IBAN Change Fraud via Company Email: Payment and Liability for Damages
Last updated: 21.10.2026 · Author: Attorney Coşkun Genç, Istanbul cybercrime lawyer
Short answer: As a rule, a payment made to a fake IBAN notified through a compromised or spoofed company email does not discharge the debt, because the money has not reached the creditor or a person authorised to collect it. The loss, however, may be apportioned according to the fault of the parties: both the merchant who pays without verification and the merchant who fails to secure its email may be found at fault (Article 18(2) TCommC, Article 52 TCO). The act constitutes aggravated fraud under Article 158(1)(f) TPC. The first step is to send the bank an immediate recall request and to file a criminal complaint on the same day.
IBAN change fraud via company email is the form, aimed at commercial payments, of the method known internationally as "business email compromise" (BEC). This article examines whether the debt is deemed paid where the correspondence between two companies is infiltrated and the payment account is changed, how the loss is apportioned between the parties, in which cases the bank is liable, and the criminal law dimension. Fraud targeting the bank accounts of individual customers and the position of persons who let others use their accounts are examined in separate guides; for these topics, see the article The 12th Judicial Reform Package and IBAN fraud victims.
How does IBAN change fraud via company email work?
The perpetrator infiltrates the email account of one of the parties or opens an address closely resembling it, and then sends a "our bank account has changed" notice as if continuing the genuine correspondence. The message quotes earlier correspondence and states the invoice amount and order number correctly; this is why the other party often does not become suspicious. Sometimes a fake pro forma invoice is attached as well.
Signs frequently seen in cases reflected in court decisions are: a one-letter difference in the address, a change of one digit in the telephone number in the signature block, a request for payment to an account in another country on grounds such as a "tax problem" or an "audit", and an urgent demand for payment. The perpetrator may also answer confirmation emails written to the genuine account from the mailbox under his control, creating the impression that the payment has arrived.
In terms of legal consequences, the most important distinction is whose email was compromised. If the seller's (creditor's) mailbox was compromised, the creditor's duty of care in security comes to the fore; if the buyer's (debtor's) mailbox was compromised, or the buyer was deceived by an instruction from a similar address, the payer's duty of care in verification comes to the fore. In most files, both parties have shortcomings.
Does a payment to a fake IBAN discharge the debt?
No; as a rule, a payment made to a fake IBAN does not release the debtor from the debt. A monetary debt is extinguished when it is paid to the creditor or to a person authorised to collect on the creditor's behalf. Money that goes to a third party's account without the creditor's knowledge and will does not constitute performance.
For this reason, the creditor may demand the invoice amount again, and the debtor cannot succeed solely with the defence "I paid my debt" based on the payment receipt. Article 112 of the Turkish Code of Obligations (TCO, Law No. 6098; Türk Borçlar Kanunu – TBK) provides that where an obligation is not duly performed, the debtor must compensate the creditor's loss unless it proves that it is not at fault; the debtor is liable for every degree of fault, and the scope of liability is determined according to the nature of the transaction (Article 114 TCO).
"In a contract of sale, for the payment to release the buyer from the debt, it must be made to the seller or to persons authorised to collect on the seller's behalf. In the present case, the payment relating to the invoices subject to enforcement proceedings was made not to the claimant's bank account stated in the invoices, but to another bank account notified from an email account not belonging to the claimant. In that case, the said payment cannot release the defendant from the debt."
Istanbul Regional Court of Appeal, 43rd Civil Chamber, E. 2021/545, K. 2024/855, 30.05.2024
However, the finding that "the debt has not been extinguished" does not always mean that the debtor must pay the full amount a second time. If a deficiency in the creditor's own email security contributed to the loss, the claim may be reduced according to the fault of the parties. The next heading addresses this apportionment.
Who bears the loss, and how are fault and loss apportioned?
As a rule, the loss is borne by the party whose faulty conduct paved the way for the fraud; if both parties are at fault, it is apportioned. The yardstick is every merchant's obligation to act "as a prudent businessperson" in its commercial activities. This yardstick requires a higher degree of care than is expected of an ordinary person.
Turkish Commercial Code (TCommC, Law No. 6102; Türk Ticaret Kanunu – TTK) – Article 18(2)
(2) Every merchant shall act as a prudent businessperson in all activities relating to its business.
Turkish Code of Obligations (Law No. 6098) – Article 52(1)
Where the injured party consented to the act causing the damage, contributed to the occurrence or aggravation of the damage, or worsened the position of the person liable to pay compensation, the judge may reduce the compensation or remove it entirely.
