Internet Fraud in Türkiye: Penalty Under TCK 158/1-f (2026)

Internet fraud, legally known as fraud committed through information systems, is regulated in Article 158/1-f of the Turkish Penal Code (TCK) as qualified fraud committed "by using information systems, banks or credit institutions as a tool". Fake online shops, second-hand listings, investment promises on social media and "profit" stories built in messaging groups are the most common forms of this offence. However, not every money loss connected with the internet falls under this provision. The Court of Cassation requires that the information system be used as a tool to deceive a person: where the offender himself withdraws money from an account whose password was captured, this is theft, and where the deception is carried out only by telephone, it is in many cases simple fraud. This article covers the penalty for internet fraud, the elements of Article 158/1-f, how it differs from TCK Articles 142/2-e, 244 and 245, the liability of a person who rents out an IBAN and Article 158/4, which entered into force in 2026, the competent court, the limitation period, complaint and mediation, and the routes open to victims. For the general framework of the process, our fraud lawyerTR page can also be consulted.

💻 What Is Internet Fraud (Fraud Through Information Systems)?

The basic offence in internet fraud is fraud under TCK Article 157: deceiving a person through fraudulent conduct and thereby obtaining a benefit for oneself or another to that person's or another's detriment. TCK Article 158/1-f treats the commission of this act by using information systems, banks or credit institutions as a tool as a qualified form. The elements of fraud through information systems can be summarised as follows:

• Fraudulent conduct: A deception skilful enough to remove the victim's ability to check, such as a fake website, a fake seller profile, an invented profit screen or a false identity.
• Deception of a person: The victim falls into error because of the deception and, of his own will, disposes of his assets (for example by sending money or entering card details).
• Information system as a tool: The deception is built through an information system such as a website, an application, social media or a listing platform, or the system makes the deception easier.
• Loss and benefit: A reduction in the victim's assets and an unjust benefit for the offender or another person; the act must be committed intentionally.

This sub-paragraph is shown in table form, together with the other qualified forms of the same article, in our qualified fraudTR article.

🧩 How Is "Using Information Systems as a Tool" Interpreted?

In the settled approach of the Court of Cassation on fraud through information systems, the information system itself cannot be deceived; Article 158/1-f requires that the system be used as a tool to deceive a person. In the wording repeated in the decisions of the 2nd Criminal Chamber, where "a benefit is obtained by using the information system without any deception", the act cannot be classified as fraud; it constitutes either theft by using information systems under TCK Article 142/2-e or the offence in TCK Article 244/4. This principle leads to three typical outcomes:

• Deception through a listing or website: The offender posts a listing on a website or sharing platform, the victim reaches him through that listing and sends the money himself. Because the information system facilitated the offence, Article 158/1-f applies. This criterion is expressly stated in the request for a reversal in the interest of the law that was accepted in the decision of the 11th Criminal Chamber of the Court of Cassation dated 22.06.2026.
• Deception carried out only by telephone: Where the victim was called directly by telephone and persuaded, the deception was not built through an information system and there is no other qualified form, the act may be simple fraud under TCK Article 157 even if the money was sent to a bank account (same decision). If the offender presented himself as a police officer, prosecutor or bank employee, TCK Article 158/1-l comes into play instead.
• Phishing and account takeover: The password is captured through a fake page that imitates a bank's website and the offender makes the money transfer himself. Because the victim was not deceived into sending money, the Court of Cassation treats this as theft by using information systems under TCK Article 142/2-e; obtaining the password and information by deception may also be assessed separately under TCK Article 136. For the dividing line, our articles fraud or theft?TR and the offence of violating personal dataTR go into more detail.

Using a bank or credit institution as a tool is covered by the same sub-paragraph; however, this form refers to turning the facilities offered by the bank into a means of deception. In the 22.06.2026 decision above, the act was treated as simple fraud even though the money was paid into the offender's bank account, which shows that merely sending money to a bank account is not regarded as sufficient on its own for this qualified form.

⚖️ Distinguishing Articles 158/1-f, 142/2-e, 244 and 245

In cases involving an alleged internet fraud that is connected with a card or an account, the legal classification changes the penalty and the possibility of mediation. A comparison according to the text of the articles:

For TCK Article 245/1 to apply, the card must have been obtained and used without the owner's consent; where the victim shared the card details himself after being deceived, the case is in most cases assessed as a whole as qualified fraud. The general framework of cybercrime is covered in our cybercrimes and penaltiesTR article.

🛒 Examples: Shopping, Listings, Social Media and Investment

• Fake online shop: Payment is taken through a site that imitates a real brand or does not exist at all, and no goods are sent. Because the deception is built through the site itself, this is the typical example of fraud through information systems.
• Second-hand and rental listings: A listing for a car, a home or a holiday house is posted on a listing site and a deposit is taken. The fact that the victim reached the offender through the listing shows that the information system was used as a tool.
• Investment through social media: In a relationship built through an advertisement or a messaging group, "profit" is shown on a fake trading panel and money is requested again and again in the name of investment and "tax/commission". These cases are mostly run with forex fraudTR, crypto or share promises; where there is an organised structure, the increase under TCK Article 158/3 and the offences under Capital Markets Law No. 6362 for operating without Capital Markets Board (SPK) authorisation are also assessed. A platform's authorisation can be checked with the method described in our SPK licence checkTR article; for crypto-asset cases, our crypto lawyerTR page is available.
• Task scams and job advertisements: Earnings are promised in return for likes, comments or order tasks; small payments are made first and larger amounts are then requested.
• Rented IBANs: In internet fraud, the victim's money is not sent directly to the fraudsters' own accounts but to the accounts of third parties who let their accounts be used for payment. The liability of these persons is dealt with separately below.

