Türkiye

TÜİK, the national statistics office, published its first crime victimisation survey on 20 May 2026, covering the 12 months to September 2025. It gives three official estimates and does not combine them into one share of people hit by a scam. Bank fraud reached 2.32% of people aged 15 and over, and consumer fraud 2.82% of the same group. Cybercrime, which mixes cyberbullying, takeover of an email or social account, identity theft, malware and ransomware, reached 3.48% of internet users aged 15 and over. Bank fraud and consumer fraud together are 5.14%, about half the share expected from how widely mobile phones and fixed broadband are used, and below the international average. The gap is wide enough that these official estimates are not comparable with that expected share: they fit under-reporting, or questions that do not cover the whole range of scams.

The bank-fraud incidents show how people are reached. Of the last incidents, 50.0% were a card misused on the internet, 23.2% were money taken from the account, 8.5% were a card misused at a business, 6.1% were a cloned card, and 9.9% were some other method. Consumer fraud, in the survey's definition, is paying for goods or services that were not delivered or were not what was promised.

The money moves through cards and bank accounts. In the bank-fraud incidents in the victimisation survey, the largest share is a card used on the internet, then a withdrawal from the account, then use of the card at a business, then cloning. A cheque is rare, at 0.7% of last incidents. The Interbank Card Centre, BKM, runs a shared security layer called SİPER. By December 2025 it had 43 participants and had answered 3.1 billion queries, and BKM says it detects a fraud attempt in seconds and takes it out of the system. The same report describes KOLAS, the easy-address service on the central bank's instant payments: 48 institutions, 26 million customers and 35.9 million easy addresses, so a transfer can be sent to a label such as a phone number rather than an account number typed out.

From 31 July 2026 the criminal law covers the person who supplies the account. Law 7589 added a paragraph to the fraud offences: if someone's only part is to hand over a bank or credit card, or the information and tools needed to use an account at a bank, a brokerage, a payment firm or a crypto firm, so that they or someone else gains, they are still a participant and the court cuts the sentence by half. BKM's security committee pools what the member banks see. Its work includes getting ahead of rising losses on payments and of accounts used for fraud, and a separate strand, still being procured, aimed at losses from investment fraud.

Most of the last incidents cost the victim under 25,000 lira. For consumer fraud, 75.0% of victims were in that band, 7.9% lost 25,000 to 99,999 lira, 10.9% lost 100,000 lira or more, and 6.2% could not put a value on the loss. For bank fraud the same bands were 63.3%, 17.9%, 12.4% and 6.4%. The bands cover every victim of the last incident, reported or not. They record the value of that one incident, and the top band is open-ended, at 100,000 lira and over, so they do not give an average loss.

What is paid back is tied to the offender. Article 168 of the criminal code cuts the sentence by up to two thirds when the offender repays the victim in full before prosecution starts, and by up to half when the repayment comes after prosecution has started and before the sentence. Law 7589 lets people already sentenced, where the new account-handover rule would have applied and where they had not had this discount, use it if they repay in full within six months of a warning from the court. In large cases the prosecutors seize assets. On 21 April 2026 the gendarmerie, with MASAK, froze 66 properties, five vehicles and 25 bank accounts, valued together at 1.22 billion lira, in a case of aggravated fraud and illegal betting.

US$98.8m (TRY 3.9b) of it was returned to victims, 5.8% of the money lost.

In the victimisation survey, 43.3% of people whose last incident was bank fraud said they had told an official authority, and 26.9% of those whose last incident was consumer fraud said the same. The banking regulator counts a different stream. The BDDK received 231,664 applications in 2025, up from 178,108 in 2024 and from 228,334 in 2023. Applications it classed as fraud were 17,602, 7.6% of the 2025 total, against 19,411 and 10.9% in 2024 on the same new headings. Bank and credit card applications were 26,537, 11.5%, against 12,599 and 7.1%. The regulator says the 2024 topic split in this report was rebuilt on the 2025 headings, so it differs from the split in the 2024 report, and it links part of the rise in all applications to its 10 July 2025 decision on restructuring card debt and consumer loans.

