Cybercrime Lawyer: Which Cases Do They Handle, How Does the Investigation Proceed and What Should You Look for When Choosing a Lawyer?

Last updated: 15.10.2026 · Author: Attorney Coşkun Genç, Istanbul cybercrime lawyer

What Does a Cybercrime Lawyer Do?

A cybercrime lawyer follows the file from the first stage of the investigation onwards in order to understand how the incident occurred, to assess the digital traces, to make the correct legal characterisation and to prevent any loss of rights. The role is not limited to representation at the hearing; preparing the criminal complaint or the defence petition, attending statement-taking procedures, submitting requests for evidence, examining expert reports and following the hearings are also part of this work.

At the first meeting, the date of the incident, the telephone or computer used, bank movements, message records, user accounts, transaction numbers and the persons connected with the incident are identified. It is then assessed whether the existing documents have been preserved in a lawful manner. The roadmap varies according to the client's position:

• For the victim: Establishing the loss, tracing the money transfers and identifying the suspects take priority.
• For the suspect: It is investigated who the actual user of the bank account, telephone line or device is, whether the transactions were carried out without the person's knowledge, and how reliable the digital records are.

Which Cases Does a Cybercrime Lawyer Handle?

A cybercrime lawyer handles criminal files concerning acts committed by means of computers, mobile phones, the internet, social media and electronic payment systems. Articles 243, 244 and 245 of the Turkish Penal Code (TPC, Law No. 5237) regulate the basic offence types in this field (accessing a system, obstructing a system, disrupting it, altering or destroying data, misuse of cards). Fraud in which an information system is used as an instrument, offences relating to personal data and illegal betting, on the other hand, are assessed under different provisions. The files most frequently encountered in practice are the following:

• Fraud over the internet, and acts carried out through fake websites or fake accounts
• Takeover of a social media account and unlawful access to an information system
• Misuse of bank and credit cards
• Unlawful acquisition or sharing of personal data, violation of the privacy of private life
• Threats and insults over the internet, and blackmail in the digital environment
• Money transfers connected with illegal betting (Law No. 7258 on Betting and Games of Chance in Football and Other Sports)

It is not sufficient to regard the file merely as “an offence committed over the internet”; the same bank movement may constitute a different offence depending on the perpetrator's method:

For the details of this distinction, see our articles Fraud Through the Use of Information Systems and Credit Card Fraud.

What Stages Does a Cybercrime Investigation Go Through?

A cybercrime investigation generally begins with a complaint or a report and, after the stages of evidence gathering, technical examination and statement-taking, ends with the public prosecutor's indictment or decision of non-prosecution. Not every file proceeds in the same way; whether the incident is connected with card fraud, unauthorised access, a data breach or illegal betting changes the provisions to be applied and the evidence to be gathered.

1. Complaint or report: The process begins with a criminal complaint filed with the Chief Public Prosecutor's Office, a complaint lodged with law enforcement (police/gendarmerie), a report, or a link emerging from system records. The complaint should set out in an orderly manner the date of the incident, the platform used, the suspicious accounts, the contact details and the money transfers.
2. Gathering of digital evidence: The public prosecutor's office may request bank records, subscriber information, IP and log records, HTS records (historical traffic search – call detail records), camera footage and platform data. Not only the first account to which the money was sent, but also the actual user of that account, the other accounts through which the flow of money continued and the devices used may be investigated.
3. Technical examination and seizure: Computers, telephones and digital accounts may be examined; devices may be seized. Through these measures, an attempt is made to establish the source and timing of the data and the movements on the system.
4. Statement: The suspect is summoned by law enforcement or the public prosecutor's office to give a statement; the victim's account is also taken.
5. Decision: If there is sufficient suspicion of an offence, an indictment is issued and a public prosecution is brought; otherwise, a decision of non-prosecution is rendered.

