Cybercrime

Cybercrimes refer to offenses committed against information systems such as computers, phones, servers and internet accounts, or committed through those systems. Taking over a social media account, sharing personal data without permission, making purchases with credit card details, or launching an attack on a company's servers all fall within this scope. In a field where technical evidence can disappear quickly, working with a cybercrime lawyer at an early stage helps ensure the process is handled properly, whether you are the victim or the suspect.

On this page, we explain the main cybercrimes under the Turkish Penal Code, how digital evidence is collected, the complaint process, and the points to watch for in a defense.

Main Cybercrimes Under the Turkish Penal Code

The section of the Turkish Penal Code (TCK) on Crimes in the Field of Informatics regulates three main types of offenses:

Accessing an information system (TCK Art. 243)

A person who unlawfully accesses an information system or continues to remain in it is punished under TCK Art. 243/1 with imprisonment of up to one year or a judicial fine. If the data in the system is destroyed or altered as a result of this access, the penalty is imprisonment from six months to two years. Monitoring data transfers within a system or between systems by technical means requires imprisonment from one to three years under TCK Art. 243/4.

Blocking or disrupting a system, destroying or altering data (TCK Art. 244)

A person who blocks or disrupts the operation of an information system is punished under TCK Art. 244/1 with imprisonment from one to five years. A person who corrupts, destroys, alters or makes inaccessible the data in a system, or places data into the system, is punished under TCK Art. 244/2 with imprisonment from six months to three years. The penalty is increased if the act is committed against the system of a bank, credit institution or public institution.

Misuse of bank or credit cards (TCK Art. 245)

A person who obtains and uses another person's bank or credit card in any way and thereby gains a benefit for themselves or for another is punished under TCK Art. 245/1 with imprisonment from three to six years and a judicial fine of up to five thousand days. Producing and using counterfeit cards is also regulated as a separate offense. In addition, TCK Art. 245/A punishes a person who manufactures, sells or possesses devices, programs or passwords made exclusively for committing cybercrimes with imprisonment from one to three years and a judicial fine of up to five thousand days.

Other Crimes Committed Through Information Systems

Information systems have become a means of committing many traditional crimes. Common examples in practice include:

• Unlawfully disclosing or obtaining personal data: Requires imprisonment from two to four years under TCK Art. 136.
• Violation of the privacy of private life: Sharing photos, videos or audio recordings without consent is assessed under TCK Art. 134.
• Violation of the confidentiality of communications: Reading or disclosing another person's messages without permission may constitute an offense under TCK Art. 132.
• Aggravated fraud: Deceptions carried out through online listings and fake websites mostly fall within this category; for details, see our fraud offense page.
• Insult and threats on social media: For these offenses committed through messages or posts, publicity and the identification of the person targeted are of particular importance.

Collecting and Preserving Digital Evidence

In cybercrimes, evidence most often consists of screenshots, log records, IP information, bank transaction statements and device contents. Because this evidence can easily be deleted or altered, both the victim and the investigating authorities need to act quickly. For the victim, the following steps are important:

1. Saving posts, messages and profile information together with their dates and link addresses
2. Notifying the bank immediately in the case of banking transactions and keeping receipts
3. Using the platform's account recovery and reporting channels for compromised accounts
4. Not resetting the device and not deleting suspicious files

For the suspect, under CMK Art. 134, searching and copying computers and files may be carried out by a judge's order, or, in cases where delay would be harmful, by order of the public prosecutor; the prosecutor's order is submitted for the judge's approval within twenty-four hours. During seizure, a backup of all data in the system is taken, and a copy of this backup is made and given to the suspect or their counsel. Whether the imaging process was carried out in accordance with proper procedure is one of the technical issues that the defense must examine.

Complaint and Investigation Process

The victim may file a complaint with the Chief Public Prosecutor's Office, either directly or through law enforcement. The complaint petition should clearly state the date of the incident, the account names used, link addresses and the evidence at hand. To identify the perpetrators, the prosecutor's office requests information from internet service providers, social media platforms and banks. Obtaining information from platforms located abroad may take time, which can affect the duration of the investigation.

Some crimes committed through information systems, such as violations of the confidentiality of communications and of the privacy of private life, are subject to a complaint. For these crimes, if no complaint is filed within six months from the date the act and the perpetrator became known, no investigation can be conducted. Which crime requires a complaint varies depending on how the incident is classified. Requests such as removing content or blocking access may be assessed separately under Law No. 5651.

Defense for Suspects and Defendants

The most common defense issue in cybercrime allegations is who actually committed the act. The fact that an IP address or account belongs to a person does not, by itself, prove that the person carried out that action personally. Shared networks, compromised devices and fake accounts must be taken into account in this assessment. The scope, method and conclusions of technical expert reports must be examined in detail, and the report must be challenged where necessary. In data leak allegations against company employees, it must also be separately assessed which data the person accessed and with what authorizations, whether the access fell within their job description, and the integrity of internal company records. For the general course of investigations and prosecutions, you may also take a look at our Criminal Law page.

Our Firm's Support

We provide support in cybercrime cases with victim representation, preparing complaint petitions, evidence preservation requests, and defense counsel for suspects or defendants. Every case is unique; it would not be right to make predictions about the outcome without concretely examining the technical evidence and the circumstances of the incident.