💳 Liability for Renting Out an IBAN and TCK 158/4 in 2026

A person who lets someone else use his bank account, card or internet banking details in return for payment in an internet fraud chain may be regarded as having participated in the offence if he knows that the account will be used for fraud. Court of Cassation practice points in this direction: in its decision dated 20.03.2024, the 11th Criminal Chamber upheld the conviction under TCK Articles 158/1-l and 158/3 of a defendant who claimed to have handed over his account cards in return for a commission, but who was held to have known that the money paid into his account was fraud money. The defence "someone else used my account" is assessed according to the ordinary course of life and the other evidence in the case.

TCK Article 158/4, added by Law No. 7589 and in force since 31.07.2026, introduced a new criterion into this picture. Under it, where participation in the offences in Article 157 or 158 is limited to giving another person the necessary information or tools that allow the use of payment instruments such as a bank or credit card belonging to oneself or another, or of an account held with a bank, an intermediary institution, a payment service provider or a crypto-asset service provider, with the aim of obtaining an unjust benefit, the penalty to be imposed is reduced by half. The main points are:

• The provision provides for a reduction, not impunity; the account holder must still have the intention to participate.
• Where the account holder made further contributions, such as meeting the victim or withdrawing the money and handing it to someone else, the condition for the reduction becomes debatable.
• Provisional Article 1 of Law No. 7589 provides for reversal in cases pending on appeal and, for convicts at the enforcement stage who have not benefited from TCK Article 168, an effective repentance possibility if the loss is fully made good within six months from the court's notice.

For a victim of fraud through information systems, identifying the person whose account was used matters for tracing the money and for requesting measures against the accounts concerned. The obligations of banks in this process are covered in our bank liability in investment fraudTR article.

📏 Penalty for Fraud Through Information Systems

For fraud through information systems, under the last sentence of TCK Article 158/1, sub-paragraph (f) carries a minimum prison sentence of four years and a maximum of ten years; the judicial fine cannot be less than twice the benefit obtained from the offence. The main provisions that change the penalty are:

• Committed with three or more persons / organisation: The penalty is increased by half / by one fold (TCK Article 158/3).
• Continuing offence: Where the offence is committed more than once against the same victim under the same decision, or against several persons with a single act, the penalty is increased by one quarter to three quarters (TCK Article 43).
• Effective repentance: If the loss is fully made good before the prosecution begins, the penalty is reduced by up to two thirds; if it is made good after the prosecution begins but before the judgment, by up to one half; in case of partial payment, the victim's consent is required (TCK Article 168).
• Attempt: Where the offence remains incomplete because the money has not left the victim's account, the penalty is reduced by one quarter to three quarters (TCK Article 35).

Deferral of the announcement of the judgment (HAGB) and suspension of the sentence can be discussed only if the penalty imposed after reductions is two years or less, and conversion into a judicial fine only if it is one year or less (CMK Article 231, TCK Articles 50-51). A detailed example of these calculations is given in our qualified fraud article.

🏢 Competent Court, Jurisdiction and Limitation Period in Internet Fraud

Competent court: The position has also changed for internet fraud cases; because Law No. 7571 removed qualified fraud from the list of offences within the jurisdiction of the heavy penal court in Article 12 of Law No. 5235, new cases are tried before the criminal court of first instance (asliye ceza). Cases that were filed before the heavy penal court before the amendment came into force, or that are at the appeal stage, are concluded under the old rules in accordance with provisional Article 7. The Constitutional Court did not find this amendment contrary to the Constitution in its decision Docket No. (E.) 2026/10, Decision No. (K.) 2026/111.

Jurisdiction: The rule is the court of the place where the offence was committed (CMK Article 12/1); however, under CMK Article 12/6, in offences where information systems, banks or credit institutions or cards were used as a tool, the courts of the victim's place of residence are also competent. This provision allows the victim to pursue the process where he lives in internet fraud cases where the offender is in another province or abroad.

Limitation period: For fraud through information systems, whose upper limit is ten years, the limitation period for prosecution is 15 years (TCK Article 66/1-d); with interrupting events such as a statement, arrest or indictment, it extends to a maximum of 22 years and 6 months (TCK Article 67/4). In a continuing offence, the period starts from the day the last offence was committed.

📣 Is a Complaint Required? Complaint Petition and Mediation

Fraud through information systems is not subject to a complaint; the prosecutor's office investigates it ex officio as soon as it learns of the offence. The six-month complaint period (TCK Article 73) does not apply, and the victim's later withdrawal of the complaint does not end the case. The exception is the situation in TCK Article 159, where the fraud is committed to collect a receivable arising from a legal relationship. Mediation is not possible either; CMK Article 253/1-b-8 brings only simple fraud under TCK Article 157 within the scope of mediation. For this reason, whether the act was built through an information system or only by telephone directly determines the possibility of mediation.

