SIM Card Cloning and Account Takeover: Liability of the Bank and the Mobile Operator

Last updated: 25.10.2026 · Author: Attorney Coşkun Genç, Istanbul cybercrime lawyer

In SIM card cloning and account takeover cases, the victim's first question is who will pay the money back. In the practice of the Court of Cassation, the operator that issues a new SIM card without adequately verifying identity and the bank that approves a transaction by SMS password without noticing the SIM change are, in many cases, held jointly liable for the same loss. This article examines the obligations of both parties, the apportionment of fault, the criminal law dimension and the victim's first steps.

What is SIM card cloning (SIM swap), and how is an account taken over?

SIM card cloning, also referred to in practice as a "SIM swap", is a transaction whereby the line holder's number is moved to another SIM card without his or her knowledge. Rather than a physical copy, it involves a "lost or faulty SIM" application made to the operator or its dealer with a forged identity document or one belonging to someone else, resulting in a new card being issued for the same number. Once the new card is activated, calls and SMS messages sent to the number go to the perpetrator's device.

At this stage the perpetrator uses the customer number and password previously obtained through phishing or leaked data. Because the one-time password (SMS OTP) now reaches him, password resets, activation of the mobile app on a new device and EFT transfers can be completed within minutes. The first sign the victim notices is often a "No SIM" warning suddenly appearing on the phone.

The opening of a new line in your name without your knowledge is a separate situation; for that, see the article on lines opened in your name and "potato lines" (patates hat).

My line was suddenly cut off: what should I do in the first hours?

If your line has been cut off for no apparent reason, you should call the bank and the operator from another phone and have every notification recorded with its time; transfers are usually made shortly after the line goes down.

1. Fraud notification to the bank: Call the bank's call centre from another line; have your internet and mobile banking access blocked, report the suspicious transactions, and note the time of the call and the reference number. The Regulation provides that, for loss, theft and fraud notifications, a customer connected to an agent may make the notification even without identity verification, and that the necessary security measures must be taken (Article 40(1) of the BDDK Regulation).
2. Notification to the operator: Ask whether a SIM change or number porting has been carried out on your line, have the line suspended, and obtain the new SIM card yourself after verifying your identity. Request the date, time and dealer details of the transaction carried out.
3. Accounts to which the money was sent: Ask the bank in writing to take action regarding the recipient accounts; the suspension of the accounts (Article 128/A CCP) may also be requested from the prosecutor's office.
4. Other accounts: Change the passwords of e-mail, social media and crypto accounts linked to the same number from a trusted device; switch from SMS to app-based authentication.
5. Criminal complaint: Submit a petition to the Chief Public Prosecutor's Office setting out the events in chronological order with times; request that the SIM change transaction document, the dealer's camera footage and the traffic records be obtained.
6. Written application: Make separate written applications to the bank and to the operator; expressly request the preservation of call centre voice recordings and transaction and device logs.

For the dispute procedure regarding card spending, see the guide on the first 24 hours after card details are stolen.

What is the mobile operator's identity verification obligation?

The mobile operator is obliged to verify that the person requesting a SIM change is in fact the line holder, and it is also liable for its dealer's negligence in this respect. The basic rule is found in Article 56 of the Electronic Communications Law No. 5809. The Article prohibits the unauthorised copying of cards carrying subscriber information, the submission of untrue documents, and the carrying out of subscription transactions without the person's knowledge.

The detailed procedure is set out in the BTK's Regulation on the Process of Verifying the Identity of Applicants in the Electronic Communications Sector. The Regulation expressly covers cases where documents relating to a SIM change application are drawn up electronically, and provides for identity to be verified by methods such as the e-Government Gateway (e-Devlet Kapısı), video verification with an electronic identity document, verification of a chip-based identity card with a PIN or fingerprint, or a transaction-specific video recording in face-to-face channels (Articles 1 and 5). By an amendment published in the Official Gazette of 11.06.2026 and in force since 25.06.2026, the verification methods were reorganised on the basis of the electronic identity document.

From the victim's perspective, the two most important provisions are these: the correct identification of the applicant is the responsibility of the operator (Article 7(11)), and the burden of proof in transactions within the scope of this Regulation lies with the operator (Article 11). The Regulation on Consumer Rights in the Electronic Communications Sector likewise places the burden of proof on the operator for all transactions carried out with subscriber approval, and requires that the subscriber be able to access transaction documents through the online transaction centre (Articles 8(4) and 8(7)). The operator is also liable for the acts of its dealer; an obligor is obliged to compensate for damage caused by auxiliary persons it uses in the performance of the obligation (Article 116 TBK).