Article 18(2) TCommC raises the standard of care of merchants; failing to verify an unexpected account change received by email through a previously known channel (a registered telephone number, a face-to-face meeting, earlier verified correspondence) may be regarded as contrary to this standard. Article 52 TCO, in turn, empowers the judge to reduce, or even remove entirely, the compensation where the injured party's own conduct contributed to the occurrence of the damage; in practice this is referred to as "contributory fault" (müterafik kusur).
In the appellate (istinaf) decision cited above, the buyer, who did not verify despite payment suddenly being requested to another account abroad in a five-year commercial relationship, was found at fault; it was also accepted that the seller had failed to secure its email. Treating the fault of the two parties as equal, the Chamber limited the buyer's liability to half of the invoice amount.
"Having regard to the nature of the parties' fault, accepting that both parties are equally at fault is reasonable and consistent with the specific case."
Istanbul Regional Court of Appeal, 43rd Civil Chamber, E. 2021/545, K. 2024/855, 30.05.2024
The ratio is not fixed in every file. The seriousness of the failure to verify, the duration of the relationship, how unusual the change request was, how distinguishable the fake address was from the genuine one, and how quickly the parties acted after the compromise are weighed together. The table below summarises frequently encountered situations according to these criteria.
| Situation | Is the debt extinguished? | Key factor in the fault assessment |
|---|---|---|
| The creditor's email was compromised; the debtor paid without verification | As a rule, no | Fault of both parties; the claim may be reduced under Article 52 TCO |
| The debtor was deceived by an instruction from a similar (spoofed) address | No | Mainly the debtor's duty of care in verification; any fault of the creditor must be proven separately |
| The debtor verified the change by a known telephone number or in person | Depends on from whom the verification was obtained | The position of the diligent debtor is strengthened |
| The bank executed the transfer to the IBAN in the instruction | In the bank–customer relationship, the instruction is deemed executed | As a rule, no fault on the bank's part; special circumstances excepted |
Is the bank liable for money sent to a fake IBAN?
As a rule, no: a bank that sends money to the IBAN written in the customer's own instruction is not held liable merely because the beneficiary's name does not match the IBAN holder. The Civil General Assembly of the Court of Cassation accepted that the bank was not at fault in a transfer made on the basis of a pro forma invoice containing a fake IBAN following the compromise of a foreign seller's email.
"…it is understood that the defendant bank carried out the transfer transactions in accordance with the IBAN details given by the claimant company, and that it had no obligation to check whether the name of the transfer beneficiary was the same as that of the IBAN to which the money was sent."
Civil General Assembly of the Court of Cassation, E. 2017/941, K. 2021/144, 23.02.2021
In the same decision, the Assembly held at fault, by the standard of the prudent merchant, the importing company which, after the first transfer, requested a second transfer to the same IBAN more than twenty days later without contacting the beneficiary and confirming whether the money had arrived. The decision was rendered by majority vote; the dissenting opinion argued that the bank should have warned the customer that name matching could not be performed in international transactions. The 11th Civil Chamber of the Court of Cassation, in its decision of 19.12.2018 (E. 2017/2671, K. 2018/8089), likewise upheld a judgment attributing no fault to the bank in a case where the IBAN was changed through the compromise of the transfer beneficiary's computers.
The result is similar where the instruction is sent to the bank from the customer's own compromised email. By its decision of 24.12.2025 (E. 2025/2503, K. 2025/7768), the 11th Civil Chamber of the Court of Cassation upheld the appellate judgment which regarded as gross fault the customer company's failure to notice that its email accounts had been compromised for three months and its choice to have high-value transfers carried out on email instructions. According to the reasoning upheld, transactions carried out through the compromise of email addresses by fraudsters are of such weight as to break the causal link in respect of the bank's duty of care.
The bank's liability may, however, arise where the instruction is manifestly suspicious, where the verification procedure agreed in the contract was not applied, or where forgery in signatures and documents could be detected by an ordinary check. Therefore, if an action against the bank is being considered, the instruction and verification provisions in the contract with the bank should be examined first.
What should be done once the IBAN change is found to be fake?
What must be done in the first hours are notifications aimed at preventing the money from leaving the account; the legal debate comes later. Since the money is usually transferred to other accounts within a short time, delay directly reduces the chance of recovery.
- Call your own bank and notify it in writing: Report that the payment was made as a result of fraud and request a recall (for international transfers, a return request via SWIFT); record the date and time of the request.