What does a complaint petition contain? Because, under CMK Article 158/6, a decision of non-prosecution may be given for abstract and general complaints, it matters in practice that the petition contains the following information in concrete terms:

• The website, listing, social media account or group link through which the first contact was made, and the user names,
• The date, time and amount of each payment, the sender and recipient account details and the receipts,
• Screenshots of the messages, listings and transaction screens, and the telephone numbers used,
• In crypto transfers, transaction IDs (TXID) and wallet addresses.

A sample text adapted to investment cases is available in our crypto fraud criminal complaint petitionTR article.

🧭 Routes for Victims and the 48-Hour Account Suspension

In internet fraud, time is decisive for tracing the money. The routes open to victims are, in outline, as follows; the first steps are also explained in our what to do after being defraudedTR article:

• Criminal complaint: Under CMK Article 158, a report or complaint may be made to the Chief Public Prosecutor's Office or to the law enforcement authorities (police, gendarmerie), in writing or orally to be recorded in a report. The Ministry of Justice's victim information page also shows these two points of application. The application points specific to crypto cases are covered in our where to report crypto fraudTR article.
• Notification to the bank and payment institution: Under CMK Article 128/A, added by Law No. 7571, where there is reasonable suspicion in the offences in TCK Articles 142/2-e, 158/1-f and l and 245, a bank, payment service provider or crypto-asset service provider may suspend the account used in the offence for up to forty-eight hours; the action is immediately notified to the Chief Public Prosecutor's Office. Within this period, the benefit in the account that is the subject of the offence may be seized by a judge's decision, or, where delay would be harmful, by the prosecutor's written order; if the seized value is found to belong to the victim, it is returned to its owner at the investigation or prosecution stage (Article 128/A-5). Details: 48-hour account suspension under CMK 128/A.
• Joining the case and appeal routes: The victim may join the public prosecution until the judgment is given (CMK Article 237). An objection to a decision of non-prosecution can be made to the criminal judgeship of peace within two weeks of notification (CMK Article 173). The period for appeal to the Regional Court of Appeal (istinaf) against a judgment is two weeks from notification of the reasoned decision (CMK Article 273/1); in an appeal petition concerning fraud through information systems, the objections stated expressly, such as the legal classification of the offence, the sub-paragraph applied and the calculation of the judicial fine, determine the scope of the review.
• Compensation for the loss: Separately from the criminal case, a compensation claim is available against the offenders and, where the conditions are met, against others who may be liable. The options are explained in our refund in forex fraudTR article.

🔍 Court of Cassation Decisions

1. Court of Cassation 2nd Criminal Chamber, Docket No. (E.) 2024/5233, Decision No. (K.) 2024/8532, 27.05.2024 – A transfer after phishing is theft

In a case that began as an alleged internet fraud, the victim had entered his user details and password on a fake page that looked exactly like the website of a payment institution, and money was then transferred from his account to the offender's account without his knowledge. Although the request for a reversal in the interest of the law argued that the act was qualified fraud under 158/1-f, the Chamber stated that the victim had not been deceived into making a money transfer, that the deception was aimed only at obtaining the password and details, and that the offender himself had made the transfer; it held that, if proven, the act was theft by using information systems under TCK Article 142/2-e and rejected the request. The decision also noted that obtaining the details by deception may constitute the offence in TCK Article 136.

2. Court of Cassation 11th Criminal Chamber, Docket No. (E.) 2026/539, Decision No. (K.) 2026/6800, 22.06.2026 – The difference between a listing and a telephone call

The victim, who was called by telephone with a job offer, had twice sent money to the defendant's bank account under the name of a "file fee". The Chamber accepted the request for a reversal in the interest of the law, which stated that fraud through information systems is accepted where information technology facilitates reaching the offender, as with a listing posted on a website or sharing platform, and that in this case contact had been made by telephone; it held that the act was simple fraud within the scope of mediation (TCK Article 157/1).

3. Court of Cassation 11th Criminal Chamber, Docket No. (E.) 2023/7128, Decision No. (K.) 2024/3851, 20.03.2024 – Liability of a person who let his account be used for a commission

The victim's account details were obtained by persons who presented themselves as calling from a bank's head office, and the victim's money was transferred to the defendants' accounts; one defendant was caught while trying to withdraw the money at a bank. The defendant, who claimed to have handed over his account cards in return for a commission, was held to have known that the money paid into his account was fraud money, and the convictions under TCK Articles 158/1-l and 158/3 were upheld. Because the case dates from before 2026, TCK Article 158/4 was not applied; in similar cases, the possibility of reduction under the new provision is assessed separately.

❓ Frequently Asked Questions

In frauds committed over the internet, whether the act is classified as 158/1-f, simple fraud or theft through information systems changes the penalty, the competent court and the possibility of mediation. For detailed information and legal support, you can contact Savun Law & Consultancy.