Attorney Hüseyin Aydın · Alanya / Antalya
You go to sleep one night; when you wake up, hundreds of thousands of lira have been transferred from your bank account to a company you have never heard of, and products you have never seen have been bought with your credit card. You did not notice any confirmation message on your phone and you did not share any password with anyone. The bank, however, rejects your refund request, saying “the transaction was made with your password, from your device”.
Under Turkish law the picture is clear: banks are institutions of trust, they are liable even for slight negligence, and the burden of proving the customer’s fault lies with the bank. Nevertheless, in practice many banks do not voluntarily compensate losses caused by their own security weaknesses. Once the dispute goes to court, proceedings can last for years, the amount due is eroded by inflation in the meantime, and some victims give up on pursuing their rights. A victim whose credit card was misused, on the other hand, faces the debt, interest and enforcement proceedings for purchases they never made.
These complaints, which are increasing throughout Turkey including Alanya, Antalya and Gazipaşa, are examined in this guide in the light of the Bank Cards and Credit Cards Law No. 5464, the Turkish Code of Obligations No. 6098 (TBK), the Consumer Protection Law No. 6502 (TKHK) and the case law of the Court of Cassation (Yargıtay).
Table of Contents
- A Concrete Example
- Why Don’t Banks Compensate the Loss?
- Credit Card Victims: Debt, Interest, Credit Record and Enforcement
- Legal Framework: Liability and Burden of Proof Lie with the Bank
- Court of Cassation and Regional Court Decisions
- Banks’ Defences and Counter-Arguments
- What Should the Victim Do? A Step-by-Step Roadmap
1. A Concrete Example
Example: In this real case from practice, personal data have been removed and amounts rounded. One night between 02:45 and 05:45, a consumer is defrauded at two different banks. From the current account at the first bank, approximately TRY 170,000 is sent via mobile banking in two transfers to a company the consumer has never heard of. With the credit card of the second bank, approximately TRY 450,000 is spent in 11 separate online purchases from electronics retailers. In the morning, on noticing what happened, the consumer calls both banks, has the cards blocked, files a written objection the next day and lodges a criminal complaint with the Public Prosecutor’s Office.
| Channel | What happened? | Amount (approx.) | Bank’s position | Status one year later |
|---|---|---|---|---|
| Mobile banking (current account) | Two FAST transfers at 03:40 and 03:53 at night to an unknown company | TRY 170,000 | “Login was made with the password and registered device; we are not at fault.” The written objection was never answered. | The Consumer Arbitration Committee ruled for the consumer; instead of paying, the bank challenged the decision and had enforcement suspended. The court-appointed expert report also favours the consumer; payment has still not been made. |
| Credit card (online shopping) | Purchases of a games console, phones and headphones; payments via 3D Secure | TRY 450,000 | “The 3D Secure code was sent to the registered phone; keeping codes secret is the cardholder’s responsibility.” | About TRY 215,000 was refunded by the merchant because orders were cancelled; a lawsuit for the remaining approx. TRY 235,000 is pending. |
The criminal investigation revealed that the goods bought with the card were ordered in another person’s name and collected in person from a store hundreds of kilometres from the consumer’s city. The company account that received the transfers had been opened only five weeks before the incident, and the money was quickly dispersed to other accounts. The picture points to an organised fraud network.
What Did the Expert Panel Find?
A panel consisting of a banking expert and an IT expert combined the bank’s own records and reconstructed the chronology of the night:
| Time | What the records show |
|---|---|
| 02:45 | The credit card’s disabled online shopping permission is enabled via the app; a mobile banking session starts. |
| 02:46 – 02:47 | The bank’s fraud monitoring system automatically calls the registered line; the recorded answer: “this transaction is not mine”. |
| 03:40 and 03:53 | Because the account is not secured, two transfers go through (about one hour after the warning). |
| 03:00 – 05:30 | 3D Secure-approved purchases with the other bank’s card; codes are sent to the consumer’s line but used from different IP addresses. |
| 04:49 | This time a transfer attempt is blocked by the security system. |
| 04:53 | The bank’s security unit calls the line; the operator says on the recording “but your voice sounds like a woman’s”, yet the session is not terminated. |
| 02:45 – 07:30 | More than two dozen sessions in one night: about ten times normal usage. |
| 07:40 | The consumer calls the bank and reports having no knowledge of the transactions. |
The panel’s conclusion: the fact that the transactions appear to have been made with the customer’s device and password does not show that the customer made them; the records support that the device and the line were under the control of third parties that night. The bank detected the risk and warned the customer but did not prevent the loss; there is no technical basis in the file for attributing fault to the customer. Moreover, the bank submitted to the court a narrower extract of the records it had given to the prosecutor and never produced the audio recording of the critical call.