At this stage, the lawyer prepares the client for the statement, determines the documents to be submitted to the file and requests that incomplete inquiries be completed. On behalf of the victim, examination of the suspicious accounts and money movements is requested; if the money has been transferred to another account through the use of information systems, the suspension of the recipient account for up to 48 hours under Article 128/A CCP may come into question. On behalf of the suspect, the technical records on which the accusation is based are assessed in detail.

How Does a Cybercrime Case Proceed After the Indictment?

With the acceptance of the indictment by the court, the prosecution (trial) phase begins and the file moves on to a trial with hearings. Since aggravated fraud was removed from Article 12 of Law No. 5235 by Law No. 7571, aggravated fraud cases under Article 158 TPC are now, as a rule, heard by the criminal court of first instance; however, files that were pending before the high criminal court or at the appeal stage when this amendment entered into force are concluded under the previous rules on subject-matter jurisdiction pursuant to provisional Article 7 of Law No. 5235. At this stage, the lawyer continues the defence or the representation of the victim by assessing the expert reports, witness accounts, money movements and digital records together. The following issues in particular are debated at trial:

• Whether the elements of the offence specified in the indictment have been constituted and whether the legal characterisation of the offence is correct
• The reliability of the digital evidence and whether it was obtained lawfully
• Witness and expert assessments, and incomplete or contradictory points in the expert report
• Whether there is any pecuniary damage
• Whether a link can be established between the incident and the defendant

In practice, the debate over the legal characterisation of the offence is decisive. Emphasising that only a human being, not an information system, can be deceived, the Court of Cassation distinguishes fraud from theft and cybercrimes as follows:

Since the deception of an information system cannot be spoken of, this subparagraph may be applied only where a human being is deceived, that is to say defrauded, through the use of that system as an instrument. Otherwise, that is to say, where no person has been deceived by entering the system but a benefit has been obtained by making use of the system, a cybercrime or the offence of theft through the use of an information system shall be constituted.
— Court of Cassation, 11th Criminal Chamber, E. 2021/17211, K. 2024/11892, 17.10.2024

In fraud files, full compensation of the damage before the prosecution (trial) phase begins results in a reduction of the penalty by up to two thirds, and compensation after the prosecution phase has begun but before the judgment results in a reduction by up to one half (Article 168 TPC). For this reason, the choices made at the investigation phase directly affect the course of the case.

Is a Screenshot, IP Address or Account Record Sufficient on Its Own?

No; a piece of information obtained in the digital environment does not by itself amount to a definitive conclusion and must be assessed together with other technical and legal evidence. Whether a social media post was actually made by the person concerned cannot be determined merely by looking at a screenshot; possibilities such as the account having been taken over, its being used by someone else, or the integrity of the record must be investigated.

The most frequent mistake in these files is to treat the account holder or the subscriber of the line directly as the perpetrator. What matters is not merely the existence of a technical record, but how it is linked to the incident and to the person concerned. In the defence, the following questions should be asked one by one:

• To whom was the examined IP address allocated, and on what date and from which device was the transaction carried out?
• Who actually used the device and the bank account; did the account details fall into the hands of third parties?
• Could the telephone line have been taken over or the identity details misused?
• Are the bank movements consistent with the account of the incident; through which accounts did the money pass and whom did it reach?

An incorrect IP match, a bank account made available for use by a third party, a line that has been taken over or card details used without authorisation may change the outcome of the file. The details of the subject are discussed in our articles Are IP Address and CGNAT Records Evidence? and Identifying the Actual User of a Bank Account.

What Should a Person Under Cybercrime Investigation Do?

Without panicking, the suspect should first find out what the accusation is and what evidence is in the file and, if possible, consult a lawyer before giving a statement. The explanations made and statements given during the investigation carry weight at later stages; one of the biggest mistakes is to give the first statement without legal assistance.

