How Is the Real User of a Bank Account Used in an Offence Identified? Active Use and the "Account Renting" Defence

In types of offence such as cybercrimes, fraud and the laundering of assets derived from crime, the identification of who actually used the bank account or crypto-asset platform account to which the money was sent constitutes one of the most critical stages of the investigation. In particular, "account renting" (hesap kiralama), "use of an account without the holder's knowledge" and transactions carried out through accounts opened in the names of third parties, which have increased in recent years, have further heightened the importance of technical examinations in criminal investigations.

Pursuant to the principle of the free evaluation of evidence that applies in criminal procedure law, all technical data must be assessed together in order to reach the material truth. In this context, examining bank transactions alone is not considered sufficient; it is also expected that it be established by whom, and with what intensity, the account was actually used.

How Is the Active Use of a Bank Account Established?

In examinations conducted by the investigating authorities, it must be investigated whether the account alleged to have been used in the offence was used for ordinary banking activities in daily life. This examination should not be confined solely to wire transfer and EFT records.

In particular, the following technical data are important for identifying the real user of the account:

• The IP addresses from which the account was accessed,
• Mobile banking session records,
• Information on the devices used to carry out transactions,
• Login times and transaction intensity,
• Geolocation data,
• ATM usage records,
• Internet banking activity,
• Transaction frequency and routine usage habits.

By means of these technical data, it can be assessed whether the account was used continuously by the same person or through different persons or devices.

Why Should the Ordinary Usage Habits of the Account Be Examined?

In practice, it is seen that some bank accounts are used by third parties without the knowledge of the account holder. Particularly in internet fraud and illegal betting investigations, situations are encountered in which, alongside persons who allow their bank accounts to be used in return for financial gain, victims whose account details have been compromised are also drawn into the investigations.

For this reason, the investigating authorities must also examine the past usage habits of the account. For example:

• The account remaining dormant for a long period,
• The occurrence of intensive money traffic only within a specific short period,
• Transactions being carried out from different cities or countries,
• The absence of daily banking activity,

Matters such as these may indicate that the account may have been used by persons other than its usual holder.

By contrast, salary payments, automatic bill payment instructions, grocery spending or examples of routine use such as regular financial transactions are among the important data that may show that the account was actively used by the account holder.

Why Is Technical Examination Important in the "Account Renting" Defence?

One of the defences frequently encountered, particularly in offences of fraud committed through information systems, is that the bank account was used by other persons or that the account holder allowed third parties to use the account in return for a certain fee.

In such files, carrying out an assessment based solely on money transfer records may result in the material truth being only partially revealed. For this reason, the judicial authorities must investigate in detail the active use status of the account in the light of technical data.

Technical findings such as the account having been used only briefly on the date of the offence, the absence of ordinary banking transactions, or access having been made from different devices may also raise the possibility that the account holder may be the victim rather than the perpetrator of the offence. However, the account renting defence does not in itself eliminate liability. The Court of Cassation accepts that a person who lets another use his or her account in return for a fee has consented to the transactions to be carried out with that account, and holds that person liable for participation in aggravated fraud committed through the use of information systems and banks as an instrument (Article 158(1)(f) TPC). Under Article 158(4) TPC, added by Law No. 7589, the penalty of a person whose participation is limited to merely providing account, card or password details is reduced by half; this provision does not eliminate the penalty. By contrast, a person in respect of whom there is no evidence, free from all doubt, that he or she knew the account would be used in fraud, or whose account was used without his or her knowledge, lacks intent and must therefore be acquitted. Technical examination serves to distinguish between these two situations.

How Does the Court of Cassation Approach the Investigation of the Active Use of an Account?

The practice of the Court of Cassation also emphasises that it must be investigated whether the bank account was actually used by the defendant. Indeed, in respect of a defendant who claimed that his or her bank card had been taken by someone else, the Court of Cassation has regarded the rendering of a conviction without investigating whether any attempt was made to withdraw money from the account between the date on which the money reached the account and the date on which the freeze was placed, and whether the account was actively used, as an "incomplete prosecution" and has treated it as a ground for reversal.

In the judgment of the 17th Criminal Chamber of the Court of Cassation of the Republic of Türkiye (Court of Cassation, 17th Criminal Chamber, E. 2015/23970, K. 2017/14700, 27.11.2017);

"rendering a conviction of the defendant on the basis of an incomplete prosecution, without regard to the fact that, in view of the defendant's assertion in his defence that his cash card had been taken by his former spouse ..., where a freeze was placed on 13.08.2008 on the money transferred to the defendant's account on 12.08.2008, it was necessary to investigate whether any attempt was made to withdraw money from the account between the date on which the money was transferred to the account and the date on which the freeze was imposed, and whether, as at the date on which the account was opened, the account was an active account in use, to summon the defendant's former spouse ... to the hearing and hear him or her, and to determine the legal situation according to the outcome"

was made the ground for reversal.

Likewise, in the judgment of the 15th Criminal Chamber of the Court of Cassation of the Republic of Türkiye (Court of Cassation, 15th Criminal Chamber, E. 2018/8073, K. 2020/1791, 11.02.2020), in a similar manner;

"in a case where the defendant did not accept the accusations, stated that he had learned to read and write after the date of the offence, the money subject to the offence was withdrawn from a cash machine, and footage of the moment at which the money subject to the offence was withdrawn could not be obtained; whereas the defendant's account activity prior to the incident should have been requested from the bank concerned, it should have been determined whether the account was actively used and, if it was determined to have been used, whether transactions were also carried out from a cash machine, and judgment should have been rendered according to the outcome, rendering judgment on the basis of an incomplete investigation"

a ruling was rendered to this effect. This approach clearly shows how important technical examinations and digital evidence have become in criminal proceedings.

Conclusion

In investigations concerning cybercrimes and financial offences, investigating the active use status of the bank account to which the money subject to the offence was sent is of critical importance not only for identifying the perpetrator but also for preventing innocent persons from incurring criminal liability.

For this reason, the investigating authorities must conduct a comprehensive examination by assessing together technical elements such as IP records, device information, mobile banking data and past usage habits. Particularly in files where defences of "account renting" or "use without the holder's knowledge" are raised, establishing the customary manner in which the account was used plays a decisive role in reaching the material truth.