Fraud Through the Use of Information Systems (Article 158(1)(f) TPC): Elements, Penalty, Distinction from Theft and Effective Repentance
Last updated: 14.10.2026 · Author: Attorney Coşkun Genç, Istanbul cybercrime lawyer
Short answer: Fraud through the use of information systems consists of deceiving a human being by deceitful means through information technology tools such as the internet, mobile applications, social media or e-mail, and thereby obtaining a benefit (Article 158(1)(f) of the Turkish Penal Code (TPC, Law No. 5237)). The penalty is imprisonment from 4 to 10 years and a judicial fine of not less than twice the benefit derived from the offence. If no one is deceived, for example where money is transferred from an account using a stolen password, the offence is not fraud but theft committed through the use of information systems (Article 142(2)(e) TPC). If the damage is fully redressed before the prosecution begins, the penalty to be imposed is reduced by up to two thirds (Article 168(1) TPC). This offence is not within the scope of victim–offender mediation (uzlaştırma).
What Is Aggravated Fraud under Article 158(1)(f) TPC?
The basic form of fraud is regulated in Article 157 TPC: deceiving a person by fraudulent conduct and thereby obtaining a benefit to the detriment of that person or of another. The legislator has treated the commission of the deceit through information systems or through banks and credit institutions as an aggravated (qualified) form. This is because these instruments make it easier for the offender to conceal his identity, to reach a large number of people at the same time and to move the money to other accounts within minutes; the victim's ability to verify the person on the other side, on the other hand, is reduced.
The examples most frequently encountered in practice are: requesting loans by sending messages to acquaintances from a hijacked social media or WhatsApp account, fake e-commerce websites, phishing pages imitating a bank's interface, fake investment applications, and promises of sale made through classified-advertisement websites. Issues of identifying the offender and of evidence specific to classified-advertisement websites are addressed separately in our article Fake Online Advertisement Fraud, and cases involving what appear to be investment platforms in our article Forex Fraud.
Statutory Text: Articles 157 and 158 TPC
Turkish Penal Code (TPC, Law No. 5237) – Articles 157 and 158 (current version)
Article 157 – Fraud
(1) A person who, by fraudulent conduct, deceives another person and thereby obtains a benefit for himself or for another, to the detriment of that person or of another, shall be sentenced to imprisonment from one year to five years and to a judicial fine of up to five thousand days.
Article 158 – Aggravated fraud
(1) Where the offence of fraud is committed: (...) f) through the use of information systems, banks or credit institutions as an instrument, (...) a penalty of imprisonment from three years to ten years and a judicial fine of up to five thousand days shall be imposed. (Additional sentence: 29.06.2005 – Law No. 5377, Art. 19; Amended: 03.04.2013 – Law No. 6456, Art. 40) However, in the cases listed in subparagraphs (e), (f), (j), (k) and (l), the minimum term of imprisonment shall not be less than four years, and the amount of the judicial fine shall not be less than twice the benefit derived from the offence.
(3) (Additional paragraph: 24.11.2016 – Law No. 6763, Art. 14) Where the offences set out in this Article and in Article 157 are committed jointly by three or more persons, the penalty to be imposed shall be increased by one half; where they are committed within the framework of the activities of an organisation formed for the purpose of committing offences, the penalty to be imposed shall be increased by one fold.
(4) (Added: 16.07.2026 – Law No. 7589, Art. 13) Where participation in the offences set out in this Article and in Article 157 is limited to the act of giving to another person, for the purpose of obtaining an unjust benefit for oneself or for another, payment instruments such as a bank or credit card belonging to oneself or to another, or the information or means necessary to enable the use of an account held with a bank, intermediary institution, payment service provider or crypto-asset service provider, the penalty to be imposed shall be reduced by one half.
Note: The other subparagraphs of the first paragraph (a-e, g-l) have been abridged. The fourth paragraph was added by Law No. 7589, known as the 12th Judicial Reform Package, and was published in the Official Gazette dated 31.07.2026.
What Elements Are Required for the Offence to Be Constituted?
- Deceit directed at a human being: The person deceived must be a natural person. “Tricking” a machine, an ATM or software does not constitute fraud.
- The information system as the instrument of the deceit: The system must not be merely a channel of communication but the environment in which the deception is set up, such as a fake profile, a hijacked account, an imitation website or a fake application screen.
- Deception and disposition: As a result of the deceit, the victim, of his own will, sends money, approves a payment or provides information.
- Benefit and intent: The offender obtains an unjust benefit for himself or for another and does so knowingly and willingly. There is no negligent form of this offence.
The Court of Cassation, emphasising the requirement of “deception of a human being”, distinguishes the aggravated form from theft and cybercrimes as follows:
Since it cannot be said that an information system is deceived, this subparagraph may be applied only where a human being is deceived, that is to say defrauded, through the use of that system as an instrument. Otherwise, that is to say where, upon accessing the system, no person is deceived but a benefit is obtained by making use of the system, a cybercrime or the offence of theft committed through the use of an information system will be at issue.