Legal assistance should be obtained without delay particularly in the following situations:

• If you have received a summons to give a statement
• If your telephone, computer or other devices have been seized
• If it is alleged that transactions were made through your account, or if your bank account has been frozen
• If a police custody order or a search warrant has been issued

The defence must be based on verifiable technical and financial records. In illegal betting files, for example, playing bets, organising betting, providing a venue or facilities, advertising and acting as an intermediary in the transfer of money are regulated separately from one another in Law No. 7258; a person's liability is determined according to his or her actual role in the file. This process is also explained in our article Illegal Betting Investigation: Statement, Account Freeze and Defence.

What Should a Cybercrime Victim Do First?

The victim should first stop the loss from growing, then preserve the digital evidence without deleting it and file a detailed criminal complaint. Since digital data can be altered or deleted quickly, it is more appropriate to obtain a legal assessment first, rather than deleting or altering records or creating a new situation by contacting the other party.

• Preserve the records: Keep messages, e-mails, usernames, profile links and the details of the relevant web page without deleting them.
• Keep the payment trail: Record bank receipts, transaction numbers and the dates of conversations.
• If a card is involved, call the bank immediately: Block the card and dispute the suspicious transactions.
• Secure your accounts: Change your passwords in a secure manner.
• File a criminal complaint: In the petition, clearly state not only the loss but also the suspicious accounts, the contact details and the available digital evidence; prepare a chronology of events.

Screenshots are important but are not always sufficient on their own; the source of the messages, the transaction times, bank records and the information that may be requested from platforms should be considered together. Requesting bank records in good time and describing the chain of transactions clearly make the file easier to understand.

What Should You Look for When Choosing a Cybercrime Lawyer?

In choosing a lawyer, knowledge of digital evidence, experience in similar cases, transparent communication and a strategy specific to the file should be decisive, rather than the office's location, online visibility or the amount of the fee. Cybercrime files require, in addition to knowledge of criminal law, an understanding of how digital evidence is obtained and assessed.

• Approach to technical records: The lawyer is not expected to carry out every technical operation personally; however, he or she must be able to understand the expert report, identify incomplete or contradictory points and, where necessary, request a new examination. At the first meeting, you may ask how the lawyer approaches IP and log records, bank movements, telephone examination reports and social media data.
• Experience in similar cases: There is a difference between the takeover of a social media account and the use of a bank card, both in terms of the elements of the offence and the evidence to be examined. Experience helps to determine which records should be requested and at what stage the defence should be prepared.
• Listening to the file: Asking about the transaction dates, the devices used, the persons involved and the available documents, instead of merely learning the name of the accusation, shows that an assessment specific to the file is being made.
• Transparency of fees and scope: The scope of services such as the statement, examination of the file, submission of evidence, objection to the expert report and following the hearings, as well as the fee, payment terms and excluded expenses, should be discussed at the outset and recorded in a written agreement.
• Regular updates: The client should be informed at appropriate intervals of important notifications, expert reports, hearing dates and interim decisions; it should also be borne in mind that there may not be new developments every day.

Instead of guarantees such as “certain acquittal”, “the file will certainly be closed” or “the freeze will definitely be lifted”, an approach that realistically explains the strengths and weaknesses of the file should be sought. In criminal proceedings, the outcome depends on the particular features of the specific case, the evidence and the assessment of the judicial authorities. The regulations of the Union of Turkish Bar Associations (Türkiye Barolar Birliği) also aim to ensure that legal services are not presented in a misleading manner.

What Should Those Looking for a Cybercrime Lawyer in Istanbul Consider?

For someone looking for a lawyer in Istanbul, for example in Kadıköy or Ataşehir, an office nearby makes meetings easier; however, the real criterion is the time devoted to the file, the legal preparation and the quality of communication. As Coşkun Genç Law Office, we act both as defence counsel for suspects and defendants and as attorneys for victims in cybercrimes files in Istanbul, particularly those heard at the Anatolian Courthouse (Anadolu Adliyesi) in Kartal and at the Istanbul Courthouse (İstanbul Adliyesi).

For an assessment of your specific file, you can reach our office through our contact page.