Hijacking of a Social Media Account: How Is the Claim Proven, and What Must the Judicial Authorities Investigate?

Last updated: 17.10.2026 · Author: Attorney Coşkun Genç, Istanbul cybercrime lawyer

In cases where insult, threat, fraud or another offence has been committed through a social media account, one of the most frequently encountered defences is the claim that the account was used not by its owner but by third parties who had hijacked the account. The manner in which this claim is to be investigated is of critical importance both for the protection of genuine victims and for refuting the defences of offenders who attempt to shift the blame for the offence onto someone else.

Which Offences Does the Hijacking of a Social Media Account Constitute?

Obtaining the password of a genuine account does not amount to a single offence; depending on what the perpetrator does in the account, more than one offence comes into play.

• Article 243 TPC – Entering an information system: Any person who unlawfully enters the whole or any part of an information system (e.g. an account), or continues to remain therein, is sentenced to imprisonment of up to one year or to a judicial fine. Where data are destroyed or altered as a result of the entry, the penalty is imprisonment of six months to two years.
• Article 244(2) TPC – Altering data, rendering data inaccessible: Any person who corrupts, destroys, alters or renders inaccessible the data in the system, places data into the system or sends data elsewhere is punished with imprisonment of six months to three years. Changing the password, deleting posts or sending messages from the account are associated with this paragraph.
• Article 136 TPC – Acquiring or disseminating personal data: Any person who unlawfully acquires, gives to another or disseminates personal data such as the photographs and correspondence in the account is sentenced to imprisonment of two to four years; the investigation is not dependent on a complaint (Article 139 TPC).
• Article 158(1)(f) TPC – Aggravated fraud: Obtaining money by writing to friends from the account that "money is urgently needed" constitutes fraud through the use of information systems as an instrument. The penalty for aggravated fraud is imprisonment of three to ten years and a judicial fine of up to five thousand days; under this sub-paragraph, the term of imprisonment may not be less than four years and the judicial fine may not be less than twice the benefit obtained.
• Article 107 TPC – Blackmail: Any person who seeks to obtain a benefit by threatening to disclose private content taken from the account is punished with imprisonment of one to three years and a judicial fine of up to five thousand days (Article 107(2)).

Which offence is changing the password? The two approaches of the Court of Cassation

The decisions do not point in a single direction. Current and prevailing practice treats changing the password so as to block the owner's access as altering data and rendering it inaccessible, and applies Article 244(2) TPC:

"The conviction of the defendant for the offence of unauthorised entry into an information system (…), by erring in the legal characterisation of the offence and without taking into consideration that the defendant's act, carried out by changing the login password of the Facebook account of the intervening party (katılan) and preventing the intervening party's access, constituted the offence of corrupting, destroying or altering data in an information system regulated in the second paragraph of Article 244 of Law No. 5237, has been found to be contrary to law."

Court of Cassation, 11th Criminal Chamber, E. 2021/17801, K. 2023/505, 08.02.2023

In the same decision, requesting money from a friend through the account was additionally held to constitute aggravated fraud, and the conviction to that effect was upheld. In an older decision, however, the 23rd Criminal Chamber of the Court of Cassation held that merely changing the password and acting as the account holder, without interfering with the data, constituted the offence of hindering the functioning of the system under Article 244(1) TPC (E. 2015/9146, K. 2016/6542, 24.05.2016). Since the penalty under that paragraph is imprisonment of one to five years, the legal characterisation directly affects the sentencing range.

Where no password change can be established, the outcome changes once again. The 8th Criminal Chamber of the Court of Cassation applied Article 243(1) TPC in a case in which no password change had been established and the defendant had merely logged in and remained in the account (E. 2017/25385, K. 2018/1217, 07.02.2018; under the pre-2016 text of the article). By contrast, requesting money from a friend in the account holder's name, even where the password had not been changed, was treated as placing data into the system and brought under Article 244(2) TPC (Court of Cassation, 8th Criminal Chamber, E. 2021/17436, K. 2022/2268, 09.02.2022). For this reason, the records of password and profile changes determine the legal characterisation of the offence.

My Instagram Account Was Stolen: What Should I Do in the First 24 Hours?

In the first 24 hours, the aim is to recover the account without losing the evidence. If possible, take screenshots first and intervene afterwards.

