Where Was the Money Subject to the Offence Spent? Identifying Spending Transactions and the Delivery Address (the Access-Identity-Delivery Triad)

Why Is Identifying the Spending of Strategic Importance?

In the investigation of fraud and similar offences, tracing the proceeds of the offence and establishing what became of them is of great importance. Identifying the commercial businesses where the unlawful gain obtained through information systems was spent is a strategic move capable of changing the course of the investigation. Obtaining the merchant records and simultaneous camera footage of the businesses where the spending took place, by establishing the causal link in a manner free from doubt, clarifies the possible distinction between the account holder and the real offender.

One of the fundamental principles of criminal procedure law is that all evidence in favour of and against the suspect or defendant must be collected in full. In this context, the spending records contained in account statements to be obtained from banks or payment institutions help to reveal by whom and for what purpose the money was actually used. In particular, in purchases made through card payment systems or online banking, it is possible to identify the trade name and full address of the business where the transaction was made. In the disputes before it, the Court of Cassation has also emphasised that it must be investigated how the money received into the defendant's account was disposed of.

What Evidence Should Be Collected Beyond Bank Records?

In some investigations in practice, the mere fact that a money transfer took place is considered sufficient to prove the offence, and the analysis of movements after the account to which the funds were transferred is neglected. However, in order to examine the accuracy of the account holder's defence and to identify possible third parties involved in the process, it is mandatory to obtain data on the businesses where the spending took place. In this context, going beyond bank records, the following complementary evidence should be meticulously investigated:

• POS device ownership information,
• Merchant agreements,
• For the moment the spending took place, simultaneous camera recordings,
• Business employees' witness statements.

What Is the "Access-Identity-Delivery" Triad in Online Purchases?

Money received into the account is not always spent by the offenders physically going to a business; in some cases, it is also seen that, with the money received into the account used in the offence, purchases are made over the internet. In such cases, it is necessary to identify the IP address from which the relevant website was accessed, to analyse the membership data used during the spending, and to obtain the delivery address information of the goods or services purchased and bring it into the case file.

Subjecting these data to a holistic examination is of primary importance for uncovering the real identity of an offender who is attempting to remain anonymous. In other words, for the sake of reaching the material truth, the causal link between the session records (IP, port, log, etc.) on the platform where the suspicious transaction took place, the personal data matching the user profile, and the physical destination of the order (delivery address) must be meticulously established. Failure to investigate this triple data set — Access-Identity-Delivery — will mean that the causal link is left incomplete in cybercrimes and will cast a shadow over the soundness of the proceedings.

How Does the Court of Cassation Approach the Investigation of Spending?

In many decisions of different chambers of the Court of Cassation, the failure to investigate the chain of spending has been treated as insufficient investigation and a ground for reversal. Some of the prominent precedent decisions are as follows:

In view of the statement that the money transferred online from the complainant's company account to the defendant's account was withdrawn at a branch, it was held that the said bank branch should be asked whether there was a security camera recording at the moment the transaction took place, and that the original of the receipt for the withdrawal of the money should be obtained and it should be investigated whether the writing and signatures on it belonged to the defendant. (Court of Cassation, 13th Criminal Chamber, E. 2014/23719, K. 2015/10433)

It was emphasised that the fate of the money deposited into the account registered in the name of the intervening party (katılan), whether it was withdrawn and, if so, by whom and in what manner, and, if it was paid towards a credit card debt, the credit card statement for the period paid and the businesses at which spending was made, should be asked; and that the location of the businesses where the spending was made should be identified and statements of the business owners should be taken as witnesses pursuant to Article 48 CCP. (Court of Cassation, 11th Criminal Chamber, E. 2021/27909, K. 2024/10771, 26.09.2024)

It was stated that a decision should be rendered according to the outcome of an investigation into by whom the IP numbers used to log in to the website where spending was made with the credit card belonging to the intervening party were used on the date and at the time of the offence, with which user information the website was logged into while the spending was made, and to whom and to which addresses the goods or services purchased were delivered. (Court of Cassation, 8th Criminal Chamber, E. 2016/9415, K. 2016/10873, 28.11.2016)

With regard to defendants who claimed to have lost their credit cards, in view of the finding that the money deposited onto the cards was used through spending in different provinces on the same day, it was held that it should be investigated whether the spending was made physically or through an information system and, if made through an information system, to whom and how the goods purchased were delivered, and whether a PIN was used during these transactions. (Court of Cassation, 15th Criminal Chamber, E. 2021/706, K. 2021/3882, 01.04.2021)

Does the Investigation End If the Money Was Never Spent?

No. Even if it is established that the money received into the account was not spent, it must be investigated whether the money was withdrawn in cash, transferred to other accounts or remained in the account; the Court of Cassation requires that the fate of the money, whether it was withdrawn and by whom it was withdrawn be inquired into (Court of Cassation, 11th Criminal Chamber, E. 2021/27909, K. 2024/10771, 26.09.2024). It is extremely important that the investigating authorities trace the money received into the account used in the offence in the light of the available data. Indeed, even in respect of a type of offence other than fraud, the Court of Cassation has required that it be investigated through bank records into which accounts the money said to have been gained from the offence was deposited and whether money was received into the defendants' accounts on the same dates, and that, where necessary, an expert report (bilirkişi) be obtained on this matter (Court of Cassation, 9th Criminal Chamber, E. 2021/20110, K. 2021/8961, 04.11.2021).