Is the bank required to detect the SIM change?

Yes. The BDDK's Regulation on Banks' Information Systems and Electronic Banking Services requires the bank, before sending an SMS OTP, to determine through integration with operators whether the customer's SIM card has been changed and, until the change is confirmed, not to use SIM-based authentication for 90 days.

An SMS OTP may not be sent for session or transaction approval to a customer who has activated the mobile app; the only exceptions are initial installation and reactivation (Article 34(7)), and that is precisely the moment the attacker targets. Information on the identity card and the mother's maiden name may not be used in identity verification (Article 34(10)). The burden of proving that transactions carried out without two-factor authentication were carried out by the customer lies with the bank (Article 34(3)).

The bank is further obliged to establish a monitoring mechanism that detects unusual transactions and to warn the customer as soon as possible in the event of a risky transaction (Article 36), and to check that the line has not been forwarded before calling the customer on the registered number (Article 40(4)).

How do the courts assess the bank's diligence?

In a consumer case upheld by the 11th Civil Chamber of the Court of Cassation, the court of first instance found that the bank had acted in breach of Article 34(8) by failing to apply two-factor authentication to a customer whose SIM had been changed and by failing to warn the customer of an EFT made from a different IP address (E. 2024/229, K. 2024/5935). In another upheld decision, the issuance of a new SIM immediately followed by the renewal of the internet password was considered "unusual and suspicious", and the bank's approval of the transaction after merely asking for the place of birth and address was regarded as a lack of diligence (E. 2022/2636, K. 2023/6087).

In another case the banks had suspended the accounts after the SIM change, but a call centre agent lifted the block even though the caller had answered the questions incorrectly. The courts of first instance and the regional court of appeal held the bank liable, and the Court of Cassation dismissed the bank's appeal (E. 2023/343, K. 2024/4029). By contrast, in a case where it was understood from the file that the bank had taken all measures, the Court of Cassation reversed the judgment with respect to the bank (E. 2020/3364, K. 2021/49). The bank's liability is not automatic.

Is the bank or the mobile operator liable for the loss?

In most cases both are jointly liable; the share between them is determined according to the degree of fault. Where several persons jointly cause the same damage, or are liable for the same damage on different grounds, the provisions on joint and several liability apply (Article 61 TBK). In that case the victim may claim the entire loss from any one of those liable; in the internal relationship, the one who pays more than its share has a right of recourse against the other, and the apportionment takes into account the gravity of fault and the danger created (Article 62 TBK).

In a recourse action brought against the operator by a bank that had compensated its customer, the Court of Cassation reversed the regional court of appeal's judgment finding equal fault and stated that 75 per cent of the fault should be attributed to the operator. The reasoning of the decision sets out the obligations of both parties together:

"Banks, being institutions of trust, are required to protect the deposits entrusted to them, to investigate the risks of the SMS system in internet banking transactions and to take the necessary measures, and the claimant bank is at fault for the damage that occurred. However, since the fraudulent transactions forming the subject of the action were completed through the use of the one-time password sent by message to the SIM card, the defendant GSM company, which failed to carry out the necessary and sufficient examination as to whether the SIM card change was made by the genuine line holder, bears greater fault in the occurrence of the damage…"

Court of Cassation, 11th Civil Chamber, E. 2020/5620, K. 2022/2858, 06.04.2022 (reversal; the Chamber's own reasoning)

The fault ratio is determined in each case through an expert examination; 75 per cent is not a rule applicable to every incident. If the victim is also at fault, the judge may reduce or deny compensation (Article 52 TBK); however, since in a SIM swap the code never reaches the victim, it falls to the bank to prove the customer's fault with concrete evidence.

Against whom and where is the action brought?

For individual customers, banking and subscription relationships are consumer transactions; the consumer court has jurisdiction over disputes, and the action may also be brought at the consumer's place of residence (Article 73 of the Consumer Protection Law (TKHK)). Applying to a mediator before filing the action is a precondition to suit; disputes whose value falls within the jurisdiction of the consumer arbitration committee are exempt from this requirement (Article 73/A TKHK). The general limitation period for claims based on breach of contract is ten years; for claims based on tort it is two years from knowledge and in any case ten years; if the act constitutes an offence subject to a longer criminal limitation period, that period applies (Articles 72 and 146 TBK).

