Money Was Transferred from My Mobile Banking Without My Knowledge: When May the Bank Be Liable?

You receive a notification showing that money has been transferred to an account you do not recognise. In some cases, a loan may first have been taken out and the proceeds then transferred. The assessment must consider not only where the money went, but how the payment instruction was created and authorised.

In brief: Bank liability is not identical in every case. A transfer initiated after unauthorised access to your account is different from a payment you personally make after being deceived by someone impersonating a bank employee. The use of an authentication code does not, by itself, answer every legal question.

What should be reported to the bank immediately?

Use the bank’s official channel to identify each transaction you consider unauthorised. Request protection of the account and access credentials, investigation of the transactions and preservation of the relevant technical records. Keep the reference number and exact time of notification.

Continuing to use a compromised device may enable further access. On the other hand, immediately wiping the device can destroy evidence. Securing access and preserving technical records should therefore be considered together. Do not share new SMS codes or remote-access permissions.

Unauthorised access and a payment made under deception are different

Where someone enters your account without your knowledge and creates a payment instruction, the issue of authorisation is central. Where a fraudster persuades you to make the transfer yourself, the relationship between your apparent consent and the deception must be considered separately.

Even in the second category, it is too broad to say that there can never be a claim because “you sent the money yourself”. Security procedures, unusual transaction indicators, warnings and the conduct of both the bank and the customer may all be relevant in the particular case.

Technical records that may matter

The exact time, amount and recipient of each transaction.
New-device, new-session or password-change notifications.
The content of SMS and in-app authentication messages.
Calls, messages or links received before the incident.
Any SIM-card replacement or unexpected interruption of the mobile line.
The sequence of any loan drawdown, limit increase and subsequent transfer.

IP, device, session and authentication records held by the bank may not be available to the customer. Their preservation and examination can be requested through the appropriate process. Avoid declaring the technical method of attack as certain on the basis of a single screenshot.

Is the bank’s statement that “the password was used” sufficient?

Payment-services rules contain separate provisions on authorisation, records and liability. The user’s status, the transaction involved and the applicable agreement must be considered. Technical authentication and legally effective authorisation are related but not identical concepts.

Any allegation that the customer acted intentionally, with gross negligence or in breach of security obligations must also be assessed on the facts. General rules such as “the bank always reimburses” or “sharing a code means there is never a claim” are misleading.

Separate the applications and heads of loss

An objection to the bank and a criminal complaint against the offender serve different purposes. If a loan was created, the disputed loan debt, transfer amount, interest and other charges should be identified separately. Whether the relationship is consumer or commercial may affect the competent forum and procedural prerequisites.

There can be notification and limitation periods, so it is not advisable to wait indefinitely for a bank response. The relevant deadline should be determined by reference to the transaction and the date on which it was discovered.

Frequently asked questions

I called the bank. Should I also make a written application?

A telephone notification is important, but a recorded written application clearly identifies the transactions challenged and the basis of the request.

No authentication code reached my phone. Does that prove bank fault?

No. It can be an important fact, but the authentication method and system records must be examined.

I filed a criminal complaint. Can I stop paying instalments on a disputed loan?

A criminal complaint does not automatically suspend obligations under a loan. The debt and any interim protection must be addressed separately.

Prepare a clear record before making an enquiry

Record the transfer date and time, amount, recipient IBAN, first bank notification and reference number in one timeline. If a disputed loan is involved, keep its agreement and payment schedule separately. Preserve transaction records in their original format and do not share passwords or one-time codes.

DISCUSS YOUR CASE

Discuss an unauthorised mobile banking transfer

We can review transaction records, notifications to your bank and the security steps taken to assess your options under Turkish law.

Open the contact form

A brief summary and important dates are enough for an initial enquiry. Send documents only when requested by our lawyers, through the channel they specify. Do not share passwords, one-time codes or wallet keys.

Sources and legislation

CBRT: Regulation on Payment Services and Electronic Money
Turkish Code of Obligations No. 6098
Code of Criminal Procedure No. 5271

Originally prepared on 8 September 2026. This article provides general information on Turkish law. Remedies and deadlines should be assessed against the documents and circumstances of each case. The image is illustrative.