- File a criminal complaint: Apply to the Chief Public Prosecutor's Office with the payment receipt, the original emails together with their header information, and a summary of events. Banks and payment institutions may suspend the account used in the offence for up to forty-eight hours under Article 128/A of the Code of Criminal Procedure (CCP, Law No. 5271); the guide to the suspension of accounts provides detailed information on this.
- Inform the other party through a secure channel: Call them on a previously known telephone number rather than through the possibly compromised email; establish together whose mailbox was compromised.
- Secure the email account, but do not delete evidence: Change passwords, enable two-factor authentication, check forwarding and automatic rule settings; export suspicious emails and session logs without deleting them.
- Assess the personal data dimension: If the compromised mailbox contains customer or employee data, under Article 12(5) KVKK the data controller must notify the data subjects and the Personal Data Protection Board of the situation as soon as possible.
- Set out your legal position in writing: If you are the creditor, give written notice of your payment demand by formal notice; if you are the debtor, of your payment defence and the findings concerning the other party's fault. Article 18(3) TCommC provides that notices of default between merchants must be made through a notary, registered letter, telegram or registered electronic mail (KEP).
A remedy is also available against the holder of the account to which the money was sent. A person who is enriched from another's assets without just cause is obliged to return that enrichment (Article 77 TCO); the account holder may also be held liable under the provisions on tort. To determine who actually used the account, see the article identifying the actual user of a bank account.
Which documents and evidence should be preserved?
The apportionment of fault relies largely on the technical examination of the emails; for this reason, screenshots are not enough, and the original emails and their header information must be preserved. In the decisions, the server from which the fake emails were sent, whether the header information was altered and when the genuine correspondence was copied are determined through expert examination.
- ✓The originals of the fake and genuine emails in .eml/.msg format, with full header information
- ✓Invoices, pro forma invoices, the contract and the IBAN details used in previous payments
- ✓The payment receipt, the SWIFT message (MT103) and the instruction given to the bank
- ✓The email service provider's login, IP and forwarding rule records
- ✓Recordings or logs of telephone calls made for verification
- ✓The recall application made to the bank and the bank's response
- ✓Commercial books and current account statements (to show the outstanding amount of the debt)
- ✓The company's email security settings and the report of the internal review conducted after the incident
When the dispute is brought before the court, a party opening its computer and email systems to examination may also produce results in its own favour; in the appellate decision cited, the examination of the commercial books and systems was decisive in the assessment of fault.
Which offence is committed by compromising an email and changing the IBAN?
This act constitutes the offence of aggravated fraud through the use of information systems as an instrument (Article 158(1)(f) of the Turkish Penal Code – TPC, Law No. 5237); if the email account was accessed without authorisation and data was inserted, cybercrimes also arise separately. Anyone may commit the offence; it is sufficient that the perpetrator deceives the other party by a misleading email and obtains an unjust benefit for himself or another.
Turkish Penal Code (Law No. 5237) – Article 158(1)(f) (relevant part)
(1) Where the offence of fraud is committed: … f) through the use of information systems, banks or credit institutions as an instrument, … the offender shall be sentenced to imprisonment from three to ten years and a judicial fine of up to five thousand days. However, in the cases listed in subparagraphs (e), (f), (j), (k) and (l), the lower limit of the term of imprisonment shall not be less than four years and the amount of the judicial fine shall not be less than twice the benefit obtained from the offence.
Accordingly, in the case under subparagraph (f), the term of imprisonment is from four to ten years; the judicial fine cannot be less than twice the benefit obtained from the offence. If the offence is committed jointly by three or more persons, the penalty is increased by one half, and if it is committed within the framework of the activities of an organisation, it is doubled (Article 158(3) TPC). The text of the article is available on our Article 158 TPC page, and the details of the offence are set out in the article on fraud through the use of information systems.
Unlawfully accessing an email account carries imprisonment of up to one year or a judicial fine under Article 243(1) TPC. A person who inserts data into, or alters data in, an information system is punished with imprisonment from six months to three years under Article 244(2) TPC. In a case where a "our account number has changed" notice was sent from the compromised account, the Court of Cassation found it unlawful to convict solely of the offence of accessing the system:
"…it has been found unlawful that, without taking into account that the defendant's acts constituted, in addition to the offence of attempted fraud through the use of information systems as an instrument, the offence under Article 244/2 of Law No. 5237 owing to the insertion of data into the system after cracking the passwords of the email addresses belonging to the intervening party and accessing the account without authorisation, a judgment was rendered for the offence of accessing an information system regulated in Article 243/1 of the same Law, through an error in the legal characterisation of the offence."