Practice is not uniform on bringing an action directly against the operator. In an older decision, the Court of Cassation, noting that the forgery had been committed against the bank, upheld the judgment holding that the customer could not direct the action against defendants other than the bank (E. 2012/16072, K. 2013/12851). In a more recent consumer case, however, in an action brought by the customer against both the bank and the operator, the operator's appeal was dismissed (E. 2020/3364, K. 2021/49). Where the customer sues only the bank, the operator's fault is discussed in a separate action to be brought by the bank:

"…having regard to the fact that whether the third party notified, ... A.Ş., bears any fault in the withdrawal of money from the claimant's account may be discussed in another action that the defendant Bank may bring against ... A.Ş., and that the judgment is not of a nature to produce res judicata effects as to whether ... A.Ş., which is not a party to the action, is at fault…"

Court of Cassation, 11th Civil Chamber, E. 2023/6174, K. 2024/7619, 04.11.2024 (upheld; the bank was held liable to its customer)

Which offences arise in SIM card cloning?

A perpetrator who changes a SIM with a forged identity and transfers money from the account is, as a rule, liable for aggravated fraud and forgery offences; depending on the facts, cybercrimes and personal data offences may also arise. The main offences are as follows:

• Aggravated fraud (Article 158(1)(d) and (f) TPC): Article 158 TPC treats as aggravating circumstances the use of the material existence of a public institution, such as a forged identity card, as an instrument (sub-paragraph (d)), and the use of information systems and banks as an instrument (sub-paragraph (f)). The penalty is imprisonment from three to ten years and a judicial fine; under sub-paragraph (f), the minimum term of imprisonment is four years and the judicial fine may not be less than twice the benefit obtained from the offence. If committed by three or more persons, the penalty is increased by one half, and if committed within the activities of an organisation, it is doubled (Article 158(3)). For the general elements of the offence, see the article on fraud through the use of information systems.
• Forgery of official documents (Article 204 TPC): A person who forges or uses a forged identity card is punished with imprisonment from two to five years; if the perpetrator is a public official, the penalty is from three to eight years.
• Forgery of private documents (Article 207 TPC) and Article 63(10) of Law No. 5809: Drawing up and using a SIM change form or subscription document in another person's name may entail imprisonment from one to three years. Law No. 5809, for its part, provides for a judicial fine of one thousand to five thousand days for breach of the first paragraph of Article 56, and of fifty to one hundred days for those who personally carry out transactions in breach of its second to fifth paragraphs.
• Unauthorised access to an information system and disruption of the system (Articles 243 and 244 TPC): Unlawful access to the internet branch entails imprisonment of up to one year or a judicial fine; altering data or sending it elsewhere and thereby obtaining an unjust benefit entails, provided that it does not constitute another offence, imprisonment from two to six years and a judicial fine (Article 244(4)).
• Unlawful disclosure or acquisition of personal data (Article 136 TPC): A person who unlawfully acquires the victim's personal data or gives it to the perpetrator is punished with imprisonment from two to four years.
• Misuse of bank or credit cards (Article 245 TPC): Where a bank or credit card belonging to another is obtained and used without the cardholder's consent to obtain a benefit, imprisonment from three to six years and a judicial fine apply.

The 15th Criminal Chamber of the Court of Cassation dismissed on the merits the appeal against the conviction, under Article 158(1)(d) and (f) TPC and the provisions on attempt, of a defendant who, anticipating that the bank branch would call the customer for confirmation, had first obtained a new SIM card for the victim's line with a forged identity card (E. 2019/15809, K. 2020/1017). The Chamber also pointed out that the act of SIM change could be made the subject of a separate prosecution. In another decision, concerning a line issued by an operator employee without the person's knowledge, acquittals were reversed on the ground that assessment of the act under Article 158(1)(d) and Articles 56(2) and 63(10) of Law No. 5809 falls within the jurisdiction of the high criminal court (E. 2017/37405, K. 2021/3157). The investigation of aggravated fraud is not dependent on a complaint.

What evidence should be gathered, and what are the common mistakes?

