KÜHEYLAN HUKUK
Unauthorized Credit Card and Bank Account Transaction: Bank's Liability and Refund Theft of card information, unauthorized transfer from the account, 3D Secure and SMS password defense, 13-month notification period and application methods have been updated as of 2026
In transactions made from card or account without the consumer's knowledge and approval, the payment service provider must prove that the transaction is authorized and recorded correctly. Payment services legislation requires notification without delay after learning of an unauthorized transaction and an objection no later than 13 months after the transaction. The Supreme Court sees banks as institutions of trust and confidence and does not hold the customer responsible for internet and card transactions unless it is proven that the customer has violated his duty of care. The fact that the transaction is confirmed with an SMS password or 3D Secure does not alone prove the responsibility of the customer. Prompt and documented notification is the most important step to prevent loss of rights.
1. What is an Unauthorized Payment Transaction?
Unauthorized payment transaction is a money transfer, EFT, card shopping, cash withdrawal or internet banking transaction carried out without the consent of the account or card holder. Obtaining card information through fake sites, card theft, SIM card copying, installation of remote access software on the device and phone fraud are the most common events in this category.
The legal framework consists of the Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions, the Regulation on Payment Services and Electronic Money Issuance and Payment Service Providers based on this Law (OG 01.12.2021, 31676) and the Bank Cards and Credit Cards Law No. 5464 regarding cards. Depending on the nature of the transaction, Article 245 of the Turkish Penal Code and the provisions of qualified fraud also come into question.
The payment service user who notices an unauthorized or erroneous transaction must report this to the payment service provider without undue delay. As a rule, the user cannot rely on these provisions in notifications made after 13 months from the transaction date. If the required information is never provided to the user, this period does not apply.
The burden of proof is on the payment service provider. The provider must show that the transaction has been authenticated, recorded correctly and not affected by a technical malfunction. If this proof cannot be provided, the amount is returned to the user and the account is restored to its previous status.
Notification As soon as it is noticed, without delay Notification must be made to the bank's call center and written channel on the same day.
Maximum notification period 13 months from transaction date Even small transactions that are noticed late should be followed up
burden of proof At the payment service provider The bank must provide transaction records and verification traces
Return If proof cannot be provided, the amount is returned to the user. In case of delay, interest and damages may be claimed.
In its decisions, the 19th Civil Chamber of the Supreme Court of Appeals emphasizes that banks are institutions of trust and confidence, and therefore, as a rule, they are held responsible for even minor faults. The Department does not hold the customer responsible for expenses made by third parties over the internet with a fake password, unless it is proven that the customer neglected his duty of care in protecting his personal information. The fact that the card has not been used for a long time has been considered as a strong evidence that the card information has been obtained outside the customer.
The bank generally argues that the transaction is made with a 3D Secure password or a single-use SMS code. This defense alone is not sufficient; Which phone number and with what content the code was sent, which device and IP address the transaction was made from, and whether there is a new device registration or limit change are examined together. If the customer knowingly and voluntarily gave the code to a third party, the bank's liability may be reduced or eliminated; In every case, the concrete fault distribution is decisive.
Closing the card and access: The card is blocked, the internet banking password is changed and suspicious applications are removed from the device.
Bank application: A written objection is made on a transaction basis and an application number is obtained.
Document request: Transaction reference, merchant information, 3D Secure and SMS records, device and IP information are requested from the bank.
Criminal complaint: An application is made to the Chief Public Prosecutor's Office and requested to investigate the illegal action. Criminal investigation does not require waiting for a bank response.
Arbitral Tribunal or lawsuit: If the bank does not refund, if the dispute value is below 186,000 TL (2026), it is appealed to the Consumer Arbitration Tribunal, and if it is above it, it is appealed to the Consumer Court after mediation.
Eight different transactions were made online on the same day on a credit card that had not been used for a long time, resulting in a total debt of tens of thousands of lira. The card owner objected to the bank in a short time, and the bank rejected the objection, stating that the transactions were made with the 3D Secure password.
The bank must prove that it carelessly shared the cardholder's password or protected information. If the card has not been used for a long time, a large number of transactions have been made in a short time, and the transactions do not comply with the usual spending habits, the bank's risk monitoring obligation comes to the fore. If the fault cannot be proven with bank records, the customer cannot be held responsible for the amount. Therefore, at the first stage, a written objection based on documents, followed by an application to the Arbitral Tribunal or the court, is the appropriate way.
Is calling the bank and making a verbal notification sufficient?
It may not be considered sufficient. Verbal notification must be made on the same day, followed by a written objection and the application number must be kept.
If the transaction was made with an SMS password, is the bank right in all cases?
No. It is examined who used the password, from which device and under what conditions. The security obligation of the bank is also evaluated in transactions made through SIM copying, fake verification page or remote access.
I voluntarily gave my password to the fraudster, is it possible to claim?
It's possible, but it gets harder. The bank's security measures, transaction-time warning systems and the customer's fault rate are evaluated together. A case-specific investigation should be conducted.
The bank started collecting the debt, what should be done?
The debt must be objected to, if there is a pursuit, an objection must be made in due time and legal action must be taken to determine that the debt is not owed and to stop the pursuit.
How long does it take for the Arbitration Committee to make its decision?
The duration varies depending on the province or district where the application is made. An objection can be made to the Consumer Court against the decision of the panel within 15 days from the notification.
Waiting for days even though he noticed the suspicious transaction; notification delay leads to fault controversy.
Not relying on the bank's refund promise and not submitting a written objection.
Giving password, code or remote access permission to "security guard" requests received by phone.
Deleting screenshots, SMS and call logs.
Thinking that criminal complaint and legal application are alternatives to each other; Both can be executed in parallel.
As a rule, refunds for unauthorized card and account transactions depend on the payment service provider's failure to fulfill its burden of proof. What is decisive for the customer is the rapid, written and documented notification from the moment the incident is noticed. The high standard of care imposed on banks by the Supreme Court provides a strong basis in favor of the customer when the correct evidence is collected.
Küheylan Law Firm provides legal support at all stages, from preparing bank objections to requesting bank records, to carrying out the criminal complaint and the Consumer Arbitration Panel or Consumer Court process together. Collecting evidence before it is lost and establishing the correct fault defense often determines the outcome.
Important Legal Notice: This guide has been prepared for general information purposes and does not constitute legal advice. Legislation and judicial precedents may change; The concrete circumstances of each event are different. In order to avoid loss of rights, a case-specific legal evaluation must be made in terms of lawsuit, application and objection periods.
KÜHEYLAN HUKUK