1. Recover the account: Use the platform's official recovery procedure; also change the password of the e-mail account linked to the account.
2. Close the sessions: Remove the devices you do not recognise and enable two-step verification.
3. Notify the platform and the people around you: Report the hijacking; announce to your followers that they should disregard any requests for money made in your name.
4. Preserve the evidence: Take screenshots of the perpetrator's messages and posts together with the URL and the date and time; do not delete security e-mails such as "your password has been changed".
5. Have your device examined: If malware is suspected, have a digital forensic examination carried out before resetting the device; a reset also erases the perpetrator's traces.
6. File a criminal complaint: Apply with the evidence to the Chief Public Prosecutor's Office or to law enforcement (police/gendarmerie); friends of yours who sent money should also file complaints.

Evidence and document checklist

• ✓Screenshots showing the URL and the date and time
• ✓Notifications of password, e-mail and telephone changes and of new logins
• ✓The report made to the platform and the platform's replies
• ✓Where money was sent, the payment receipts and correspondence
• ✓The registration e-mail address and telephone number showing that the account belongs to you

What Must Be Investigated When It Is Claimed That the Account Was Hijacked?

It must be made a subject of examination whether the posts made from the date on which the account is claimed to have been hijacked show any change in subject matter and content, and whether any difference has occurred in the username, profile photograph or account settings.

When faced with a claim that a social media account has been hijacked, the first and most important step to be taken by the judicial authorities is to contact the hosting provider or the social network provider immediately. In this context, the following must be established:

• The date of creation of the account in question and by whom it was created,
• The IP information used when the account was created,
• Whether the account was accessed on the alleged date of hijacking and in the following days,
• Whether a password change was made,
• If access was gained, what the related IP data are.

How Does the Court of Cassation Approach Incomplete Examination?

In one of its decisions, the Court of Cassation examined proceedings conducted on the allegation that the victim's Facebook account and the linked e-mail account had been accessed without the victim's consent and that posts with insulting content had been made. Despite the police findings and the IP data obtained from Microsoft, as regards the trial court;

It was emphasised that the questions of whether the e-mail account had become inaccessible, whether the account was active between the date of the offence and the date of the complaint, and on what date and from which IP the password or profile changes were made had been left unresolved; it was further stated, noting that it had not been determined whether the defendant's internet line had been used by third parties and that the e-mail address had not been conclusively established as belonging to the victim, that this information should be requested from the relevant service providers and, if necessary, an expert examination should be carried out.

Court of Cassation, 8th Criminal Chamber, E. 2018/10148, K. 2019/15288, 18.12.2019 (summary of the decision)

The Court of Cassation found the judgment rendered without these technical investigations having been carried out to be unlawful on the ground of "incomplete examination", and held that, where no password or profile change can be established, the act must be assessed within the scope of Article 243 TPC (entering an information system).

Is the "My Account Was Hijacked" Defence Always Accepted?

No. In the decision of the Gaziantep Regional Court of Appeal, 9th Criminal Chamber, E. 2017/2691, K. 2018/2260, dated 22.11.2018, the defence that the defendant's photographs had been obtained by others and an account opened in his name was rejected on the following grounds:

It was stated that it was not consistent with the ordinary course of life that the photographs had been unlawfully obtained by persons other than the defendant and used as the profile picture on an account opened in his name; that, moreover, there were comments by the defendant's friends under the post, and the claim that another person had hijacked the account solely in order to make comments constituting an offence was not, on its own, credible; and that the defendant did not even claim to have made any application concerning the hijacking of the account.

Likewise, in a case in which the 18th Criminal Chamber of the Court of Cassation examined a request for reversal in the interest of the law (kanun yararına bozma) (E. 2018/4381, K. 2019/1853, 22.01.2019), the trial court had accepted the fact that the social media account that was the subject of the offence had a high number of followers as a decisive criterion in terms of proof, and had assessed that the copying of the perpetrator's photographs from other platforms and their use on this account (the creation of a fake account) was contrary to the ordinary course of life and that this defence did not reflect the truth. The Court of Cassation rejected the request, stating that this finding, being based on the assessment of evidence, could not be reviewed by way of reversal in the interest of the law.

Points to Be Observed by the Defence and the Victim

The practical conclusions drawn from the judicial decisions are as follows: a person who claims that their account has genuinely been hijacked must, as soon as the hijacking is noticed, make an official application to the platform and document that application (the absence of such an application is regarded as a fact that weakens the credibility of the defence), and must preserve as evidence any change in style and subject matter in the content of the posts, password change notifications and alerts concerning unrecognised devices/locations. From the investigating authorities, the following should be requested: that the access IPs be obtained together with port and timestamp information, that these IPs be compared with the suspect's connections and, if necessary, that a digital forensic examination of the devices be carried out.

How Is a Criminal Complaint Filed, and How Are Devices Examined?

