Legal Liability for Transactions Made with a Stolen Credit Card: Does the Bank or the Cardholder Pay? A Guide with Court of Cassation Decisions
Last updated: 14.10.2026 · Author: Attorney Coşkun Genç, Istanbul cybercrime lawyer
Short answer: In transactions made with a stolen credit card or with stolen card details, the loss does not automatically remain with the cardholder. According to the Civil General Assembly of the Court of Cassation, because banks are institutions of trust, they are liable even for their slightest fault. Where the cardholder is not at fault, the risk of misuse is borne by the card-issuing institution. By contrast, a cardholder who shares his or her PIN or SMS code with a third party, or who delays notification, may have to bear all or part of the loss on account of gross negligence. In each case, liability is determined by weighing the bank's security measures against the cardholder's conduct, often through an expert examination. A criminal investigation is also conducted against the perpetrator under Article 245 of the Turkish Penal Code (TPC).
Who Pays for Spending Made with a Stolen Card?
This question is answered by the law, the contract and case law together. Law No. 5464 imposes on the cardholder an obligation to protect the card and the PINs and to report theft immediately. In return, the bank is under a duty to establish a secure system, to monitor unusual transactions and to protect its customer. We have explained the notification and dispute steps to be taken in the first hours in our article My Card Details Were Stolen: What Should I Do in the First 24 Hours? This article, on the other hand, examines who is liable, and to what extent, once the loss has occurred.
Law No. 5464 on Bank Cards and Credit Cards – Article 15
Article 15 – Obligations relating to the use of the card
Liability arising from the use of the card shall rest with the cardholder from the moment the contract is signed and the card passes into his possession or, in the case of a card having no physical existence, the card number is learned.
The signature panel of the card must be signed by the cardholder. Where the member merchant so requests, the cardholder shall be obliged to present an identity document when using the card.
The cardholder may not be held liable for losses arising from unlawful use in purchases of goods and services made through various means of communication or by means of an order form without a sales slip being issued pursuant to Article 20 of this Law.
The third paragraph is frequently overlooked in practice: the cardholder cannot be held liable for unlawful transactions made by telephone or by order form without a sales slip being issued. The TRY 150 limit provided for the 24 hours preceding notification, on the other hand, is regulated in Article 12 of Law No. 5464 and is reproduced verbatim in our first-24-hours article.
When Is the Bank Liable Even for Its Slight Fault?
The Civil General Assembly of the Court of Cassation held that no fault could be attributed to a cardholder whose wallet was stolen on a minibus and who reported this within minutes, in respect of a purchase made with a forged signature four minutes before the notification. Since the incident occurred before Law No. 5464, the Assembly applied the general provisions and required the bank's liability to be determined by having an expert investigate the adequacy of the security system it used. The Assembly emphasised the nature of banks as special institutions of trust:
Indeed, having regard to Article 99 of Code of Obligations No. 818 (BK), which must be applied to the dispute in view of the dates of entry into force, and to the provision in Article 115 of Turkish Code of Obligations No. 6098 (TBK), which subsequently entered into force, banks, since their activities are subject to licensing and require expertise, may be held liable even for their slightest fault in the services they provide. (...) In cases where the cardholder bears no fault in the card falling into the hands of persons acting in bad faith, the risk of unlawful use is created by the card-issuing institutions (…).
— Court of Cassation, Civil General Assembly, E. 2017/2850, K. 2019/154, 14.02.2019
The same decision stated that standard terms (genel işlem şartları) placing the risk entirely on the customer may be deemed invalid as contrary to public order, and that whether the bank used an adequate security system under the conditions of the time must be investigated by a specialist expert. The 3rd Civil Chamber of the Court of Cassation likewise upheld a first-instance court decision concerning the liability of a bank that allowed an internet banking transaction without obtaining confirmation after the SIM card had been cloned (E. 2024/3854, K. 2025/3493, 23.06.2025).
In Which Cases Does the Cardholder Bear His or Her Own Loss?
The cardholder voluntarily giving his or her PIN, 3D Secure code or internet banking credentials to a third party is one of the typical situations that the Court of Cassation regards as “gross fault”. Failing to notify the bank for days despite knowing that the card has left one's possession, and failing to protect the PIN, are also regarded as gross fault. In a case where PIN-authorised purchases were made with a card stuck in an ATM within the three days preceding the notification, the Civil General Assembly accepted by majority vote that, in such a situation, the causal link between any security deficiency of the bank and the loss may be broken:
Even if it were considered that the bank, which is held liable even for its slightest fault on account of being an institution of trust, was at fault for failing to take adequate measures on the ATM device and should be held liable for the resulting loss, since in the specific case the claimant cardholder bears gross fault in the PIN being obtained by third parties, the causal link between the loss and the fault has been broken in respect of the defendant bank, and the action must be dismissed.
— Court of Cassation, Civil General Assembly, E. 2020/108, K. 2022/1450, 08.11.2022, § 30
In view of the information and documents on which the appealed decision is based and the reasoning stated, and in particular of the finding that the bank employee was the claimant's nephew, that, owing to the kinship and relationship of trust, the claimant had given him all of the claimant's information relating to mobile banking transactions so that he could carry out banking transactions, and that in this situation the bank bears no liability, ...
