because the bank had not taken the necessary security measures. The Court of Cassation (Yargıtay), however, quashed the decision, treating as an incomplete examination a ruling reached solely on the basis of an abstract expert opinion, without comparing the cardholder's duty to protect their information and the bank's duty of care with the concrete technical and payment records. The importance of this decision is not that the bank is not liable in every case, but that the technical proof and the conduct of the parties must be examined together.
Court of Cassation 11th Civil Chamber, E.2023/3330, K.2024/5094
In the relevant passages accessed of the decision dated 24.06.2024, the bank's security systems and the customer's responsibility for account and device security were discussed in respect of unauthorized transactions through internet and mobile banking channels. Applying this decision to a current dispute requires comparing the decision with its full operative part and reasoning, the payment channel used and the concrete examination of fault. A defence put forward by a bank alone should not be presented as a definitive legal holding of the Court of Cassation.
Technical questions to be asked in the expert examination
Was the transaction made with the genuine card or with copied data; was it made over the internet while the card was in hand? Which security verification was used, to which device or line was the verification code sent, how did the bank's security and risk rules operate, and was the possibility of a fake merchant investigated? A single IP address or SMS record may not conclusively establish who the actual user of the device was. The expert examination must be based on the real technical records of the incident, cite its sources and be capable of review by the court.
Which provisions may come into play in a criminal investigation?
Distinguishing Article 245 of the Turkish Criminal Code from the fraud provisions
The use of another person's bank or credit card without consent may, depending on the nature of the incident, be assessed under Article 245 of the Turkish Criminal Code (TCK). In an allegation of fraud through a fake POS terminal, a deceptive sale or an information system, TCK Articles 157–158 and other special provisions may come into play. It is not correct to tie every card dispute to a single offence; the actual act and the intent of the perpetrator must be established. The fact that the customer has lodged a dispute of an unauthorized transaction with the bank does not mean that it has been established that an offence was committed.
The effect of a criminal investigation on the refund of payment
A complaint to the prosecutor's office does not mean that the bank will refund the money automatically. Conversely, the bank's position that "it will carry out no examination until the criminal file is concluded" cannot be accepted as legally correct in every transaction. The monetary dispute keeps its own notification and application regime; criminal evidence is requested in the relevant file when necessary.
Which avenue of application is used, and under what conditions?
First, apply to the card issuer
In the first application, the unauthorized nature or the error of the transaction is made concrete; a reasoned reply and confirmation of the records are requested from the bank. In a dispute with a foreign issuing bank, the bank's own country, the card scheme and the payment legislation are assessed separately. If a Turkish bank's card is involved, the CBRT regulations, Law No. 5464, Law No. 6502 and banking practice are examined together.
Banks Association of Türkiye Retail Customer Arbitration Committee
The committee within the Banks Association of Türkiye (TBB) is an avenue of application for natural persons who have a dispute with member banks over transactions of a retail nature; not every foreign bank or every commercial transaction is automatically within its scope. A written application to the bank is made first and a confirmation document is requested. According to the TBB's current statement, the bank's response period is generally 30 days, and 20 days for credit card applications; an extension of 10 days may apply under the conditions. The application deadline of 60 days after the response or the expiry of the period, and in every case the committee's limit of two years from the event, must also be observed. TBB arbitration is not a court; there are conditions of admissibility for parallel court proceedings and applications to the consumer arbitration committee over the same dispute.
Consumer arbitration committee and consumer court
If the dispute is a consumer transaction within the scope of Law No. 6502, the consumer arbitration committee (tüketici hakem heyeti) is considered for disputes below TRY 186,000 for 2026, and the consumer court (tüketici mahkemesi) route is considered, depending on the nature of the dispute, for disputes at or above that limit. Where necessary, mediation as a condition precedent to litigation under Article 73/A and its exceptions must be examined. The fact that a foreign card was merely used in Türkiye does not automatically bring the dispute within the jurisdiction of the Turkish consumer court. The parties and the applicable law must be determined.
Commercial disputes, international jurisdiction and alternative routes
If the card was used for a commercial activity, or if the parties to the action and the nature of the transaction do not establish a consumer relationship, the competent court and the mediation regime may differ. Because of the foreign element, the Law on Private International and Procedural Law (MÖHUK), a jurisdiction agreement, the foreign bank agreement, the currency and, where necessary, mandatory provisions applicable in Türkiye are examined separately. An application that preserves the time limit on one arbitration or court route does not automatically stop the time limits on every other channel.