In both the compensation action and the criminal investigation, the decisive factor is to establish with documents the time link between the SIM change and the outflow of money:

• ✓Account statements, receipts and notification e-mails from the bank
• ✓A screenshot showing the moment the line was cut off and a timeline of events with times
• ✓The SIM change transaction document from the operator: date, time, dealer, the identity verification method used and any video recording
• ✓The bank's login, device, IP and password reset logs and call centre voice recordings (Article 40(5) of the BDDK Regulation)
• ✓Reference numbers of notifications made to the bank and the operator, and their written replies
• ✓The criminal complaint petition, the statement record and the investigation number

Which device the new SIM card was inserted into and from which base station it was used are often the strongest evidence for identifying the perpetrator. For the period these records should cover, see the article on HTS records and the period they should cover.

Exceptions and common mistakes

• Resetting the phone: Restoring the device to factory settings or deleting messages in panic may eliminate the possibility of proving the time the line was cut off and the notifications received.
• Having shared the code: For a customer who read out the verification code to someone posing as a bank employee, the incident is no longer a SIM swap but social engineering; the argument for contributory fault becomes stronger.
• Overlooking the date of the incident: The BDDK Regulation entered into force on 15.03.2020 and the BTK identity verification regulation on 01.03.2022; for earlier incidents, the rules in force at that time apply.
• Skipping mediation: Mediation is a precondition to suit before the consumer court; an action filed directly may be dismissed on procedural grounds.

Compensation and Criminal Complaint Process with an Istanbul SIM Swap Fraud Lawyer

In SIM swap cases, the outcome is often determined by three points: obtaining the SIM change transaction document and dealer records at an early stage, establishing through log records whether the bank detected the SIM change, and building a complete timeline showing that the victim was not at fault. Av. Coşkun Genç Law Office provides legal support in Istanbul in such incidents at the stages of preparing the criminal complaint, following up requests for account freezes and traffic records, applying to the bank and the operator, mediation and the compensation action before the consumer court. In work carried out as an Istanbul SIM swap fraud lawyer, the evidence obtained in the criminal file is also used to determine the fault ratio in the compensation action.

Victims wishing to obtain the support of an Istanbul internet banking fraud lawyer may request a preliminary assessment through our contact page, together with the account statement, receipts, correspondence with the operator and the bank, and a timed account of events. The office's areas of practice can be found on the cybercrimes page.

Sources

1. Electronic Communications Law No. 5809, Articles 56 and 63 – mevzuat.gov.tr
2. BDDK, Regulation on Banks' Information Systems and Electronic Banking Services (Official Gazette 15.03.2020, No. 31069), Articles 34, 36 and 40 – mevzuat.gov.tr
3. BTK, Regulation on the Process of Verifying the Identity of Applicants in the Electronic Communications Sector (Official Gazette 26.06.2021, No. 31523; amendment Official Gazette 11.06.2026, No. 33277), Articles 1, 5, 7 and 11 – mevzuat.gov.tr
4. BTK, Regulation on Consumer Rights in the Electronic Communications Sector, Article 8 – mevzuat.gov.tr
5. Turkish Penal Code (TPC, Law No. 5237), Articles 136, 158, 204, 207, 243, 244 and 245 – mevzuat.gov.tr
6. Turkish Code of Obligations (TBK, Law No. 6098), Articles 52, 61, 62, 72, 116 and 146 – mevzuat.gov.tr
7. Consumer Protection Law (TKHK, Law No. 6502), Articles 73 and 73/A – mevzuat.gov.tr
8. Court of Cassation, 11th Civil Chamber, E. 2020/5620, K. 2022/2858, 06.04.2022
9. Court of Cassation, 11th Civil Chamber, E. 2023/6174, K. 2024/7619, 04.11.2024
10. Court of Cassation, 11th Civil Chamber, E. 2024/229, K. 2024/5935, 03.09.2024
11. Court of Cassation, 11th Civil Chamber, E. 2023/343, K. 2024/4029, 16.05.2024
12. Court of Cassation, 11th Civil Chamber, E. 2022/2636, K. 2023/6087, 23.10.2023
13. Court of Cassation, 11th Civil Chamber, E. 2020/3364, K. 2021/49, 18.01.2021
14. Court of Cassation, 11th Civil Chamber, E. 2012/16072, K. 2013/12851, 19.06.2013
15. Court of Cassation, 15th Criminal Chamber, E. 2019/15809, K. 2020/1017, 28.01.2020
16. Court of Cassation, 15th Criminal Chamber, E. 2017/37405, K. 2021/3157, 18.03.2021