— Court of Cassation, 3rd Civil Chamber, E. 2025/4860, K. 2026/2088, 09.04.2026
However, sharing a PIN does not always relieve the bank entirely. The 11th Civil Chamber of the Court of Cassation upheld a decision finding 60% at fault a customer who, at the request of a person calling while posing as a bank official, installed a remote access application and gave a code, and 40% at fault the bank, which failed to notice unusual transactions made one after another within a short time (E. 2025/724, K. 2025/5873, 02.10.2025; the case concerned transactions made via mobile banking from a demand gold account). The decision emphasised the banks' obligation to monitor transactions that are unusual and carry a risk of fraud.
| Scenario | General tendency | Decisive question |
|---|---|---|
| Card physically stolen, reported immediately, purchase with a forged signature | Cardholder not at fault; the bank and the merchant may be liable | Time of notification and examination of the signature |
| Transaction by telephone/order form, without a sales slip | Under Article 15(3) of Law No. 5464, the cardholder cannot be held liable | Nature of the transaction |
| SIM card cloned, OTP went to the fraudster | Fault of the bank and the GSM operator is debated | Confirmation and identity verification measures |
| PIN or SMS code knowingly shared | Gross fault of the cardholder; the bank is often not liable | Circumstances of the sharing |
| Code shared, but the transactions clearly unusual | Fault may be apportioned (e.g. 60%–40%) | The bank's transaction monitoring system |
| Notification delayed for days | TRY 150 limit is lost, liability increases | When the holder became aware |
Important note: In these cases, the outcome is often determined by the expert report. The report should examine the bank's log records, device and IP changes, SIM change notifications, transaction limits and risk scoring; a report that confines itself to the finding that “the transaction was made with the PIN” should be challenged. For the evidential value of IP records, our article Is an IP Address Evidence on Its Own? may be consulted.
What Legal Remedies Are Available Against the Bank?
- Written application to the bank: If the dispute is rejected, a reasoned response and the transaction records should be requested.
- Consumer arbitration committee (tüketici hakem heyeti): For 2026, application is mandatory in disputes below TRY 186,000. The application can be made via e-Government (e-Devlet).
- Mediation and consumer court: In disputes exceeding the threshold, applying to a mediator before filing a lawsuit is a precondition to bringing the action. The action is often brought as a negative declaratory action (a declaration that no debt is owed) or for the refund of the amount paid.
- Statute of limitations: Contractual claims against the bank are, as a rule, subject to a ten-year limitation period under Article 146 of the Turkish Code of Obligations (TCO); if the claim is based on tort, the shorter periods under Article 72 TCO may come into play. One should therefore act before the evidence is lost.
For Which Offence Is the Person Who Used the Stolen Card Tried?
Turkish Penal Code (Law No. 5237) – Article 245(1) and (3)
(1) Any person who, by whatever means, obtains or holds a bank or credit card belonging to another and, without the consent of the cardholder or of the person to whom the card should be given, uses it or causes it to be used and thereby obtains a benefit for himself or for another shall be punished with imprisonment of three to six years and a judicial fine of up to five thousand days.
(3) A person who obtains a benefit for himself or for another by using a counterfeit or falsified bank or credit card shall, unless the act constitutes another offence requiring a heavier penalty, be punished with imprisonment of four to eight years and a judicial fine of up to five thousand days.
Physical possession of the card is not required. The use of card details for online shopping is likewise assessed within the scope of Article 245(1):
The settled case law of our Chamber has emphasised that where bank or credit card details, and thereby personal data, are obtained but not used elsewhere, the offence regulated in Article 136 TPC is constituted, whereas obtaining an unjust benefit by using such details constitutes, owing to its nature as a transitional offence (geçitli suç), solely the offence set out in Article 245(1) TPC.
— Court of Cassation, 8th Criminal Chamber, E. 2021/11863, K. 2021/17643, 15.09.2021
If the money was withdrawn from the account via internet banking rather than by card, Article 142(2)(e) TPC (theft through information systems) comes into play, and where there is deception, Article 158(1)(f) TPC; for the distinction, see our article on fraud through information systems. Pursuant to Article 245(5) TPC, the provisions on effective repentance relating to offences against property apply to the offence in Article 245(1); this provision does not apply to the use of a counterfeit or cloned card (Article 245(3)) (Court of Cassation, 8th Criminal Chamber, E. 2019/11632, K. 2019/12206, 14.10.2019). The holder of the account to which the money was transferred may be liable under the provisions on participation in an offence (Articles 37–39 TPC) if he or she knowingly allowed the account to be used. If the act constitutes fraud (Articles 157–158 TPC) and the account holder's contribution consists solely of providing the information or means enabling the account to be used, his or her penalty is reduced by half under Article 158(4) TPC, added by Law No. 7589; this provision does not create a new liability and does not apply to the offences under Article 245 TPC. For details, see our article on IBAN victims. The suspension of the recipient account, in turn, is the subject of our article on Article 128/A CCP.
Istanbul Credit Card Fraud Lawyer
In the action to be brought against the bank, the apportionment of fault, and in the criminal file, the identification of the perpetrator and the redress of the loss, must be managed together. As Coşkun Genç Law Office, we provide legal support in Istanbul, particularly at the Anadolu Courthouse (Anadolu Adliyesi) in Kartal and the Istanbul Courthouse (İstanbul Adliyesi), in card fraud and cybercrime cases, both to victims and to suspects and defendants. For an assessment of your case, you can contact us.
Important: This article is for general information purposes only and does not constitute legal advice. Please seek the assistance of a lawyer for your specific case.
Related articles: Credit Card Fraud (TPC 245) · identifying the actual user of a bank account