Gold Account Fraud: Bank Liability and 20% Fault Reduction

An investor who holds gold in a precious metals account receives a call one afternoon from someone who says he is from the bank's security unit. The caller says the account has been hit by a "cyber attack" and that he will help cancel irregular instructions; the call lasts for hours. By evening, most of the gold in the account has been sold, the EFT and transfer limits have been raised, and the proceeds have been sent to unknown persons. In such a case, how are the bank's responsibility and the weight of the investor having shared the passwords sent to the phone to be balanced?
In its decision of 09.09.2026, Docket No. E.2025/7239, Decision No. K.2026/4461, the 11th Civil Chamber of the Court of Cassation (Yargıtay) unanimously upheld the ruling of the 20th Civil Chamber of the İzmir Regional Court of Appeal, which found the bank at fault but applied a 20% reduction because the investor had shared passwords, treating this as contributory fault. In the same decision, the Chamber also set aside the Regional Court of Appeal's supplementary decisions, which had rejected the appeal petitions on the ground of amount, using the monetary limit in force on the date of the decision: the date to be used for the finality threshold is the date the case was filed.
- A three-hour phone call and an emptied gold account
- The investor's claim, the bank's defence
- Consumer court: the bank fully at fault
- Regional Court of Appeal: 20% contributory fault
- Court of Cassation: supplementary decisions set aside, ruling upheld
- The filing-date rule for the finality threshold
- Frequently asked questions
📞 A three-hour phone call and an emptied gold account
The claimant held 444.40 grams of 995/1000 fine gold on deposit in a precious metals account at the defendant bank, referred to in the decision as the "gold age" account. In the section of the decision headed "Case and Legal Characterisation", the account is expressly characterised as an investment account.
According to the petition, events unfolded on 03.12.2021 as follows:
- At 15:18 the telephone number registered with the bank was called; the caller introduced himself as a bank official and asked whether a transfer order had been given from the account.
- When the claimant said he had given no such order, the call continued in the name of the "bank security unit"; the caller said that a cyber attack had hit the bank, that many accounts had been entered and that help would be given to cancel irregular instructions.
- An e-mail bearing the caller's name and the bank's logo was also sent to the claimant. The claimant passed on orally a password that arrived on his phone and was said to be "out of date", in order to have it cancelled.
- At 15:42, 16:05, 16:52 and 18:02, the gold in the account was sold in parts and moved to the deposit account; the EFT and transfer limits, which had been kept low, were raised to TRY 150,000.00 and TRY 200,000.00.
- On the same day five separate EFTs were made to one person and two separate transfers to another, and a total of TRY 344,500.00 left the account.
After learning of the incident, the claimant had a block placed on his accounts, and the matter was investigated by the Chief Public Prosecutor's Office. The case was filed on 09.02.2022 and heard before the İzmir 8th Consumer Court (2024/222 E.).
⚖️ The investor's claim, the bank's defence
The claimant argued that he had not shared his passwords with anyone, that he had taken the necessary precaution by keeping his limits low, that the bank had not informed him of high-value EFT and transfer orders, and that mobile banking transactions should not have been possible from a device other than the registered one. In his view, a bank that safeguards gold on deposit is obliged to make good the shortfall in the account in full. His claim was the return in kind of 444.40 grams of gold or, if that was not possible, payment of its Turkish lira value on the date of payment.
The bank relied on the following defences:
- The claimant failed to protect his passwords, card and SMS details; remote access to his mobile device was obtained.
- The claimant shared his identity and financial details, as well as the password enabling remote access, with persons who introduced themselves as bank employees.
- A conversation of nearly three hours with a customer representative runs against the ordinary course of life.
- Transaction notification messages and pre-transaction SMS verification codes were sent to the claimant's phone, and the security measures required by the regulations were provided.
🧾 Consumer court: the bank fully at fault
The İzmir 8th Consumer Court (2024/222 E., 2025/268 K.) upheld the claim. The findings that stand out in its reasoning are these:
- The bank's mobile application has no interface through which the customer can define two-factor verification settings.
- No security process was run when the claimant's mobile application was entered from another phone.
- A transfer to an account not shown as registered, to which no money had been sent before, did not put the bank on alert; no suspicious transaction confirmation message was sent to the registered number at the time of the transaction.
- The consumer's inability to intervene against third parties exploiting a security gap created by the bank cannot be regarded as fault.
Finding that the claimant had no contributory fault, the court ordered the return in kind of 444.40 grams of gold or, if that was not possible, collection of the amount calculated at the gram gold selling rate on the date of payment.
🔍 Regional Court of Appeal: 20% contributory fault
On the bank's appeal, the 20th Civil Chamber of the İzmir Regional Court of Appeal (2025/1095 E., 2025/1340 K.) upheld all of the findings on the bank's fault. The Chamber also noted that no malware was found on the phone examined in the investigation file and that no redirection to another phone had taken place.
The decisive difference lay in the claimant's own statements and the witness account. According to the Chamber, during the phone call with the fraudsters the claimant shared some of the passwords that arrived on his phone. This conduct did not remove the bank's fault, but it was a cause that contributed to the increase of the loss. For this reason, the Chamber, taking into account the way the incident occurred, applied at its discretion a 20% contributory fault reduction; it set aside the first-instance decision and partly upheld the claim.
