Criminal law · Legal information

What Is Internet Fraud? The Complaint and the Evidence

Published · 19 February 2026

In short

Internet fraud speaks of the fact of deceit plus information systems. Not every phishing falls into the same aggravated form. The aggravated list is in a separate article.

The IBAN, the screen, and the request for the IP or the log are the order of the evidence. A deleted chat weakens the proof.

A charge of a forged document sits in a separate cluster.

The integrity of digital evidence can lengthen the laboratory process in Ankara. It does not erase the offence.

What should be known?

Internet fraud covers the appearances in which the deceitful scheme is built through an online channel, a fake page, a fake listing, or messaging. Phishing, a fake advertisement, social commerce, and an urgent transfer to an IBAN are the often-searched parts of this heading. If the evidence is not gathered before the chat is deleted and before the account is emptied, the investigation becomes harder.

This text is general information. An application to CİMER or to the BTK does not take the place of the prosecution investigation. A refund of the money is not promised. The order of the IBAN and of the correspondence stands in the checklist of the IBAN and the correspondence.

Introduction: why are the first hours critical in digital fraud?

In online deception the perpetrator is often invisible, the account is short-lived, and the chat is deleted with a single click. The victim first focuses on saving the money. In that time the URL, the sender’s identity, and the receipt can scatter. From the point of view of criminal law, the actual material is this. The national frame also applies in cyber investigations in Ankara. A digital trace is lost more quickly than a paper document.

The elements do not break away from the trio of deceit, harm, and benefit in the article on the offence of fraud. The claims of money and of assets stand separately under the heading of the return of money in fraud. For the general frame, the criminal law page can be read. This article tells the digital appearance, the evidence, and the application channels in a practical order.

How is internet fraud defined?

It is not a technical slogan. It is the building of the classical elements of fraud with a digital tool. The perpetrator affects the will with a fake identity or a fake shopfront. Money or data is taken. Harm arises. Making the information system the tool of the deceit can also open the argument of an aggravated form. Separate information-system offences — unauthorised access, damage to the system, seizure of data — can be a side file. Not all of them are the same provision.

Phishing and the appearance of a fake institution

A message in the guise of cargo, a bank, PTT, tax, or social assistance produces urgency. When the link is clicked, a fake page opens. A password or card information is asked for. Sometimes only “tell the security code” is said. The code is in fact an approval mechanism. The screen, the full link address, and the sender’s identity should be kept. An early notice to the bank can increase the possibility that the account will be stopped. The result is still not guaranteed.

A second-hand car, a telephone, household goods, or a “limited stock” advertisement pulls the deposit forward. The delivery is postponed, a new cost appears, the account changes. A social-media shopfront gives confidence, because a photograph and a comment can be imitated. Not every bad seller is a fraudster. A claim that the goods did not exist from the start, that a fake cargo code was produced, or that the identity was stolen strengthens the criminal argument.

IBAN, cargo, and “my relative is in danger” setups

Sharing only an IBAN, avoiding a face-to-face delivery, and an offer of “transfer my money to another account, the commission stays with you” are patterns often seen. A lie that a family member was abducted, had an accident, or was taken into custody also produces a similar urgency. It is possible for the voice to be produced artificially. In this setup the evidence is the call record, the number, and the statement of the amount that was sent.

Whom does it concern?

People for whom the goods did not arrive, or a fake product arrived, in an online purchase
People whose account or card was used through phishing
People who sent a deposit over social media
People from whom urgent money was asked in the name of a relative
Suspects about whom it is claimed that a transaction was made with a fake account

A legal person can also be a victim, such as the company’s social-media account being taken over and payment being asked from customers. A person in the position of a suspect can claim that the account was taken over. That claim also requires evidence.

Complaint and evidence: step by step

The order below does not produce the same result in every file. It can help reduce the loss of the trace:

Make a notice to the bank or to the platform in the direction of stopping the payment and access channels.
Take a screen and a backup of the chat, the listing, the profile, and the URL without deleting them.
Gather the receipt, the IBAN, the recipient’s name, the hour, and the amount in a single list.
Keep the device, if possible, without formatting it.
Give a report or complaint petition to the law enforcement or to the prosecution.
Attach the evidence list to the petition. Submit a supplement for documents found later.
Use the CİMER or BTK channel separately and consciously, as an administrative notice.
Follow the investigation correspondence and the service.

These steps do not guarantee the return of the money. The purpose is that the event remain capable of proof.

The victim should not suppose, after making a notice to the bank, that “the transaction stopped, the file is finished.” The bank transaction is administrative. The prosecution investigation runs separately. The platform’s closing of the account produces a similar illusion. A closed account can make a request for the trace harder. For this reason the order of the notice and of the report is built with the risk of loss of the trace, not with anger. In the petition the place of the payment and the place of the application should be written separately.

