My Card Details Were Stolen: What Should I Do in the First 24 Hours? A Guide to Reporting, Disputes, Criminal Complaints and Evidence
Last updated: 14.10.2026 · Author: Attorney Coşkun Genç, Istanbul cybercrime lawyer
Short answer: As soon as you notice that your card details have been stolen, block the card for use via the mobile app and call the bank’s call centre to make a lost/stolen report. Be sure to note the date and time of the report and the application number. Under Article 12 of Law No. 5464 on Bank Cards and Credit Cards, if there is no gross negligence or intent on your part, your liability for unlawful transactions made in the 24 hours preceding the report is limited to TRY 150. If the report is delayed, this protection may be lost. On the same day, dispute in writing any transactions you do not recognise, keep screenshots and messages, and file a criminal complaint with the prosecutor’s office or law enforcement.
How Can I Tell That My Card Details Have Been Stolen?
Card details are most often stolen while the card is physically in your possession. The most common methods are fake payment links sent under the pretext of a parcel delivery, a fine or a refund (phishing), fake e-commerce websites, persons introducing themselves as bank employees asking for passwords over the telephone, remote access applications installed on the phone, and fake advertisements. A one-time password (OTP) message received without your knowledge, small test charges, and foreign or crypto platform transactions that you do not recognise are the first warning signs.
There is a difference in legal consequences between the physical theft of the card and the mere acquisition of its details. We have discussed in detail the effect of this distinction on the bank’s liability in our article Guide to Legal Liability in Stolen Credit Card Transactions. This article, by contrast, focuses on what should be done, and in what order, in the first hours.
Which Steps Should I Take in the First 24 Hours, and in What Order?
| Time | Action to take | Why is it important? |
|---|---|---|
| First minutes | Temporarily block the card via the mobile app; disable internet and foreign use | New transactions are stopped |
| First hour | Call the bank’s call centre and make a lost/stolen report; note the time of the report and the application number | The TRY 150 limit in Article 12 of Law No. 5464 depends on the report |
| First 6 hours | Dispute in writing every transaction you do not recognise (mobile app, branch or e-mail) | The date and content of the dispute are means of proof |
| First 12 hours | Keep messages, links, screenshots and the account statement; change your passwords | Digital traces may be deleted within a short time |
| First 24 hours | File a criminal complaint with the Chief Public Prosecutor’s Office or law enforcement; obtain a copy of the petition and the official report | The money may be suspended in the recipient account, and identification of the perpetrator begins |
Cancelling the card is different from temporarily blocking it. Temporary blocking should be the first reflex; once it is certain that the details have been stolen, the card must be cancelled completely and a card with a new number requested. Also check the debit cards and virtual cards linked to the same account.
Why Should the Bank Be Notified Within the First Hour?
Law No. 5464 on Bank Cards and Credit Cards imposes on the cardholder both the obligation to protect the card details and the obligation to inform the bank as soon as the cardholder learns of the theft. The liability of a cardholder who complies with this obligation is limited:
Law No. 5464 on Bank Cards and Credit Cards – Articles 12 and 16
Article 12 – Unlawful use of the card and insurance
In the event of loss or theft of the card or of the information specified in Article 16, the cardholder shall be liable, limited to one hundred and fifty New Turkish Liras, for damage arising from unlawful use occurring within the twenty-four hours preceding the notification to be made by the cardholder. This limit shall not apply where the unlawful use is based on the gross negligence or intent of the cardholder or where no notification is made.
The card issuing institution shall be obliged, upon request and subject to payment of the relevant insurance premium, to ensure that the cardholder’s liability in the amount of one hundred and fifty New Turkish Liras specified in the first paragraph is insured. The procedures and principles concerning the insurance of cards and the sharing of liability shall be determined by a regulation to be issued by the Agency.
Article 16 – Obligation to notify
The cardholder shall be obliged to protect securely the card entrusted to him or her and, where the use of the card requires the use of a code number, password or other identifying method, such information, and to take measures to prevent their use by others, and to inform the card issuing institution immediately upon learning of the loss or theft of the card or of any transaction carried out against his or her will.
The expression “New Turkish Lira” in the article is applied today as TRY 150 owing to the change of currency, and as of 15.10.2026 the article has not been amended. If the card is physically in your possession and only its details have been stolen, and transactions have been carried out with those details over the internet, by telephone or by order form without a charge slip (harcama belgesi) being issued, you cannot be held liable for these unlawful transactions under Article 15(3) of Law No. 5464; whether this provision applies to transactions approved with a password or SMS code is debatable, depending on the specific case. The Court of Cassation also places the time of notification at the centre; transactions made before the notification and with the password may lead to consequences against the cardholder:
Under Article 16 of Law No. 5464, the cardholder is obliged to protect and keep safe the credit card details. Should theft, loss or similar events relating to the credit card occur, the cardholder must immediately notify the bank and have the card cancelled.