The new ruling is the return in kind of 355.52 grams of gold (995/1000 fine) or, if that is not possible, collection of its value at the gram gold selling rate on the date of payment; the claim for the excess was rejected (355.52 grams is 80% of 444.40 grams). The contributory fault reduction rests on Article 52 of the Turkish Code of Obligations, which provides for a reduction where the injured party contributed to the occurrence or increase of the loss.
🏛️ Court of Cassation: supplementary decisions set aside, ruling upheld
Both parties appealed the ruling. By supplementary decisions of 03.11.2025 and November 2025, the Regional Court of Appeal rejected the appeal petitions on the ground of amount, applying the TRY 544,000.00 appeal threshold in force on the 2025 decision date. The parties appealed these supplementary decisions as well.
The Court of Cassation carried out its review in two stages:
- Supplementary decisions: Under additional Article 1/2 of the HMK, as amended by Article 20 of Law No. 7550, the amount at the date the case was filed is used when applying the monetary limits in Articles 341, 362 and 369. On the filing date, 09.02.2022, the appeal finality threshold was TRY 107,090.00; since the amount upheld was TRY 344,500.00, the supplementary decisions were set aside.
- Merits: It was stated that the Regional Court of Appeal's final decision on the merits contained no violation of the applicable rules of law and that there was no reason requiring the application of HMK Articles 369/1 and 371, and the decision was upheld under HMK Article 370/1.
The decision was given on 09.09.2026, as final and unanimously. Because, under Article 73/2 of Consumer Protection Law No. 6502, cases brought by consumers before consumer courts are exempt from court fees, the return of the appeal fees collected from the claimant on request was ordered.
📅 The filing-date rule for the finality threshold
The procedural side of the decision answers a question often met in investment account disputes. Once a case is filed, the proceedings can last for years; in that time the monetary limits rise every year by the revaluation rate. The rule introduced by Law No. 7550 made clear which year's figure determines the limit:
- For the limits on proof by documents in HMK Articles 200 and 201, the date on which the legal transaction was made,
- for the monetary limits in HMK Articles 341 (appeal on the facts and law), 362 (appeal on points of law) and 369 (hearing), the date on which the case was filed is used.
Had the decision date been used in this case, the limit would have been TRY 544,000.00 and the parties would not have had access to a cassation review. Once the TRY 107,090.00 limit at the filing date was applied, the route to cassation opened, although the result on the merits did not change.
On the merits, the message of the decision has two layers. First, the bank's failure to call the customer for confirmation in high-value and unusual transactions, its failure to run additional verification on a login from a new device and its failure to monitor transfers to accounts never used before were treated as fault. Second, the customer's sharing of the passwords that arrived on his phone with the callers did not release the bank from liability and was treated only as a ground for reducing the compensation. The decision on the fault ratio in internet bankingTR, which stresses that the distribution of fault in similar cases should be determined by expert examination, and the decision on the bank's liability in internet banking fraudTR, which deals with the bank's heightened duty of care, can be read together with it. The question of which court has jurisdiction over the unauthorised sale of a gold account is examined in the decision on jurisdiction in a gold account caseTR.
Another notable aspect of the decision is that the ruling was framed as return in kind. The claimant asked not for the Turkish lira equivalent but for the gold in his account to be returned by the gram; both the first-instance court and the Regional Court of Appeal framed the ruling in grams of gold, providing for the Turkish lira equivalent only as a secondary option where return in kind is not possible.
❓ Frequently asked questions
Can an investor who shared a password claim nothing from the bank?
Which shortcomings was the bank's fault based on?
Why was the ruling framed in grams of gold rather than Turkish lira?
Is the appeal threshold set by the decision date or the filing date?
For detailed information and legal support, you can contact Savun Law & Consultancy. Contact details are on the contact page; other decisions on investment account and banking disputes are collected on the Precedent DecisionsTR page.
This article is for general information; its content is compiled from the decision of the 11th Civil Chamber of the Court of Cassation published in the Court of Cassation decision search system. The Court of Cassation upheld the Regional Court of Appeal's decision on the merits without stating a separate principle; the assessments on the distribution of fault belong to the Regional Court of Appeal. In a dispute that looks similar, the outcome may differ according to the way the transactions were carried out, the nature of the information shared, the bank's security infrastructure, the investigation findings and the expert examination. Savun Law & Consultancy cannot be held responsible for any application, lawsuit or defence made on the basis of this article.

Questions & answers · Istanbul Bar Association 75235
Have a question about this topic? Ask our lawyer.
Write your question and Attorney Veli Savun will answer it on this page. You do not need to give your name.
Example questions — tap one and adapt it to your situation:
Answers are general information only; they do not create a lawyer–client relationship and are not legal advice on your specific case. All questions & answers →
This page is an English adaptation of our Turkish article Altın Hesabında Kusur İndirimi – Yargıtay 11. HD 2026/4461.
More from Investment Fraud & Crypto Law in Türkiye
- How to Recover Stolen Crypto in Türkiye: Tracing and Seizure
- Where to Report Crypto Fraud in Türkiye: Complaint Channels 2026
- SPK Complaint in Türkiye: Channels, Process and Limits
- Cash Handed to a Brokerage Employee: Court of Cassation 2022/820
- Can Investors Sue SPK for Forex Losses? Council of State Ruling
- Forex Robot Allegation: Istanbul Appeal Court Ruling 2025/1669