A cloned voice that sounds exactly like the CFO, a video call with a “bank security officer”: AI has made impersonation cheap and convincing, and this year the rules around it moved. Since 31 July 2026 the Turkish Penal Code has a new paragraph on people who hand their accounts to fraudsters; since 2 August 2026 the EU AI Act’s deepfake disclosure rule applies; and the final compromise text of the EU Payment Services Regulation (PSR) gives consumers a refund right for bank impersonation fraud. What has not changed in Türkiye is the rule on who bears the loss. It turns on one question: did the customer authorise the payment?
The trend in one paragraph
Fraudsters use generative AI to imitate people and institutions the victim trusts. Either the fraudster defeats the provider’s controls (talking a call centre into resetting credentials, or getting the victim to read out a one-time code) and moves the money himself, or the victim, convinced by a fake voice, video or message, sends the money personally. The second pattern is authorised push payment (APP) fraud, and Turkish law treats the two very differently.
Unauthorised or authorised: the line that decides who pays
The liability rules sit in the Central Bank (TCMB) Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers (the “Regulation”), issued under Article 12(3) of Law No. 6493. Under Article 52(2), a payment transaction is authorised once the payer consents to it; under Article 52(3), a transaction not approved in the agreed manner is deemed unauthorised. Payment service providers include banks, payment institutions, e-money institutions and PTT (Law No. 6493 Art. 13).
| Scenario | Likely category | Main Turkish rule |
|---|---|---|
| Fraudster passes voice or video checks and pays out | Unauthorised | Regulation Art. 54: refund, burden of proof on provider |
| Victim reads an OTP to a fake “bank officer” who then pays out | Unauthorised, but customer conduct is examined | Art. 54(4)-(5): TRY 250 cap, or full loss for intent or gross negligence |
| Finance team pays a “CEO” deepfake’s instruction to a new IBAN | Authorised (APP fraud) | Art. 52(2) and Art. 69: no statutory refund; general law of obligations |
| Card details used after a phishing call | Unauthorised card use | Law No. 5464 Art. 12 (Law No. 6493 Art. 24 excludes card matters) |
Unauthorised transactions: the provider carries the burden
Here the Regulation is customer-friendly. The customer must notify the provider without delay, and in any case within 13 months (Art. 54(1)). If the customer denies authorising a transaction, the provider must prove that the customer approved it, that it was correctly recorded and that no technical failure affected it (Art. 54(2)). Once a transaction is shown to be unauthorised, the provider must refund it immediately, though strong suspicion of payer fraud, or of an intentional or grossly negligent breach of the payer’s security duties, allows a reasonable investigation first (Art. 54(3)).
Where a lost or stolen instrument, or poorly kept security credentials, let someone else use the instrument, the payer bears at most TRY 250 of losses in the 24 hours before notification, and nothing after it (Art. 54(4)). The cap disappears if the payer acted fraudulently or breached the security duties in Article 53 intentionally or with gross negligence (Art. 54(5)). Two rules favour the customer. If the provider did not require the authentication TCMB rules demand, the payer is not liable for losses from a lost or stolen instrument or misused credentials, unless Art. 54(5) applies (Art. 54(9)). And under the TCMB information systems communiqué, a payment or e-money institution that failed to offer strong authentication where required must prove the customer authorised the transaction (Art. 10(14)).
Cards follow a separate track: Law No. 6493 does not apply to matters governed by Law No. 5464 on bank and credit cards (Art. 24(1)), whose Article 12 caps the cardholder’s liability for misuse in the 24 hours before notification at 150 lira, except for gross negligence, intent or failure to notify.
APP fraud: no statutory refund in Türkiye
When the victim personally instructs the payment, the transaction is authorised under Article 52(2), however good the deepfake. Under Article 69, a payment executed in line with the unique identifier (in practice, the IBAN) given by the payer is deemed correctly executed, and the provider answers only for the identifier even if the customer also gave the payee’s name. Article 69(2)-(4) requires the payer’s provider to try to recover the funds and, if that fails, to give the payer on written request the information needed to go to court. Those duties are framed for an incorrect identifier given by the customer; whether they extend to a payment sent to the IBAN the fraudster supplied is not settled.