— Court of Cassation, 19th Civil Chamber, E. 2016/17447, K. 2018/1770, 03.04.2018
In the same decision, it was accepted that approximately one hour had elapsed between the time the card became stuck in the ATM and the report to the bank, that cash had been withdrawn with the password in the meantime, and that the cardholder had to be held liable for the transaction preceding the report. In short, postponing the report with the thought “I will go to the branch tomorrow” puts at risk the protection afforded by the law.
Important information: The TRY 150 limit may be met with a “gross negligence” defence where you have shared your password or the one-time code received by SMS with a third party. Nevertheless, this does not mean that the bank bears no liability whatsoever. The bank’s security measures and its obligation to monitor unusual transactions are assessed separately. You can find Court of Cassation decisions on the apportionment of fault in our liability guide.
How Is a Transaction Dispute (Chargeback) Made?
A transaction dispute is the process by which a transaction made without your knowledge is examined by your bank and reclaimed from the counterparty bank within the framework of the card scheme rules. Do not settle for reporting the dispute orally over the telephone; specify each transaction individually, with its date, time, amount and merchant name, through the dispute menu in the mobile app or by a written petition. In the dispute, explain honestly whether the card is in your possession and whether you have shared a password or code. The bank may ask you for a signed dispute form, identification and the criminal complaint report.
During the review, ask the bank to record the disputed amount on the statement as a “disputed transaction”. If the bank rejects the dispute, request the reasoned response in writing; this letter will be one of the most important documents at the stage of the consumer arbitration committee (tüketici hakem heyeti) or the consumer court.
Which Evidence Should I Keep?
- Notification traces: The time of the call to the call centre (a screenshot of the phone’s call history), the application number, and the notification SMS from the bank.
- Attack traces: The full address of the link you clicked, a screenshot of the fake website, the number that called you, and WhatsApp correspondence. Do not delete messages and do not reset the phone.
- Transaction traces: Account and card statements, OTP messages, merchant names and transaction times.
- Official traces: The criminal complaint petition or the statement record, and the investigation number.
If a remote access application has been installed on the phone, take a screenshot before deleting the application, then disconnect from the internet and change your passwords from another device. The acquisition of your personal data may also be assessed separately under Articles 135-136 TPC.
Where and How Is a Criminal Complaint Filed?
Obtaining a benefit by using another person’s card or card details without consent is an offence under Article 245(1) of the Turkish Penal Code (TPC, Law No. 5237) punishable by imprisonment from three to six years and a judicial fine of up to five thousand days. The offence is not one prosecuted upon complaint; an application may be made to the Chief Public Prosecutor’s Office, the police or the gendarmerie directly or through a lawyer via the National Judiciary Informatics System (UYAP). Be sure to state in the petition the list of transactions, the time of notification and the details of the account or merchant to which the money was transferred.
Where genuine card details are used, the victim is the cardholder (Article 245(1) TPC); where the details are copied onto a counterfeit card and used, the Court of Cassation accepts the bank as the victim (Article 245(2)-(3) TPC; Criminal General Assembly of the Court of Cassation, E. 2020/281, K. 2022/426, 08.06.2022). The decision concerning cases in which genuine card details were used states as follows:
... the victims of the acts of obtaining genuine credit card details belonging to bank customers and making purchases are the account holders, and in the use of cards allocated to different persons, Article 245/1 of the TPC, as many times as the number of victims, ...
— Court of Cassation, 8th Criminal Chamber, E. 2019/11632, K. 2019/12206, 14.10.2019
It is therefore important that you file a complaint in the investigation file as the person harmed by the offence, document your loss and, once a public prosecution is brought, join the proceedings as an intervening party (katılan). If the money has been transferred to another account or a crypto platform through the use of information systems, the recipient account may be suspended for up to 48 hours under Article 128/A of the Code of Criminal Procedure (CCP, Law No. 5271). We have explained how the process works in our article Suspension of Bank and Crypto Accounts (Article 128/A CCP). If the card transactions were carried out through a fake advertisement, our article on fake advertisement fraud will also provide guidance.
Card Fraud and Cybercrimes Attorney in Istanbul
Proof that the notification was made in time, the content of the dispute petition and the correct framing of the criminal complaint determine the outcome both against the bank and in the criminal investigation. As Coşkun Genç Law Office, we serve card fraud victims and our clients in the field of cybercrimes in Istanbul, particularly in files at the Anatolian Courthouse (Anadolu Adliyesi) in Kartal and the Istanbul Courthouse (İstanbul Adliyesi). For an assessment of your case, you may contact us.
Important: This article is for general information purposes and does not substitute for legal advice. Please seek the assistance of a lawyer for your specific case.