2. Why Don’t Banks Compensate the Loss? Time Works in the Bank’s Favour
Banks often do not pay voluntarily even when they know they are likely to lose, because not paying is economically cheaper than paying. This choice forces the consumer, who is in the right, to chase the claim for years.
- Objections are rejected with standard letters. In the example, one bank never replied to the written objection; the other, months later, rejected it with a template letter saying “keeping the code secret is the cardholder’s responsibility”, even though the merchant had already refunded part of the amount. Yet under Article 11 of Law No. 5464 the card issuer must reply within 20 days with reasons.
- Every lost stage is followed by an appeal to the next. When the Consumer Arbitration Committee ruled for the consumer, the bank did not pay; it challenged the decision before the consumer court and obtained an interim measure suspending enforcement. With first-instance proceedings, expert examination, appeal and cassation, such cases can take years to become final.
- Inflation erodes the claim. Even if the court finally finds against the bank, the bank as a rule pays the principal plus statutory interest. Since the statutory interest rate may lag behind inflation in periods of high inflation, the purchasing power of a payment made years later falls clearly below the value of the money on the day it left the account. Meanwhile, it is the bank that holds and uses the money.
- Litigation costs have a deterrent effect. The consumer must advance expert fees, court costs and legal fees. Many victims with relatively small losses cannot bear this burden and give up.
Tools Available to the Victim
- Start date of interest: Interest should be claimed from the transaction date on which the money left the account; starting it from the application or filing date increases the loss.
- Excess damage: Damage exceeding default interest may be claimed separately under TBK Art. 122 if the debtor is at fault. Since case law requires concrete proof, the inflation loss must be demonstrated with concrete data.
- Fast, low-cost routes: For claims below the monetary threshold, applying to the Consumer Arbitration Committee is free of charge and its decision is enforceable like a judgment. Complaints may also be filed with the BDDK (Banking Regulation and Supervision Agency) and the Customer Complaints Arbitration Committee of the Banks Association of Turkey.
- Early request for records: Requesting log, IP and SMS delivery records in writing at the objection stage prevents the bank from later submitting selected and incomplete records.
3. Credit Card Victims: Debt, Interest, Credit Record and Enforcement
A person whose account is emptied loses their money; a person whose credit card is misused is, on top of that, turned into the debtor of purchases they never made. When the bank rejects the objection, the charges appear on the statement as debt and the process unfolds as follows:
- Statement and interest: The charges are added to the period’s debt; contractual interest and, after the due date, default interest accrue on the unpaid part.
- Card blocking and credit record: If the minimum payment is not made, the card is blocked, the delay is reported to the credit bureau and the credit score drops. The victim may become unable to obtain a mortgage, car loan or new card because of purchases they never made.
- Termination of the account and enforcement: If the debt is not paid, the bank terminates the account, sends a formal notice and initiates enforcement proceedings, creating a risk of salary and bank account attachment.
At this point the victim faces a real dilemma: if they pay, they fear appearing to accept charges they never made and having to fight for years to recover the money; if they do not pay, they come under the pressure of interest, credit records and enforcement. The bank’s refusal to pay is the most effective way of shifting this pressure onto the consumer.
| Counter-measure | What it achieves | Points to note |
|---|---|---|
| Payment under reservation | Stops the burden of interest and negative credit records; the amount paid can later be reclaimed with interest through litigation. | The payment description, and a separate written notice, should state “with all objections reserved, not constituting an acknowledgement of debt”. |
| Lawsuit with a request for an interim measure | A request may be made to suspend interest, enforcement or negative credit reporting for the disputed charges. | The request must be stated clearly and with reasons in the statement of claim. |
| Action for negative declaratory judgment | A declaration is sought that no debt is owed for the disputed charges (Enforcement and Bankruptcy Law (İİK) Art. 72). | If enforcement has begun, the court may stop payment to the creditor against security. |
| Objection to the payment order | In enforcement without a judgment, an objection stops the proceedings; the bank must then seek annulment or removal of the objection (İİK Art. 62). | The deadline is 7 days from service of the payment order; missing it makes the enforcement final. |
4. Legal Framework: Liability and Burden of Proof Lie with the Bank
Deposits Lost Are the Bank’s Loss
A bank is obliged to return the money entrusted to it. Money leaving the account on an unauthorised instruction is, as a rule, the loss of the bank, not of the customer. As debtor, the bank must compensate the loss unless it proves that it bears no fault for the breach of contract (TBK Art. 112). If the customer is at fault, this can only be a ground for reducing compensation as contributory fault (TBK Art. 52), and the bank must prove it.