Court of Cassation, 11th Criminal Chamber, E. 2022/9541, K. 2025/7292, 17.06.2025
The same Chamber also emphasised that the act of a defendant who accessed a company's email, emailed a customer and had the payment made to his own account falls within the scope of Article 158(1)(f) TPC (Court of Cassation, 11th Criminal Chamber, E. 2021/14479, K. 2021/7098, 22.09.2021). The criminal investigation also provides evidence for the civil action in terms of tracing the money and identifying the account holders.
What are the common mistakes and exceptions?
The most common mistake is to "verify" the account change by replying to the email that announced it; if the mailbox has been compromised, the perpetrator answers. Other conduct that has led to aggravated fault in the decisions includes:
- Not questioning an unusual request: Switching to an account in another country or under a different name, after years of payments to the same account, requires additional verification.
- Not checking after the first payment: In instalment payments, making the second payment without asking whether the first amount arrived increases the fault.
- Noticing the compromise late: Not checking bank statements and the inbox for months may be regarded as gross fault for the creditor or the account-holding company.
- Destroying evidence: Deleting emails or closing the account in a panic makes it harder to prove whose mailbox was compromised.
- Not specifying a payment channel in the contract: In contracts that do not regulate the method by which an account change is to be notified, the debate on fault becomes protracted.
There are also exceptions. If the parties have agreed in the contract that an account change is valid only through a specific channel and the debtor has complied with that channel, its position is strengthened. If it is proven that the creditor's employee acted together with the perpetrators, placing the loss on the creditor may come into question. If one of the parties is not a merchant, the higher standard of care in Article 18(2) TCommC does not apply to that party; the assessment is made according to the general provisions.
For prevention, establishing a written payment procedure within the company, requiring two-person approval and voice verification from a known number for account changes, first making a small test payment for large amounts, and making two-factor authentication mandatory for email accounts reduce both the risk of fraud and the share of fault in any potential lawsuit.
Payment and Compensation Process with an Istanbul Commercial Fraud Lawyer
In these files, the outcome is often determined by three points: technical proof of whose email was compromised, documentation of the verification made or not made before payment, and the speed of the notifications made to the bank and the prosecutor's office. Av. Coşkun Genç Law Office provides legal support in Istanbul, in fraud committed by changing the IBAN through company email, with the preparation of the criminal complaint, the follow-up of recall and suspension procedures before the bank, the defence on apportionment of fault in receivables actions and actions for annulment of objection (itirazın iptali), and compensation claims against account holders. In our work as an Istanbul commercial fraud lawyer, the criminal and civil dimensions are planned together.
Companies wishing to obtain the support of an Istanbul cybercrime lawyer may request a preliminary assessment through our contact page, together with the originals of the fake and genuine emails, the invoices, the payment receipt and SWIFT message, the application made to the bank and the correspondence with the other party. General information on our practice area is available on the cybercrimes page.
Sources
- Turkish Code of Obligations (Law No. 6098), Articles 52, 77, 112, 114 – mevzuat.gov.tr
- Turkish Commercial Code (Law No. 6102), Article 18 – mevzuat.gov.tr
- Turkish Penal Code (TPC, Law No. 5237), Articles 158, 243, 244 – mevzuat.gov.tr
- Code of Criminal Procedure (CCP, Law No. 5271), Article 128/A – mevzuat.gov.tr
- Personal Data Protection Law (KVKK, Law No. 6698), Article 12 – mevzuat.gov.tr
- Civil General Assembly of the Court of Cassation, E. 2017/941, K. 2021/144, 23.02.2021
- Court of Cassation, 11th Civil Chamber, E. 2025/2503, K. 2025/7768, 24.12.2025
- Court of Cassation, 11th Civil Chamber, E. 2017/2671, K. 2018/8089, 19.12.2018
- Court of Cassation, 11th Criminal Chamber, E. 2022/9541, K. 2025/7292, 17.06.2025
- Court of Cassation, 11th Criminal Chamber, E. 2021/14479, K. 2021/7098, 22.09.2021
- Istanbul Regional Court of Appeal, 43rd Civil Chamber, E. 2021/545, K. 2024/855, 30.05.2024
Important: This article is for general information purposes only and does not constitute legal advice. The ratio of fault is determined separately in each file according to the technical examination of the emails, the parties' contract and the verifications made before payment; the appellate decision cited is specific to its particular facts. Your specific case should be assessed separately on the basis of the current version of the legislation.