Most applications arrive through the Presidency's communication centre, CİMER: 139,637 in 2025, 60% of the total. The regulator's own channels, its online complaint form, written petitions and its call centre, brought 92,027, and the online form alone was 81,267, 21% more than the year before. A matter that becomes a criminal file is counted at the prosecutors' offices, which opened 534,491 fraud files in 2025. The survey shares, the regulator's applications and the prosecutors' files count different things, and they are not added together.

The figure shown here is 534,491 fraud files recorded by prosecutors in 2025. They are investigation files opened within the year by the Chief Public Prosecutors' Offices for fraud under articles 157 to 159 of the Turkish Criminal Code, and they include fraud against businesses. With files carried over from 2024 the total is 1,144,287. In the new files the ministry counts 694,546 suspects and 1,398,650 separate crimes, because one file can contain more than one crime and a suspect is counted once for each type of crime.

The same book prints narrower computer counts beside that figure. Misuse of a bank or credit card, article 245, was 35,763 files and 52,281 crimes opened in 2025. Offences against data-processing systems, articles 243 to 246, were 59,887 files and 88,347 crimes. The next table's section for that heading, listing articles 243, 244, 245 and 245/A, shows 61,680 files for the same 88,347 crimes, and it includes breaking into a system and damaging data as well as card misuse. Aggravated fraud, article 158, is the form that uses a bank or an IT system as the tool, or in which the offender claims to work for a bank, an insurer or the state. Since 31 July 2026 it also covers the person who only hands over the card or the account details. On 21 April 2026 the gendarmerie, with MASAK and the prosecutors, caught 127 suspects across 18 provinces.

On the prosecutors' count, fraud is among the largest property offences: 534,491 new files in 2025, set against 35,763 new files for misuse of a bank or credit card. Inside bank fraud, the statistics office's breakdown of the last incident is a card misused on the internet in 50.0% of cases, a withdrawal from the account in 23.2%, another method in 9.9%, misuse at a business in 8.5%, and a cloned card in 6.1%. A cheque accounts for 0.7%, and 1.5% of people could not say which method was used.

At the banking regulator the fraud heading was 17,602 applications in 2025, while bank and credit card applications were 26,537, up from 12,599 in 2024. The criminal code's aggravated form matches the internet and bank cases: it applies where the fraud is carried out through an IT system, a bank or a credit institution, and where the person claims to be a public official or a member of staff at a bank, an insurer or a lender. Consumer fraud is the survey's other large category, at 2.82% of people aged 15 and over, and it is payment for goods or services that do not arrive or are not what was promised. The prosecutors' fraud files are the count used for the country: they are the national total nearest to scams against people, while the card files and the regulator's applications each cover a narrower slice.

The official pieces are being joined up, and the results do not yet match the number of files. Law 7545 gave Türkiye a Cyber Security Board and a Cyber Security Presidency, with power to test critical systems, to gather threat information and to support an organisation that has been attacked. Banks already pool what they see through BKM's security committee. SİPER, the shared security layer, had 43 participants and 3.1 billion queries by December 2025, and it is built to catch an attempt in seconds. Prosecutors, the gendarmerie and MASAK run operations together: the 21 April 2026 operation seized assets valued at 1.22 billion lira.

The criminal caseload is still large. Prosecutors opened 534,491 new fraud files in 2025 and carried 609,796 from the year before. BDDK applications rose 30%, to 231,664, while the slice classed as fraud fell from 19,411 to 17,602 and card applications rose from 12,599 to 26,537. Law 7589 puts the person who hands over a card or account details into the fraud offence, with the sentence cut by half, and article 168 discounts the sentence again when the offender repays the victim. Those are sentencing rules, counted in the criminal case. TÜİK's estimates, 2.32% for bank fraud and 2.82% for consumer fraud, sit at about half the share expected from mobile and broadband use and below the international average, so they stay on the record as the official estimates and are not a comparable measure of how many adults were scammed.