Banks Are Liable Even for Slight Negligence
According to the Court of Cassation, banks are institutions of trust established by special law and obliged to protect deposits carefully against fraud. They are therefore subject to a heightened objective duty of care and are liable even for their slightest fault. The care expected of a bank as a prudent merchant is stricter than that of an ordinary merchant and has increased further with internet banking.
Law No. 5464 Expressly Places the Burden of Proof on the Bank
- Art. 32/2: In a dispute between the card issuer and the cardholder, the card issuer bears the burden of proving that the transaction was recorded without error, posted to the account and that there was no technical deficiency or malfunction.
- Art. 32/1: In disputes arising from transactions made electronically by providing the card number, the burden of proof lies with the merchant.
- Art. 15 (last para.): The cardholder cannot be held liable for losses arising from unlawful use in purchases made via communication channels without a sales slip.
- Art. 33: Card issuers must exercise the necessary prudence and care.
- Art. 16: The cardholder, in turn, must keep passwords and codes secure and notify the issuer immediately upon learning of a transaction made against their will.
The BDDK Regulation Imposes a Duty to Prevent
Under the Regulation on Banks’ Information Systems and Electronic Banking Services, banks must use at least two-factor authentication; where a transaction is made without compliant authentication, the bank must prove that the customer made it (Art. 34). Banks must set up transaction monitoring mechanisms obliged not only to detect but also to prevent unusual and fraudulent transactions (Art. 36). Audit logs must be capable of producing reliable evidence (Art. 35); where the registered number is to be called, it must first be checked that the line has not been forwarded to another number (Art. 40).
Consumer Law: Defective Banking Service
Where the customer is a natural person, the dispute constitutes a defective banking service under the TKHK. For claims below the annually announced monetary threshold, the Consumer Arbitration Committee has jurisdiction; above it, the consumer court after mandatory mediation. Contract clauses such as “every transaction made with the password belongs to the customer and the bank has no duty to verify” do not remove the bank’s statutory duty of care and are subject to unfair terms review.
5. Court of Cassation and Regional Court Decisions
Settled case law places the loss on the bank unless the bank proves with concrete evidence that the password and code were obtained through the customer’s fault. The decisive point: if it is established that the customer personally handed the code to a third party, the outcome may be reversed.
| Decision | Essence |
|---|---|
| Yargıtay HGK, E. 2012/550, K. 2012/820 | Deposits withdrawn through irregular transactions are the bank’s loss; the bank is liable even for slight negligence. |
| Yargıtay 11. HD, E. 2022/4527, K. 2024/585, 24.01.2024 | The bank must keep its security infrastructure up to date against evolving fraud methods, detect unusual transactions and obtain customer confirmation. |
| Yargıtay 11. HD, E. 2012/5308, K. 2013/4684, 11.03.2013 | A bank lacking a security system able to notice 7 transactions made within a short time is at fault; a bank that cannot prove the password was obtained through customer negligence is liable. |
| Yargıtay 13. HD, E. 2012/17470, K. 2012/25579, 15.11.2012 | A bank that fails to secure its system against high-value transactions split into consecutive payments breaches its objective duty of care. |
| Yargıtay 11. HD, E. 2011/8143, K. 2012/15150, 04.10.2012 | SMS confirmation does not provide full security; a bank that leaves the safest method to the customer’s choice instead of making it mandatory is at fault. |
| Istanbul Regional Court 12. HD, E. 2025/1305, K. 2025/1393, 22.09.2025 | If it cannot be shown that the transactions were actually made through the 3D Secure infrastructure, the “3D Secure” defence does not relieve the bank of liability. |
| Yargıtay 11. HD, E. 2024/6085, K. 2025/3799, 28.05.2025 | Counter-example: Where it was undisputed that the claimant personally gave the passwords and codes to third parties, the claim was dismissed and the dismissal upheld. |
The last decision contains an important warning: statements such as “I read the code to someone on the phone who said he was a bank employee” directly determine the outcome. The facts must therefore be described carefully and accurately in the first application and statements.