— Court of Cassation, 11th Criminal Chamber, E. 2021/17211, K. 2024/11892, 17.10.2024
For example, while communicating through the system, the interlocutor is tricked into providing phone credit and money; a benefit is obtained by sending e-mail; or, under pretexts such as a password change or an update, as though calling from the bank, the victim is misled, believes that he is entering the bank's screen, gives details about his account information, and the transfer of his money elsewhere is thereby effected; in this manner the victim is defrauded through the use of an information system as an instrument.
— Criminal General Assembly of the Court of Cassation, E. 2012/1293, K. 2013/111, 02.04.2013
What Offence Is Committed by Hijacking a Social Media Account and Asking for Money?
Hijacking an acquaintance's Facebook, Instagram or WhatsApp account and sending that person's friends, in his name, a message such as “I urgently need money, I will pay it back this evening” is a typical example of Article 158(1)(f) TPC. Here, the deceit is based on the trust the victim places in that account. The hijacking of the account may additionally raise the offence of unlawful access to an information system (Article 243 TPC).
In the case where, while the intervening party was using his Facebook account, the defendant, having somehow taken over the Facebook account of ..., a friend of the intervening party, sent a message to the intervening party, asked whether he used an internet banking account and, upon learning that he did, asked him for TRY 450.00 on condition of repayment, (...) where the GSM line no. ... to which the transfer was made was registered in the name of ..., the mother of the defendant ..., and where, during the body search conducted on 25.12.2012, the date on which the defendant was taken into police custody, the line that is the subject of the offence was found on the defendant, inserted in his mobile phone, no error has been found in the finding that the offence of aggravated fraud was constituted.
— Court of Cassation, 15th Criminal Chamber, E. 2013/14846, K. 2013/12178, 01.07.2013
Fraud, Theft or a Card Offence? The Difference between Articles 142(2)(e), 244(4) and 245 TPC
The same bank transaction may constitute different offences depending on the offender's method. The decisive question is: Did the money leave through a transaction made by the deceived victim himself, or was it taken without the victim's knowledge?
| Act | Offence | Term of imprisonment |
|---|---|---|
| The victim is deceived and sends the money himself | Article 158(1)(f) TPC aggravated fraud | 4 – 10 years |
| Money is transferred from the victim's account with a stolen password, without the victim's knowledge | Article 142(2)(e) TPC theft through information systems | 5 – 10 years |
| Another person's bank/credit card is used without that person's consent | Article 245(1) TPC misuse of a card | 3 – 6 years |
| A benefit is obtained by disrupting the system or altering data, and no other offence is constituted | Article 244(4) TPC | 2 – 6 years |
Rendering a judgment under Article 244/4 of the same Code as a result of an error in the legal characterisation of the offence, without taking into account that the act consisting of transferring money, through internet banking and without the knowledge and consent of the intervening party, from the intervening party's account attached to the Levent Branch of the Bank to the account of the defendant held at the Adana Branch, and withdrawing it, constitutes the offence of 'theft committed through the use of an information system' regulated in Article 142/2-e of the TPC, as also accepted in the decision of the Criminal General Assembly of the Court of Cassation dated 17.11.2009, E. 2009/11-193, K. 2009/268
— Court of Cassation, 2nd Criminal Chamber, E. 2014/22654, K. 2016/3151, 25.02.2016
Article 244(4) TPC, on the other hand, is a subsidiary provision applied only where the act “does not constitute another offence”. For the victim's first steps when card details are stolen, see our article My Card Details Were Stolen: What Should I Do in the First 24 Hours?
What Is the Penalty for Fraud Through Information Systems?
Although the general penalty range of Article 158(1) TPC is 3-10 years, for subparagraph (f) the minimum term of imprisonment is 4 years. The judicial fine likewise cannot be less than twice the benefit derived from the offence. The main circumstances affecting the penalty are as follows:
| Circumstance | Effect | Legal basis |
|---|---|---|
| Basic aggravated form (subparagraph f) | 4 – 10 years' imprisonment + a judicial fine of not less than 2 times the benefit | Article 158(1)(f) TPC, last sentence |
| Commission jointly by three or more persons | The penalty is increased by one half | Article 158(3) TPC |
| Commission within the framework of an organisation's activities | The penalty is increased by one fold; Article 220 TPC also comes into play | Articles 158(3) and 220 TPC |
| Participation limited solely to giving an account/card or its details | The penalty is reduced by one half | Article 158(4) TPC (Law No. 7589) |
| Full redress of the damage before the prosecution | The penalty is reduced by up to two thirds | Article 168(1) TPC |
| Full redress of the damage before the judgment | Reduction of up to one half | Article 168(2) TPC |
Important information: Where the contribution of a person participating in a fraud offence consists solely of giving to another person, for the purpose of obtaining an unjust benefit, his own or another person's card or account, or the information or means necessary to use the account, his penalty is reduced by one half under Article 158(4) TPC as from 31.07.2026; the reduction may not apply to additional contributions such as withdrawing the money from the account and handing it over, while an account holder who lacks intent is not punished at all. Since it is a more favourable law, it applies directly in pending cases and by way of adaptation in finalised cases; Provisional Article 1 of Law No. 7589 further provides that cases pending before the Regional Court of Appeal (istinaf) are to be reversed and sent to the court of first instance, and that convicts at the enforcement stage may benefit from the effective repentance reduction under Article 168(2) TPC if they fully redress the damage within six months of the court's warning. For details, see our articles Article 158(4) TPC: IBAN Victims and Sentence Reduction and Under Article 158(4) TPC, Is Enforcement Stopped Without Redress of the Damage?