For a person in the position of a suspect, the digital trace is also a material that cuts both ways. A claim of “my account was taken over” stays weak if it is not supported by the device, the IP, and the notice records. A formatted telephone does not strengthen this claim. A statement with counsel is a safer ground than reading the chat screen on its own.

The split of CİMER, the prosecution, and the BTK

The prosecution and the law enforcement are the actual address of the criminal investigation. CİMER is an administrative communication. It can make a direction. It does not take the place of the investigation. The BTK can open an argument of an administrative measure in a number, an SMS, or some online complaints. It is not the conviction of the perpetrator or the return of the money. Mixing the three channels produces the disappointment of “I did it, why is there no file?”

How does a screenshot help?

The date, the hour, the username, and the context of the conversation should be visible in the image. A single bubble, the sentence “send money,” may not show the identity of the other side. An official record request from the platform runs more soundly through the investigation authority. The victim’s asking the platform, on the victim’s own, to “close the account” can also close the trace. For this reason the order is important.

A screen taken in Çankaya, or in another district, does not lock the jurisdiction on its own. In a digital event the server, the account, and the payment intermediary can scatter to different places. This scatter does not make the evidence worthless. It requires writing the place information and the technical trace separately in the petition.

In a phishing file the main trace is often the link and the login page. The SMS header, the sender’s short code, and the browser address bar are more concrete than the account “the bank called.” The transactions made after the card information was entered appear on the bank statement. The chat sometimes does not exist at all.

In a fake advertisement, the identity of the listing that was clicked, the advertisement account, and the payment page are separate layers. In social commerce the profile, the story, the live-broadcast record, and the deposit correspondence should stand together. The sentence “everyone was shopping from this page” stays weak without the screen of that page. Comments can be imitated. For this reason a comment is not a trust document on its own.

In an IBAN setup the receipt is the backbone. The mismatch of the recipient’s name with the name in the chat is valuable for the characterisation. If there is a chain of “the commission stays with you, transfer the money to this account,” each account should be written on a separate line. A single receipt shows the middle of the chain. It may not show the beginning and the end.

Not using the BTK and CİMER as a list of legal advice

This article is not an administrative guide in the style of “fill in this form, tick this box.” The menus of the BTK and of similar institutions change. Their fields of authority are also updated. The distinction the reader needs to know is this: an administrative notice is not a substitute for a criminal report. A request that the number be closed, or that access to the site be blocked, does not automatically resolve the perpetrator’s identity and the place of the money. A CİMER record is not a document of “the state learned, so an action is now brought.” The actual investigation is on the line of the prosecution and the law enforcement.

Mistakes often made

Deleting the chat in anger, or blocking the account and losing the trace
Writing only to CİMER and not going to the prosecution
Being content with a cropped screenshot
Making “one more trial” to the same IBAN
Spreading the perpetrator’s photograph on social media for a lynching
Supposing that a bank notice and a criminal report are the same thing
Assuming that the return of the money will come automatically

Legal warning: in digital-fraud files the result depends on the existence of the traces and on the characterisation. This text is general information. It does not contain a promise of a definite return or of a conviction.

Legislation and institutions

The fraud and the aggravated forms in the Turkish Penal Code are often applied in files where the deceit was built with an information system. Separate information-system offences stand in other provisions. The Code of Criminal Procedure draws the procedure of the statement, the digital evidence, seizure, a decision of no grounds for prosecution, and the indictment. Imprisonment and/or a judicial fine are provided in the statutory frame. The current text of the provision should be checked.

Electronic communications and some content complaints can enter the field of administrative institutions. This field is not a substitute for the criminal trial. In applications in Ankara, jurisdiction can also be associated with more than one place because of the digital nature of the event. A definite place is not said without the concrete account and IP information.

Separate information-system offences and fraud can stand side by side. Unauthorised entry into an account is one argument. Asking for money through that account is another argument. Joining the two in a single sentence scatters both the complaint and the defence. Imprisonment and/or a judicial fine are provided in the statutory frame. The current text of the provision should be checked. A decision of no grounds for prosecution, or an indictment, takes shape according to whether the digital traces were found sufficient.

Conclusion: before the digital trace is deleted

Internet fraud is the building of the classical elements with an online tool. The first work is not to pour the anger onto social media. It is to fix the URL, the chat, the receipt, and the IBAN. CİMER and the BTK are administrative doors. The actual criminal report is at the prosecution and the law enforcement. The return of the money is a separate legal route, and it is not guaranteed.

This article is for general information. The assessment can change according to the features of the concrete event. The pages of criminal law, the offence of fraud, and the return of money in fraud offer an additional frame under the related headings.

How the digital record is separated

The screen record, the receipt, and the correspondence are read in the order in the complaint file, without being counted as the same evidence. The office address does not choose the competent authority. The application authority is understood from the unit in the record.

Conclusion

This article is for general information. The document, the time, and the procedure of the concrete event should be read separately. There is no promise of a result by heart.

Frequently asked questions

What is phishing, and which evidence should be kept?