No Turkish statute or TCMB rule we have found gives an APP victim an automatic refund. A claim against the provider rests on general law: Article 112 of the Code of Obligations (Law No. 6098) makes a debtor liable for defective performance unless it proves no fault; Article 18(2) of the Commercial Code (Law No. 6102) requires every merchant to act as a prudent businessperson (basiretli tacir); and Article 115 of the Code of Obligations voids advance exclusions of liability for gross fault and, for licensed activities requiring expertise, even for slight fault. The provider will point to the customer’s own conduct: under Article 52 of the Code of Obligations, applied to contract claims by Article 114, a judge may reduce or remove compensation where the injured party contributed to the loss.
Such disputes tend to turn on the monitoring duties below. For business customers, note Article 72 of the Regulation: with non-consumer customers, the parties may disapply or vary certain protections, including Article 54(2), (4) and (6).
Monitoring and authentication duties
For payment and e-money institutions, Article 19 of the TCMB communiqué requires transaction monitoring that tracks, where appropriate, known fraud methods, abnormal payment or behaviour patterns, compromised authentication elements, signs of malware and, where possible, prior fraud records of the customer and counterparties. On detecting unusual or high-risk transactions, the institution must warn the customer as soon as possible by phone, SMS or similar means (Art. 19(2)). Banks have a parallel duty under Article 36 of the BDDK Regulation on Banks’ Information Systems and Electronic Banking Services.
The communiqué also anticipates voice-led social engineering. Strong authentication is the default for electronic channel transactions, and passwords, PINs or biometrics controlled by the device maker rather than the institution’s app do not count as strong authentication elements (Art. 10(8)). Changes to authentication or phone details requested by phone must run through automated systems without staff involvement (Art. 10(30)), and before calling a customer the institution must check that the number has not been forwarded (Art. 10(31)). Phone staff must receive periodic training on social engineering (Art. 8(19)).
Biometric data is special category personal data under Article 6(1) of Law No. 6698 (KVKK), and the communiqué’s definition of biometric data includes face and voice. Firms that use voiceprints or face matching for authentication or remote identity verification need an Article 6(3) condition, the Board’s adequate measures (Art. 6(4)) and Article 12 security measures. Article 23(2) of Law No. 6493 lets providers use personal data where necessary to prevent, investigate and detect payment irregularities. On personality rights, see our voice cloning piece.
The criminal law side
Fraud using information systems, banks or credit institutions as a tool is qualified fraud under Article 158(1)(f) of the Turkish Penal Code, as is fraud by someone posing as a public official or bank employee (Art. 158(1)(l)). The general range is three to ten years’ imprisonment, but for these two forms the minimum is four years and the judicial fine must be at least twice the gain. Law No. 7589, published on 31 July 2026, added Article 158(4): where a participant only handed over cards, or the information or tools needed to use accounts at banks, intermediary institutions, payment service providers or crypto-asset service providers, for an unlawful benefit, the penalty is halved. These are the so-called mule accounts.
The EU comparison
The PSR applies to payment services provided within the Union (Art. 2), so it matters for a Turkish group serving EU customers through an EU-licensed entity. As of October 2026, the final compromise text is Council document 8221/26 of 17 April 2026, confirmed by Coreper on 22 April 2026; formal adoption is pending. Our PSD3 and PSR article covers the wider reform.
| Issue | Türkiye today | EU PSR (17 April 2026 text) |
|---|---|---|
| Payer’s cap, unauthorised use | TRY 250 (Regulation Art. 54(4)) | EUR 50 (Art. 60(1)) |
| Bank impersonation (APP) | No statutory refund | Consumer refund if bank’s channels were spoofed, subject to notifying the provider and police; answer within 15 business days (Art. 59) |
| Payee name check | Provider liable only for the identifier (Art. 69) | Name and IBAN matching for all credit transfers (Art. 50); refund if it fails (Art. 57) |
| Timing | In force | 21 months after entry into force; Arts. 50 and 57 after 27 months (Art. 112) |
Under the EU AI Act, deployers of AI systems that generate deepfakes must disclose that the content is artificially generated or manipulated (Art. 50(4)), and generative AI providers must mark outputs in a machine-readable way (Art. 50(2)). Article 50 applies from 2 August 2026; Regulation (EU) 2026/1744 gives providers whose systems were already on the market before that date until 2 December 2026 for the marking duty. Fraudsters will not label their deepfakes; see our deepfakes piece.