Table of evidence and application by type of transaction
| Transaction | Priority evidence | Application or examination |
|---|---|---|
| POS with a stolen card | Loss report, slip, authorization, camera | Dispute to the bank, Law 5464 Art. 12 and a criminal application |
| Internet spending while the card is in hand | 3D Secure, device, session and transaction records | Examination of scope and proof under CBRT Art. 54 |
| Unauthorized ATM withdrawal | ATM transaction/cash records, time, camera | Bank; the prosecutor's office where necessary |
| The same payment charged twice | Statement, invoice, payment approval | Erroneous transaction and refund of the amount |
| A different amount at POS | Slip, price, menu, approval notification | Dispute of the amount and examination of the merchant |
| Charge without service being provided | Contract, reservation, correspondence | Consumer application or conditions for chargeback |
Conclusion
In unauthorized card transactions, the outcome does not follow from the payment having been executed in the bank's system; it follows from whether the transaction was legally authorized, the parties' duties of care, the reliability of the payment records and the right application regime. Delay in notification, whether the card was in fact lost or stolen, the difference between POS, ATM and internet transactions and the country of the card-issuing bank bear directly on rights and time limits. While securing the card, the tourist should at the same time preserve the evidence, and should pursue the bank application, chargeback, TBB/consumer proceedings and the criminal investigation as separate tracks.
Frequently Asked Questions
My card was not stolen but an unauthorized POS spend appears in Türkiye. Can I dispute it?
Yes. That the card is physically with you does not prove that you approved every transaction. The use of the card data, the authorization and the payment service records must be examined.
Is the bank certainly not liable if a 3D Secure code was entered?
No. Whether the verification reflected the real user's intent, the technical records, the method of fraud and the parties' responsibilities are examined in the specific case.
Does the TRY 150 limit apply to all fraudulent transactions?
No. Article 12 of Law No. 5464 is regulated under special conditions concerning the unlawful use of a lost or stolen card or of card information; the conditions of gross negligence/intent and of notification are important. For cards issued by foreign banks, the applicable law is examined separately.
What can I do if the bank rejects my dispute of the spend?
Depending on the type of card, the identity of the issuing bank, consumer status and the amount, a reasoned objection to the bank, the TBB committee, the consumer arbitration committee or the court and, where necessary, a criminal application may be considered.
Can I still dispute with the bank after 13 months?
Article 54 of the CBRT Regulation provides for a maximum 13-month period for requesting correction, and an exception, but notification without delay is required once the transaction becomes known. It should not be assumed that this provision will apply automatically to every card and every dispute.
Can an action be brought in Türkiye over a card issued in a foreign country?
A definitive answer cannot be given without examining the parties to the action, jurisdiction, the applicable law, the contract and the transaction's connection with Türkiye. That a POS terminal was used in Türkiye does not, on its own, resolve all the conditions.
Sources and legal bases
- Law No. 5464 on Bank Cards and Credit Cards (Banka Kartları ve Kredi Kartları Kanunu), Art. 11–12, 16. mevzuat.gov.tr
- Central Bank of the Republic of Türkiye (TCMB), Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers, in particular Art. 54. tcmb.gov.tr
- Banks Association of Türkiye (TBB), Retail Customer Arbitration Committee Application Information. tbb.org.tr
- Ministry of Trade of the Republic of Türkiye, 22.01.2026, Information on Consumer Arbitration Committees. ticaret.gov.tr
- Official Gazette (Resmî Gazete), 23.12.2025, Communiqué on the 2026 monetary limits of consumer arbitration committees. resmigazete.gov.tr
- Law No. 5237 Turkish Criminal Code, Art. 157, 158, 245. mevzuat.gov.tr
- Court of Cassation 13th Civil Chamber, 04.06.2014, E.2014/1527, K.2014/17575, unauthorized internet spending and incomplete technical examination. app.dejure.ai
- Court of Cassation 11th Civil Chamber, 24.06.2024, E.2023/3330, K.2024/5094, banking security and the parties' obligations. app.dejure.ai