Legal guide on payment made to a fake website, digital evidence, bank application and criminal investigation.
Fake site fraud is when a real brand, bank, public service, reservation business, or shopping platform is imitated, directing the user to make a payment or share card, password, and identification information. The steps taken in the first hours are important for recovering the loss and identifying the perpetrators; however, notifying the bank, filing a criminal complaint, and preserving evidence are not alternatives to each other.
Fake pages appearing as tourism reservations, vehicle rentals, housing, e-commerce, and shipping in Antalya and Manavgat can cause different types of victimization.Attorney Ahmet Emre ÇimenIt ensures that the case is examined from the way the connection develops to the payment chain, and that criminal investigation, bank application, and, when necessary, private law claims are carried out in a coordinated manner.
How Does a Fake Site Build Trust?
Imitation sites often use domain names, colors, product images, and payment screens that resemble the real institution. The user may be directed to the page through a search engine advertisement, social media post, SMS, QR code, or link in a messaging application. If the small typographical differences in the address bar, a different extension, or a very newly established domain go unnoticed, the page may be accepted as real.
Fraud may not consist solely of design. Limited time pressure, low price, the claim that the cargo is waiting, a message that there is a risk in the bank account, or the appearance of official payment aims to make the victim act quickly. In the next stage, card information, one-time code, internet banking password, or direct transfer may be requested. Legal assessment should clearly reveal which fraudulent behavior directed the victim to which transaction.
First Timeline: First Minute, First Day, Next Stage
In the first minutes
If card or bank information has been entered, the bank's official communication channel should be called; the card should be blocked, the account's security and the suspicious transaction should be reported. If the same password is used elsewhere, it should be changed from a secure device and any open sessions should be closed. If an application has been installed on the phone or computer, the device can be disconnected from the network; an urgent cleaning operation that would destroy evidence should not be performed.
Within the first day
The full address of the fake page, the redirecting advertisement or message, screenshots, phone number, correspondences, receipt, transaction reference, and recipient information should be preserved. The bank notification’s record number should be obtained, the report made to the platform should be kept, and a chronology should be prepared for the criminal complaint. Recording the URL and visible content before the site is closed can facilitate the investigation.
Next stage
Responses to applications should be followed up; new account activity, identity use, or unauthorized sessions on other platforms should be checked. Requests concerning the recipient chain should not be delayed since suspicious money transfers can be distributed to different accounts. If personal documents were shared, not only financial loss but also the risk of identity misuse should be evaluated.
How to Set Up an Evidence Matrix?
Data to be protected What can it show? Where can it be obtained?
Full URL and domain name Imitation page, redirection, and used infrastructure Browser history, message, and screenshot
Advertisement or profile link Method of reaching the victim and account relation Social media or search platform
Receipt and transaction reference Amount, time, recipient, and beginning of money flow Bank or payment institution
SMS and email header information Sending time, redirection, and technical source Device, email provider, operator
Session and device record Which device or connection was used to access the account Bank, platform, and technical review
It is helpful for the date-time and address to appear in the screenshot; however, the unedited original of the image should also be preserved. Forwarding the message to another phone alone may cause loss of certain metadata. If possible, the email should be preserved in its original form, and the description and recipient information on the receipt should not be altered.
According to What is the Legal Qualification Determined?
The use of a fake website as a fraudulent tool may, depending on the circumstances of the incident, bring up allegations of qualified fraud by using information systems along with banks or credit institutions as instruments. However, not every payment dispute constitutes fraud in criminal law. From the outset, fraudulent intent, misleading behavior, the victim's disposition due to this, and the gain obtained are examined together.
The use of card information, unauthorized access to an account, acquisition of personal data, fake documents, or trademark imitation can constitute separate crimes and legal liability. The method used by the perpetrator, how the data was obtained, and where the money was transferred affect the precise classification. In the same incident, there may be multiple suspects with different roles.
Does the Bank Automatically Refund the Money for an Application?
It is important to report a suspicious transaction to the bank quickly; however, not every transaction is automatically refunded. The technical and contractual processes differ for card payments, wire transfers, FAST transactions, electronic money, or cryptocurrency transfers. How the transaction is verified, which information the consumer shares, the timing of the notification, and the status of the money in the receiving account are all considered.
Bank applications should be made in a way that leaves a written record; transaction disputes, card security, and notifications regarding the recipient account should be kept separate. Filing a criminal complaint does not resolve the bank dispute by itself, nor does applying to the bank replace a judicial investigation. Depending on the specific case, options regarding the consumer arbitration committee, consumer court, or courts with general jurisdiction can be examined separately.
