Cybercrime and internet law
We handle hacked accounts, online fraud, insults and blackmail on social media, and content removal requests, from the criminal complaint through to court proceedings.
IT law covers relationships formed over the internet, social media, software and digital platforms, and the offenses committed in these environments. Individuals usually come to us after something has already gone wrong: a hijacked Instagram account, money lost to an online shop or a fake investment site, insults or threats on social media, or blackmail with private images.
What happens in the first days often decides these files. Posts can be deleted, accounts closed, and platform and operator logs are kept only for a limited time. We therefore secure the evidence properly (full URL, username, date and time, screen recordings and, where needed, a formal evidence report), prepare the complaint to the public prosecutor's office and guide the notices to banks and platforms. The main offenses in this area are unlawful access to an IT system (Turkish Criminal Code, TCK Article 243), damaging or altering data (TCK 244), misuse of bank or credit cards (TCK 245) and aggravated fraud committed through IT systems (TCK 158/1-f).
The route to content removal or access blocking (erişim engeli) depends on the type of violation. For content that breaches the privacy of private life, Article 9/A of Law No. 5651 provides for an administrative application reviewed by a criminal judgeship of peace. For posts that violate personality rights, the Constitutional Court annulled Article 9 of Law No. 5651 (effective 10 October 2024), so applications to the platforms, interim injunctions from a civil court and, if the content is a criminal offense, requests within a criminal investigation come to the fore. We decide together which route fits the content and the platform.
For businesses, we work on software license and SaaS agreements, e-commerce compliance, domain name disputes and investigations involving suspected cybercrime, for companies and their employees. We also defend people who become suspects because their account or card was used in a fraud.
When you may need this
- Your Instagram, WhatsApp or email account was taken over and the linked phone number and email were changed.
- You were defrauded while shopping online, by a fake listing or on an investment or crypto site, and sent money to another account.
- Your credit card or bank account was used without your permission.
- Insulting, threatening or defamatory posts about you are being published on social media.
- Someone is blackmailing you with private photos or messages, or has shared them without your consent.
- You want a news article, review or post about you removed or blocked.
- You have been called in for a statement because your bank account or phone line was used in a fraud.
- Your company needs a software, SaaS or e-commerce agreement drafted.
How the process works
- 01
Securing the evidence
We collect full URLs, usernames, dates and times, conversations and screen recordings. Where needed, we consider having the content formally recorded by a notary or through the court.
- 02
Bank and platform notices
In fraud cases we guide notices to your own bank and to the bank that received the money; for hijacked accounts, we make sure the platform's recovery and reporting channels are used.
- 03
Complaint and investigation
We file a complaint supported by evidence with the public prosecutor's office. We request investigative steps such as obtaining IP and subscriber data or bank records, and follow the file.
- 04
Content removal and access blocking
Depending on the violation, we choose between a privacy application, a notice to the platform or an interim injunction from a civil court, and monitor how the decision is implemented.
- 05
Litigation and compensation
We act as counsel for the intervening party in the criminal case. Where appropriate, we file claims for pecuniary and non-pecuniary damages for the loss and the violation of personality rights.
Services in this area
- Complaints about hijacked accounts and unlawful access to IT systems01
- Complaints, victim representation and damages in online and card fraud02
- Insults, threats and blackmail on social media03
- Content removal and access blocking applications04
- Defense of suspects and defendants in cybercrime investigations05
- Software license and SaaS agreements06
- E-commerce and platform regulation compliance07
- Domain name and digital asset disputes08
Documents worth bringing
- Identity document (passport or residence permit for foreign nationals)
- Screenshots of posts, messages and profiles, with full URLs
- For hijacked accounts, the platform's email and SMS notices and login alerts
- For fraud, receipts, bank statements and the other party's IBAN and user details
- Complete conversations (not only excerpts) and any audio recordings
- Records of your applications to the platform and the bank, and their replies
- For businesses, existing contracts, terms of use and privacy notices
How fees and costs are determined
Legal fees are agreed in a written fee agreement according to the type of work (complaint and investigation follow-up, defense or victim representation in a criminal case, access blocking applications, damages claims, contract drafting) and its scope. The floor is the Minimum Attorney Fee Tariff (AAÜT) published each year by the Union of Turkish Bar Associations; under Article 164 of the Attorneys' Act No. 1136, a fee below the tariff cannot be agreed. The current tariff is published in the Official Gazette and on the TBB website.
No fee is charged for filing a complaint with the prosecutor. In criminal cases, costs and attorney fees are allocated under the general rules; on conviction, an intervening party represented by a lawyer is awarded attorney fees against the defendant. Civil injunction and damages proceedings involve court fees, service and expert costs and any security the court may require; the losing party pays the other side's costs and attorney fees under the AAÜT. Court fee amounts are updated every year.
Frequently asked questions
My Instagram account was hacked. What should I do?
Start with Instagram's account recovery steps and keep the alerts sent to the linked email and phone. Change the passwords of other accounts that used the same password, and warn your contacts about money requests that may come from your account. If the account is being used for fraud, blackmail or insults, you can file a complaint with the prosecutor using screenshots and URLs; unlawful access to an IT system is an offense under TCK Article 243.
I was defrauded online in Turkey. Can I get my money back?
Notify your bank and the receiving bank as soon as possible; card payments may also be disputed through your bank. Then file a complaint with the prosecutor, attaching receipts and conversations. Recovery depends on identifying the receiving account and finding assets that can be seized; separately from the criminal case, a civil claim for damages can also be filed.
I was insulted on social media. How do I file a complaint?
Insult (hakaret) is an offense prosecuted only upon complaint, except when committed against a public official because of their duties. The complaint must be filed with the public prosecutor within six months of learning of the act and the perpetrator, and in any case within two years of the act. Keep a screenshot, the full URL and the account's username; if the insult was made publicly, the penalty is increased, and a claim for non-pecuniary damages can also be filed.
How can I get content blocked in Turkey?
If the content violates the privacy of your private life, you can apply to the Cybersecurity Directorate (Siber Güvenlik Başkanlığı) under Article 9/A of Law No. 5651; you must also submit the request to a criminal judgeship of peace within 24 hours, or the measure lapses. For content violating personality rights, since Article 9 was annulled, applications to the platforms and civil interim injunctions are the main routes. To have an access-blocking decision against you lifted, the appropriate objection route depends on the type of decision.
Can I file a cybercrime complaint without a lawyer?
Yes. A lawyer is not required to file a complaint; you can submit a petition to the prosecutor's office or go to the police. Even so, presenting complete evidence, requesting IP, operator and bank records and following the file all affect the outcome. Where the other party is unknown or information is needed from platforms based abroad, the process is more technical and takes longer.
How long does a cybercrime case take?
It depends on the case. Requests to banks, operators and platforms to identify the perpetrators can extend the investigation, and obtaining information from platforms abroad may take months. Once a suspect is identified and charged, these cases are usually heard by a criminal court of first instance.
My account was used in a fraud. Am I liable too?
People who let others use their bank account, card or phone line may be called in as suspects in fraud investigations; whether there was intent is assessed case by case. A fourth paragraph added to TCK Article 158 in July 2026 halves the penalty for those whose involvement is limited to handing over an account, a card or the credentials needed to use them. If you receive such a summons, it is sensible to review the file with a lawyer before giving your statement.
This page is for general information only and does not constitute legal advice. Every legal matter has its own circumstances; please request a meeting for your specific situation.
Share your legal matter.
Send your appointment request and we will get back to you shortly. For urgent matters, please call.