6. Banks’ Defences and Counter-Arguments
| The bank’s defence | Counter-argument |
|---|---|
| “The transaction was made with the customer’s password and registered device; two-factor authentication was satisfied.” | The technical record does not show who made the transaction. Through remote access software, screen sharing or abuse of accessibility services, a device can come under a third party’s control. |
| “The 3D Secure code was sent to the registered phone; the transaction cannot be completed without it.” | Sending the code does not mean it reached the customer, was read, or was entered by the customer. In the example, the codes were entered from different IP addresses. The bank bears the burden of proving the code reached the customer (Law No. 5464 Art. 32). |
| “Under the contract, every instruction given with the password belongs to the customer.” | A bank cannot contract out of its statutory duty of care or gross negligence; in consumer contracts such clauses are subject to unfair terms review. |
| “The partial refund was made by the merchant; it is not an admission of fault.” | The cancellation and refund of some of the transactions made the same night by the same method is a strong indication that all of them were unauthorised. |
| “Our security system worked; we called the customer.” | If the system detected the risk but the transaction was not stopped, this is the strongest evidence against the bank. The regulation is not satisfied by detection and warning; it requires prevention. |
| “The criminal investigation should be awaited; the claim should be directed at the suspects.” | The bank’s contractual liability does not depend on the perpetrators being found. After paying, the bank can seek recourse against them. |
| “The customer is responsible for the security of the registered line.” | Checking whether the line has been forwarded before calling is the bank’s duty. In the example, the operator noticed the voice mismatch but did not stop the transactions. |
A procedural note: full production of the bank’s logs, call recordings and fraud scores should be requested; if they are not produced, it should be requested that adverse inferences be drawn against the bank under Article 220 of the Code of Civil Procedure (HMK).
7. What Should the Victim Do? A Step-by-Step Roadmap
Steps taken in the first hours both limit the loss and largely eliminate the “customer fault” argument in court.
- Call the bank immediately, block the card and digital channels and note the time of the call (Law No. 5464 Art. 16).
- Take screenshots and do not reset your phone. SMS messages, notifications, call history and installed apps are evidence; a factory reset makes forensic examination impossible.
- File a written objection with the bank. List each transaction with date, time and amount. For credit cards, the objection must be made within 10 days of the payment due date (Art. 11).
- File a criminal complaint with the Public Prosecutor’s Office. The prosecutor can obtain delivery records from stores, IP and log records from banks and the identity of recipient account holders.
- Follow up the bank’s response. The bank must reply with reasons within 20 days; if it rejects or does not reply, take legal action.
- Choose the right forum. The Consumer Arbitration Committee for claims below the monetary threshold; above it, mandatory mediation followed by the consumer court.
- In court, request all of the bank’s records and ask for an IT expert on the expert panel; the mobile operator should be asked whether call forwarding or a SIM change took place on the line.
- Manage the credit card debt. If the objection is rejected, one of payment under reservation, an interim measure or a negative declaratory action should be considered; silently not paying increases interest and negative credit records.
- If a payment order arrives, do not miss the 7-day deadline. File an objection with the enforcement office; the objection stops the proceedings.
Conclusion
Passwords, SMS codes and registered devices are the bank’s authentication tools; they are not proof that the customer made the transaction. As fraudsters develop ways of capturing these tools, the burden of prevention falls on the party best placed to see and manage the risk: the bank. The law is on the consumer’s side; the real problem is not being right, but obtaining one’s rights in time.
The example shows this clearly: the bank’s own system recorded the answer “this transaction is not mine” at night, yet the account was not secured and the money left within an hour. The arbitration committee and the expert panel found no fault attributable to the consumer; nevertheless, more than a year has passed and payment has still not been made. Where a security system detects the risk but does not stop the transaction, prompt reimbursement of the consumer, with the dispute being resolved afterwards, would put the burden where it belongs. Until then, victims must act quickly, preserve evidence, observe deadlines and manage their credit card debt consciously. With regard to your specific disputes and to avoid any loss of rights, it is advisable to seek professional legal advice from a lawyer specialised in the field.
Sources used: Bank Cards and Credit Cards Law No. 5464 Arts. 11, 15, 16, 32, 33; TBK No. 6098 Arts. 52, 112, 122; İİK No. 2004 Arts. 62, 72; HMK No. 6100 Art. 220; TKHK No. 6502; Regulation on Banks’ Information Systems and Electronic Banking Services Arts. 34-36, 40; Yargıtay HGK E. 2012/550 K. 2012/820; Yargıtay 11. HD E. 2022/4527 K. 2024/585; E. 2012/5308 K. 2013/4684; E. 2011/8143 K. 2012/15150; E. 2024/6085 K. 2025/3799; Yargıtay 13. HD E. 2012/17470 K. 2012/25579; Istanbul Regional Court 12. HD E. 2025/1305 K. 2025/1393. For legislation texts: mevzuat.gov.tr.
Legal Notice: This text has been prepared for general information purposes only and does not constitute legal advice. sophoshukuk.com makes no referral, guarantee or promise of outcome. Each case must be assessed on its own particular circumstances; for your specific dispute, please obtain professional advice from a lawyer.