Investigation of Domain Name, Platform, and Money Trail
The registration and hosting information of the fake site, IP records, advertising account, phone line, and payment infrastructure may require writing to different institutions during the investigation. Some data may be stored abroad or kept for a short period. Therefore, in the application, it is useful not just to say "I want the suspect to be identified" but to specify the connections and records that need to be preserved.
The owner of the account to which the money was sent may not always be the person managing the organization. Those who let someone else use their account, people involved in withdrawing or transferring money to another account, and those managing the fake site can take on different roles. Account ownership, intent, and active contribution should be investigated together; a definite perpetrator cannot be concluded solely based on name similarity or account registration.
If Card, Identity, and Password Information Has Been Shared
If the card number has been shared along with a verification code or banking password, security measures should not be limited to the related card only. The email account, phone line, mobile banking, and other platforms using the same password should be checked. If there is suspicion of unauthorized SIM transactions or remote access applications, operator and device security should also be addressed.
If an identity photo, address, or other personal documents have been provided, monitoring may be required in terms of fake accounts, loan applications, line openings, or new fraud scenarios. Applications that the person can make to data controllers and requests in a criminal investigation serve different purposes. Searching for the perpetrator by randomly sharing the data online may further endanger the victim's own privacy.
What Should Be Included in a Complaint Petition?
The petition should be chronological and verifiable rather than a long account filled with technical terms. It should clearly state how the fake connection was seen, which security element was used, with whom and through which account the communication took place, when and how much payment was made, and what happened afterward. Known URLs, phone numbers, usernames, IBANs, transaction numbers, and device information can be provided as an attachment list.
The platform, bank, and communication records to be requested should be clarified in terms of their relevance to the incident. Detection of site content, money movements, account opening documents, login logs, and related digital materials may gain importance according to the file. Adding information about unrelated individuals found online as suspects may mislead the investigation and violate personal rights.
The Relationship Between Compensation for Damages and the Criminal File
The purpose of a criminal investigation is to determine the crime and the perpetrator; the damage may not physically return in every case during the investigation. Seizure or protective measures depend on legal conditions and existing assets. Compensation and claim procedures against the perpetrator or other legally responsible persons or organizations can arise separately from the criminal file.
Decisions should not be made in cases of withdrawing a complaint, offering a settlement, or partial payment without examining the nature of the crime and the scope of the document made. New people who say they will close the fake site or definitely return the money may also attempt a second fraud. Communications with official institutions and banks should be conducted through verified channels.
Legal Support for Fake Website Fraud in Antalya
Attorney Ahmet Emre Çimen, In the fake website fraud cases in Antalya and Manavgat, it combines fraudulent pages, contact accounts, payment, and device records into a single chronology. It conducts case-specific tracking so that applications to banks and platforms do not conflict with requests in the criminal investigation, and so that personal data and compensation aspects are not overlooked.
No guarantee can be given in advance regarding the recovery of money or identification of the perpetrator. The outcome; varies depending on the payment method, preservation of evidence, accessibility of records, role of suspects, and the assessment of the competent authorities. Early and regular application helps in the effective use of available opportunities.
Frequently Asked Questions
I made a payment to a fake website, what should I do first?
Immediately notify the bank or the official channel of the payment institution, ensure the security of your account, and keep the URL, correspondence, and receipt with transaction information without altering them.
If I notify the bank, will the money definitely be refunded?
No. Refunds are assessed based on factors such as payment type, verification method, timing of notification, and money movements.
Where should a fake website be reported?
Suspicion of a crime can be reported to the public prosecutor's office or law enforcement. Security notifications to the platform, the bank, and the relevant service provider are also carried out separately.
Is just a screenshot sufficient?
It is useful evidence; however, in most cases, full URL, the original message, receipt, platform and bank records are required for support.
Is it certain that the IBAN owner is the perpetrator?
No. Account ownership is an important piece of information, but who actually used the account and with what intent is investigated with other evidence.
I sent my ID photo to a fake website, what should I do?
Document the incident, increase the security of your accounts, and consider applications to the relevant authorities according to the risk of misuse of your identity information.
If the site is closed, can a complaint be filed?
Yes. Investigation can be conducted through stored URL, correspondence, payment, and device records; however, it is important not to delay due to the possibility of records being deleted over time.