Under Article 158 of the Code of Criminal Procedure (CCP, Law No. 5271), a criminal complaint may be filed in writing or orally with the Chief Public Prosecutor's Office or with law enforcement. The petition should set out the URL of the account, the date and time at which the hijacking was noticed, the acts carried out by the perpetrator and the evidence, and should expressly request that the login IPs and the records of password and profile changes be obtained from the platform and from the linked e-mail provider.

The victim may submit their own device for examination with their consent. A search of, and the copying of data from, the suspect's devices are, however, subject to Article 134 CCP: there must be strong suspicion based on concrete evidence, and it must not be possible to obtain evidence by other means; the decision is given by the judge or, where delay would be prejudicial, by the public prosecutor, and the public prosecutor's decision is submitted to the judge for approval within twenty-four hours. By its decision dated 12.02.2026, E. 2023/128, K. 2026/36, the Constitutional Court annulled the article; since the annulment will enter into force on 25.02.2027, the article continues to apply until that date.

Can Account Records Be Requested from the Platform, and What Are the Limits?

They can, but the response does not always arrive quickly or in full. Additional Article 4 of Law No. 5651 on the Regulation of Internet Publications imposes on foreign-based social network providers with more than one million daily accesses from Türkiye the obligation to appoint a representative in Türkiye. However, the provision by the representative to the public prosecutor's office or to the court of the information necessary to reach the perpetrator is regulated in the fifth paragraph only for the offences listed there (sexual abuse of children, public dissemination of information misleading to the public, disrupting the unity of the State, and offences against the constitutional order and against State secrets); account hijacking offences are not on that list.

For this reason, the records often arrive under the platform's own policy or through international mutual legal assistance. The Court of Cassation has found it unlawful to close the investigation immediately on the ground that the information cannot be obtained from abroad:

"that, after all the investigative measures necessary for the identification of the suspect have been carried out, an indictment should be drawn up if the suspect is identified, and, should the suspect not be identified, a standing search order (daimi arama kararı) should be issued and the investigation should be continued throughout the limitation period for prosecution"

Court of Cassation, 4th Criminal Chamber, E. 2022/7943, K. 2022/14015, 02.06.2022 (reversal in the interest of the law)

Common mistakes

• Deleting the perpetrator's messages and the security e-mails after the account has been recovered.
• Restoring the device to factory settings before any examination has been carried out.
• Failing to request the records of password and profile changes in the criminal complaint.

Account Takeover Cases with an Istanbul Social Media Crimes Lawyer

In these cases, the outcome is often determined by three points: preserving the evidence together with its date and time in the first hours, expressly requesting the records of password and profile changes, and having the suspect's devices examined in good time. Av. Coşkun Genç Law Office provides legal assistance in Istanbul to persons whose accounts have been hijacked, in preparing the criminal complaint, requesting the records and following the prosecution, and to persons under investigation on account of posts made from the account, at the statement and defence stages. As an Istanbul social media crimes lawyer, our aim is for the technical records to be entered in the file in full.

Those wishing to obtain the assistance of an Istanbul cybercrime lawyer may request a preliminary assessment through our contact page, together with screenshots, security notifications and any payment receipts. You may also refer to our article on the cybercrime lawyer and to our cybercrimes page.

Sources

1. Turkish Penal Code (TPC, Law No. 5237), Articles 107, 136, 139, 158, 243, 244 – mevzuat.gov.tr
2. Code of Criminal Procedure (CCP, Law No. 5271), Articles 134, 158 – mevzuat.gov.tr
3. Law No. 5651 on the Regulation of Internet Publications, Additional Article 4 – mevzuat.gov.tr
4. Constitutional Court, E. 2023/128, K. 2026/36, 12.02.2026 (annulment of Article 134 CCP; entry into force 25.02.2027)
5. Court of Cassation, 11th Criminal Chamber, E. 2021/17801, K. 2023/505, 08.02.2023
6. Court of Cassation, 23rd Criminal Chamber, E. 2015/9146, K. 2016/6542, 24.05.2016
7. Court of Cassation, 8th Criminal Chamber, E. 2017/25385, K. 2018/1217, 07.02.2018
8. Court of Cassation, 8th Criminal Chamber, E. 2021/17436, K. 2022/2268, 09.02.2022
9. Court of Cassation, 8th Criminal Chamber, E. 2018/10148, K. 2019/15288, 18.12.2019
10. Court of Cassation, 18th Criminal Chamber, E. 2018/4381, K. 2019/1853, 22.01.2019
11. Court of Cassation, 4th Criminal Chamber, E. 2022/7943, K. 2022/14015, 02.06.2022
12. Gaziantep Regional Court of Appeal, 9th Criminal Chamber, E. 2017/2691, K. 2018/2260, 22.11.2018