Effective Repentance: How Much Is the Penalty Reduced If the Damage Is Redressed?
Turkish Penal Code (TPC, Law No. 5237) – Article 168 (relevant paragraphs)
(1) Where, after the offences of theft, damage to property, breach of trust, fraud, fraudulent bankruptcy or negligent bankruptcy (…) have been completed, but before a prosecution has been initiated against him on that account, the offender, the instigator or the accessory personally displays remorse and fully redresses the damage suffered by the victim by way of restitution in kind or compensation, the penalty to be imposed shall be reduced by up to two thirds.
(2) Where effective repentance is displayed after the prosecution has commenced but before the judgment is rendered, the penalty to be imposed shall be reduced by up to one half.
(4) In the case of partial restitution or compensation, the consent of the victim shall additionally be required for the provisions on effective repentance to be applied.
The “prosecution” begins with the acceptance of the indictment. For this reason, full payment made during the investigation phase secures the widest reduction. The payment must be made of the offender's own free will. In the case of partial payment, the victim's express consent must be obtained. Documenting the payment with a bank receipt and submitting it to the case file is important in determining the rate of reduction.
Mediation, Statute of Limitations and Competent Court
- No mediation: Article 253(1)(b)(8) of the Code of Criminal Procedure (CCP, Law No. 5271) brings only simple fraud (Article 157 TPC) within the scope of victim–offender mediation. Mediation is not available for aggravated fraud (Article 158 TPC). Withdrawal of the complaint does not terminate the case either.
- Statute of limitations for prosecution: Since the upper limit is 10 years, it is 15 years under Article 66(1)(d) TPC. Where the upper limit reaches 20 years with the organisation-related increase, the period may be 20 years, as the aggravated form is taken into account pursuant to Article 66(3) TPC.
- Competent court: Since Law No. 7571 (Official Gazette, 25.12.2025) removed the words “aggravated fraud” (nitelikli dolandırıcılık) from Article 12 of Law No. 5235, cases under Article 158(1) TPC are, as a rule, heard by the criminal court of first instance (asliye ceza mahkemesi); cases pending before the high criminal court on that date, however, are concluded under the former rule on subject-matter jurisdiction until a final judgment is rendered (Provisional Article 7 of Law No. 5235). For offences committed on the Anatolian side of Istanbul, the competent courthouse is mostly the Anatolian Courthouse (Anadolu Adliyesi) in Kartal.
- Suspension of the account: Where there is a suspicion of an offence under Article 158(1)(f) TPC, banks and payment institutions may suspend the account used in the offence for up to 48 hours under Article 128/A CCP. See Suspension of Accounts under Article 128/A CCP.
What Should Be Considered in the Defence?
The most common error in these cases is to treat the account holder or the subscriber of the phone line directly as the offender. In the defence, the following questions must be asked one by one: Was the deceit really set up through an information system, or was the system merely a means of communication? To whom do the device and the connection used to carry out the transaction belong? Through which accounts did the money pass, and whom did it reach? On the point that IP and subscriber records are not sufficient on their own, see our articles Is an IP Address Alone Evidence? and What Is a “Patates Hat” (a Phone Line Registered in Another Person's Name)? In practice, too, it is seen that the aggravated form is controversial where the system is used solely for communication, and that the reliability of digital evidence is decisive in acquittal decisions.
Fraud Through Information Systems Lawyer in Istanbul
As Coşkun Genç Law Office, we act in Istanbul, particularly in aggravated fraud and cybercrime cases heard at the Anatolian Courthouse in Kartal and at the Istanbul Courthouse (İstanbul Adliyesi), both as defence counsel for suspects and defendants and as attorney for victims. Correctly determining the legal characterisation of the offence, scrutinising the digital evidence and making timely use of effective repentance directly affect the outcome of the case. For an assessment, you may contact us.
Important: This article is for general information purposes only and does not constitute legal advice. Please seek the assistance of a lawyer for your specific case.