Phishing is asking for a password, card information, or an approval code by appearing as a bank, a cargo service, a tax office, or a well-known platform. A fake link, a fake login page, or an urgent “your account will be closed” message is a typical appearance. The screenshot, the full URL, the sender’s number, the email header, the time stamp, and the SMS copy if there is one should be kept. The browser history and the payment notice are also useful. If a transaction was made after the account was taken over, a notice to the bank should also be made. The evidence can be lost with a chat that is deleted later. This article is general information. An examination of the concrete event is required.

How are a fake listing and social commerce assessed?

A second-hand sale, a social-media shopfront, or a setup of “send the deposit at once” is often seen. That the listing is fake, that the goods were never sent, or that a different product was sent can open the argument of deceit. Facts such as the profile having been opened newly, only an IBAN being shared, and avoidance of a face-to-face delivery are written on the evidence list. Not every dissatisfied purchase is fraud. Defective goods and consumer law are a separate route. The criminal dimension strengthens in a claim of a scheme of deception from the start. The listing screen, the correspondence, and the payment document should be kept together. The characterisation changes according to the concrete event.

Does the amount come back automatically when money is sent to an IBAN?

No. A transfer or an EFT often carries the appearance of a payment that cannot be taken back. The bank’s “recall” or a notice of a suspicious transaction can come onto the agenda in some cases. The result is not guaranteed. If the recipient’s account is at another bank, is abroad, or was emptied at once, a return becomes harder. A criminal investigation is not a mechanism for the return of money. The routes of private law and of enforcement run separately. An early notice can increase the possibility that the account will be frozen. A promise still cannot be given. The receipt and the IBAN information are the backbone of the file. The concrete bank practice can change.

Is a screenshot sufficient evidence on its own?

A screenshot is an important start. A single piece is not counted as sufficient in every file. The date, the hour, the username, the URL, and the whole of the conversation should be visible. A cropped image can give birth to a claim of montage. The platform, the account statement, the cargo tracking number, and a witness statement support the image. Keeping the original device can be useful for an expert examination. Taking a backup before deleting makes a later defence of “there is no chat” harder. The evidence list should be attached to the complaint petition. Sufficiency is at the discretion of the prosecution and of the court. An additional record may be required according to the nature of the concrete event.

Does an application to CİMER take the place of the prosecution?

CİMER is an administrative application channel. It does not take the place of the investigation of the public prosecutor’s office. A text conveyed through CİMER can be directed to the relevant institution. This is not the process of an indictment or of a decision of no grounds for prosecution. The actual criminal report or complaint should be made to the law enforcement or to the prosecution. The CİMER record can be kept as a document of “I had applied.” Copying the same text both to CİMER and to the prosecution can give birth to a confusion of follow-up. Time should not be lost before it is known what each channel is for. The concrete application procedure is planned according to the file. This distinction is especially important in digital events.

What is a complaint to the BTK useful for?

The Information and Communication Technologies Authority plays an administrative role in electronic communications and in some complaints about online content or a number. A notice relating to a number, an SMS, or a website can open an argument of an administrative measure. This does not mean the punishment of the perpetrator or the return of the money. An application to the BTK can be added to the evidence package of the prosecution file, but it does not take the place of the investigation. A technical notice and a legal report should not be confused. The current application screens and the fields of authority can change. This text is not a list of legal advice. It is for finding a general direction. The concrete channel is chosen according to the nature of the event.

Does the file drop if the fake account is closed?

The closing of the account does not mean that the traces have disappeared. Platform records, IP information, the payment intermediary, and the bank movement can be asked for through other channels. An early application can make it easier for the records to be asked for before they are deleted. Not every record is kept without a time limit. Delay carries a risk of loss of evidence. The file does not drop automatically with the closing of the account. Identifying the perpetrator is a separate investigation work. A decision of no grounds for prosecution can come onto the agenda if the identity cannot be identified or if the evidence is insufficient. That is not a definite acquittal either. The concrete state of the record is the basis. A backup of the evidence should still be kept.

Where is a report of internet fraud made in Ankara?

A report or a complaint can be made to a law-enforcement unit or to the competent chief public prosecutor’s office. Units that deal with cybercrime can come into play according to the nature of the file. A victim resident in Ankara can experience an argument of jurisdiction even if the transaction does not appear in the victim’s own province. The digital nature of the event complicates jurisdiction. An application that goes to the wrong unit is often directed onward. The receipt, the screen, and the identity information should be attached to the petition. An application in Çankaya can join with a server record in another province. The definite jurisdiction should not be said before the concrete place of the event and the account information are seen. The receipt document should be kept.

Author

Av. Ayşenur Konar

Lawyer on the Ankara Bar Association roll, founder of Konar Hukuk. This text is general information; a specific file is reviewed separately. Author profile · Editorial policy

A consultation

We can look at the matter with you. The path depends on the documents. This is not a promise about the result.

Write to us Call WhatsApp