Where to start
- Sort your fraud cases into “unauthorised” and “authorised” and write refund rules for each.
- Require strong authentication wherever TCMB rules demand it; gaps shift the loss to you.
- Test the call centre against cloned voices: no agent-made credential or phone changes, forwarding checks before outbound calls.
- Tune monitoring for new-payee, unusual-amount and urgency patterns, and log every warning sent.
- For corporate clients, review Article 72 terms and add call-back rules for new IBANs.
- Run a KVKK Article 6 review for voice or face biometrics.
- If you serve EU users, plan the PSR name check and impersonation refund flow.
More in our fintech law hub.
Is a payment made after a deepfake call “unauthorised” under Turkish law?
Not if the customer gave the instruction (TCMB Regulation Art. 52(2)). If the fraudster used the deepfake to get past controls and initiated the payment himself, it is unauthorised and Article 54 applies.
How much can a customer lose from an unauthorised transaction in Türkiye?
Up to TRY 250 for the 24 hours before notification, and nothing after it (Regulation Art. 54(4)), unless the payer acted fraudulently or breached security duties intentionally or with gross negligence (Art. 54(5)). Card misuse follows Law No. 5464 Art. 12.
Does Türkiye have an equivalent of the EU impersonation fraud refund?
No, as of October 2026. Article 59 of the EU PSR compromise text gives consumers a refund where fraudsters spoofed the bank’s own channels, but the PSR is not yet formally adopted, and no Turkish rule we have found creates a similar refund for authorised payments.
Sources. Law No. 6493 (RG 27.6.2013, No. 28690), Arts. 12(3), 13, 23(2), 24(1); TCMB Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers (RG 1.12.2021, No. 31676, as amended to RG 4.9.2026, No. 33360), Arts. 52, 53, 54, 69, 72; TCMB Communiqué on Information Systems of Payment and E-Money Institutions and Data-Sharing Services (RG 1.12.2021, No. 31676, as amended), Arts. 3, 8, 10, 19; BDDK Regulation on Banks’ Information Systems and Electronic Banking Services (RG 15.3.2020, No. 31069), Art. 36; Law No. 5464 (RG 1.3.2006, No. 26095), Art. 12; Law No. 6098 (RG 4.2.2011, No. 27836), Arts. 52, 112, 114, 115; Law No. 6102 (RG 14.2.2011, No. 27846), Art. 18(2); Turkish Penal Code No. 5237 (RG 12.10.2004, No. 25611), Art. 158; Law No. 7589 (RG 31.7.2026, No. 33326), Art. 13; Law No. 6698 (RG 7.4.2016, No. 29677), Arts. 6, 12; PSR final compromise text, Council doc. 8221/26 (17 April 2026), Arts. 2, 50, 57, 59, 60, 112; Council doc. 13589/26 (2 October 2026); Regulation (EU) 2024/1689 (AI Act) (OJ L, 12.7.2024), Arts. 50, 113; Regulation (EU) 2026/1744 (OJ L, 24.7.2026).
This article is general information and not legal advice; a specific situation should be assessed with counsel.
Author
More from Vircon Insights
Loot Boxes, Gacha and the Gambling Line in Türkiye: Law 7258, Article 228 of the Criminal Code and the Advertising Board
October 20, 2026Anatomy of a Game Publishing Agreement Under Turkish Law: Revenue Share, Recoupment, Minimum Guarantee and Who Keeps the IP
October 19, 2026Open Banking in Türkiye: A Practical Legal Guide for Fintechs (2026)
October 18, 2026Equity Crowdfunding in Türkiye: How a Startup Raises Through a Licensed Platform Under Communiqué III-35/A.2
October 17, 2026Türkiye's Age Verification Regulation for Social Networks: the e-Devlet Token, Rules for 15 to 17 Year Olds and the Deadlines
October 16, 2026Türkiye Geographic Data Permits Regulation 2026: What Companies Working with Location Data Must Check
October 16, 2026Related Practice Areas
Corporate Law
Share transfers, capital increases, board structuring, governance.
View service →ICOs, Crypto & Blockchain
Crypto-asset regulation, token offerings, exchange and custody licensing.
View service →Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →