What foreign companies must do in the first hours after a payment is diverted.
Article 128/A of the Turkish Criminal Procedure Code (CMK No. 5271) allows a bank, payment service provider or crypto-asset service provider to suspend, for up to 48 hours, any account used in the offence where there is reasonable suspicion that qualified theft by use of information systems (TCK Art. 142(2)(e)), qualified fraud (TCK Art. 158(1)(f) and (l)) or misuse of bank or credit cards (TCK Art. 245) has been committed. Law No. 7571 of 24 December 2025, published in the Official Gazette No. 33118 of 25 December 2025, inserted the article into the Code with effect from that day. The institution must report the suspension and the account movements immediately to the Chief Public Prosecutor’s Office; the suspension is also notified to the account holder, who may apply to have the suspension lifted; the prosecutor decides on that application within 24 hours (Art. 128/A(2)). Within the suspension period the proceeds in the account may be seized on a judge’s decision or, where delay is prejudicial, on the prosecutor’s written order; a seizure made without a judge’s decision is submitted to the competent judge within 24 hours, and if the judge does not announce a decision within 48 hours of the seizure, the seizure lapses automatically (Art. 128/A(4)). Proceeds established to belong to the victim are returned to their owner during the investigation or prosecution (Art. 128/A(5)).
The pattern is now familiar to every finance department that pays foreign suppliers. A long-running email thread about an ordinary invoice acquires one additional message. The message comes from the supplier’s own domain, or from a near-identical one, and it explains that the beneficiary bank has changed. The payment is made. Weeks later the real supplier asks why the invoice is unpaid.
What happens next in Türkiye has changed materially. Until recently, the victim’s practical options were a criminal complaint and a wait: a prosecutor would open an investigation, and by the time a seizure order reached the receiving bank the balance had usually been withdrawn or moved on. On 25 December 2025, Law No. 7571 of 24 December 2025 inserted Article 128/A into the Criminal Procedure Code (CMK No. 5271) under the heading “Suspension of, and seizure over, the account holding the benefit obtained through the commission of information-technology offences”. It puts a short, sharp instrument in the hands of the institution that is actually holding the money at the moment it matters.
This guide sets out how Article 128/A operates, how it connects to the older and broader seizure power in Article 128, what the victim must do in the first hours, and where the mechanism stops.
1. What Article 128/A Actually Permits
Article 128/A applies to three groups of offences under the Turkish Penal Code (TCK No. 5237):
- qualified theft under Article 142(2)(e);
- qualified fraud under Article 158(1)(f) — committed by using information systems, banks or credit institutions as an instrument — and Article 158(1)(l), where the perpetrator presents themselves as a public officer or an employee of a bank, insurance or credit institution, or claims a connection with such institutions;
- misuse of bank or credit cards under Article 245.
Payment diversion fraud against a corporate victim ordinarily falls within Article 158(1)(f), because the instruction is delivered through an information system and the banking channel is the instrument of the deception.
Where there is reasonable suspicion (makul şüphe) that one of those offences has been committed, the bank, payment service provider or crypto-asset service provider may itself decide to suspend, for up to forty-eight hours, any account used in the offence in connection with transactions carried out — or attempted — with it or through it.
Three features of that sentence deserve emphasis. The decision belongs to the institution, not to the prosecutor, so the clock can start before any judicial file exists. The threshold is reasonable suspicion, which is a lower standard than the strong suspicion based on concrete evidence required for seizure under Article 128. And the power extends to attempted transactions, not only completed ones.
2. Notification, the Account Holder’s Remedy, and Onward Transfers
The provision balances that speed with immediate reporting duties.
Under Article 128/A(2), the financial institution must report the suspension and the account movements, together with all information and documents, immediately to the Chief Public Prosecutor’s Office. The suspension must also be notified to the account holder, who may apply to the prosecutor’s office for it to be lifted; the prosecutor decides on that application within twenty-four hours.
Article 128/A(3) addresses the most common practical problem in these cases — money that has already moved. If it is established that the benefit forming the subject of the offence was transferred to another financial institution before the suspension was completed, the institution must notify the other institution without delay so that a suspension can be effected there. In practice this converts what used to be a sequence of separate complaints into a single chain of institutional notifications, and it is the reason why a victim who can identify the onward transfer early is in a far stronger position than one who cannot.
Article 128/A(6) protects the decision-makers: natural and legal persons who decide on a suspension under the article are not held legally liable. That immunity matters, because it removes the institutional reluctance that would otherwise make a 48-hour freeze commercially unattractive to the bank.
3. From Suspension to Seizure — and Why the Waived Report Matters
A suspension preserves; it does not transfer. Conversion happens under Article 128/A(4): within the suspension period, the benefit forming the subject of the offence in the suspended account — whether suspended by the institution or on the prosecutor’s written order — may be seized on a judge’s decision, or, where delay would be prejudicial, on the prosecutor’s written order. A seizure carried out without a judge’s decision must be submitted for the approval of the competent judge within twenty-four hours; the judge announces the decision within forty-eight hours of the seizure, failing which the seizure lapses automatically.
The final sentence of Article 128/A(4) is the one practitioners should read twice: for a seizure under this article, the report requirement stated in Article 128 is not sought. Under Article 128, a seizure order requires a report on the value derived from the offence to be obtained, as relevant, from the Banking Regulation and Supervision Agency, the Capital Markets Board, the Financial Crimes Investigation Board, the Treasury or the Public Oversight Authority — a report prepared within three months, extendable by two. That timetable is incompatible with a 48-hour window, and the legislature has removed it for this route.
Article 128/A(5) completes the mechanism from the victim’s perspective: where it is understood that the seized benefit belongs to the victim of the offence, it is returned to its owner at the investigation or prosecution stage. The victim does not have to wait for a conviction, and does not have to obtain a separate civil judgment first. What the victim must do is prove the money’s identity, which is an evidential exercise conducted on the payment file.
4. The Wider Power: Seizure under CMK Article 128
Article 128/A is a rapid-response device. The general instrument for asset recovery in fraud cases remains Article 128, and it is considerably broader.
Where there is strong suspicion based on concrete evidence that the offence has been committed and that the asset was derived from that offence, the following belonging to the suspect or accused may be seized: immovable property; land, sea and air transport vehicles; any account whatsoever at banks or other financial institutions; all rights and receivables held at real or legal persons; negotiable instruments; shareholdings in a company in which the suspect is a partner; the contents of safe-deposit boxes; and other assets. Critically, the seizure may be carried out even where those assets are in the possession of a person other than the suspect or accused — the answer to the standard defence that the receiving account belongs to a third party.
Three further points matter in fraud work:
- Fraud is a catalogue offence. Article 128(2)(a)(6) lists fraud under Articles 157 and 158 among the offences to which the seizure power applies. Breach of trust (Article 155), fraudulent bankruptcy (Article 161) and usury (Article 241) are also listed.
- Only a judge may order it. Article 128(9) provides that seizure under the article, and the appointment of a trustee under paragraph ten, may be decided only by a judge. There is no “delay is prejudicial” shortcut here — which is precisely why Article 128/A was needed.
- Defeating the order does not work. Article 128(5) requires the account seizure decision to be notified to the bank or financial institution immediately by technical means of communication, and states that transactions carried out on the accounts after the seizure decision with a view to rendering it ineffective are void. Non-compliance with a seizure order attracts the penalties for misuse of the duty of custody under TCK Article 289.
5. Grading the Offence: Why the Characterisation Drives the Remedy
The provision under which a complaint is framed determines which recovery tools are available, so the criminal characterisation is not a formality.
Simple fraud under TCK Article 157 carries one to five years’ imprisonment and a judicial fine of up to five thousand days. Article 158 raises this to three to ten years and a fine of up to five thousand days where the offence is committed in one of the listed aggravated ways, including subparagraph (f) — using information systems, banks or credit institutions as an instrument. For subparagraphs (e), (f), (j), (k) and (l), the statute adds a floor: the lower limit of imprisonment cannot be less than four years, and the judicial fine cannot be less than twice the benefit obtained from the offence.
Article 158(3) increases the penalty by one half where the offences under Articles 157 and 158 are committed jointly by three or more persons, and doubles it where the offence is committed within the framework of the activity of an organisation established to commit crime — a common configuration in professionalised payment fraud.
A recent amendment recognises the reality of money-mule networks. A paragraph added to Article 158 on 16 July 2026 by Law No. 7589 provides that where participation in the offences under Articles 157 and 158 is limited to giving another person payment instruments such as bank or credit cards belonging to oneself or another, or the mandatory information or means enabling use of an account held at a bank, intermediary institution, payment service provider or crypto-asset service provider, for the purpose of obtaining an unjust benefit, the penalty to be imposed is reduced by one half.
6. The MASAK Route, and What It Is Not
Foreign clients frequently ask whether the Financial Crimes Investigation Board (MASAK) can simply freeze the money. The relevant provision is Article 19/A of Law No. 5549 on the Prevention of Laundering Proceeds of Crime, and it should be understood accurately.
Under that article, where there is suspicion that assets subject to transactions carried out — or attempted — with or through obliged parties are connected with the offence of laundering or the financing of terrorism, the Minister (a power that may be delegated to a deputy minister) is authorised to suspend those transactions for seven business days, or to withhold permission for them to take place for the same period, in order to confirm the suspicion, analyse the transaction, or where necessary transmit the results of the analysis to the competent authorities. The same power may be exercised, on the basis of reciprocity, on the reasoned request of a foreign counterpart institution, provided the Board itself sees suspicion of laundering or terrorist financing. Obliged parties that carry out a suspended transaction contrary to the decision face an administrative fine equal to the amount of the transaction, and in any event not less than fifty thousand Turkish Lira.
This is an administrative power exercised on the back of suspicious transaction reporting. It is not a remedy the victim can demand as of right, and it is not a substitute for the criminal route. Its practical relevance to a corporate victim is indirect: a well-documented complaint that makes the laundering dimension visible increases the chance that the reporting and analysis machinery engages in parallel.
7. The First Seventy-Two Hours: A Sequenced Response
| Hour | Action | Legal basis / purpose |
|---|---|---|
| 0–2 | Instruct the remitting bank to send a recall/SWIFT message; freeze further payments on the same supplier account | Preserves the balance and creates the paper trail relied on later |
| 0–4 | Contact the beneficiary bank in Türkiye through Turkish counsel and put the fraud allegation in writing | Triggers the institution’s own assessment of reasonable suspicion under CMK 128/A(1) |
| 0–6 | Preserve email headers, the altered instruction, the genuine invoice and the payment confirmation; do not overwrite the mailbox | Identity of funds must later be proved for return under CMK 128/A(5) |
| 4–12 | File the criminal complaint characterising the offence under TCK 158(1)(f), with a request for seizure | Article 128/A(4) seizure and, in parallel, Article 128 seizure |
| 12–24 | Ask the prosecutor to obtain the account movements and to notify onward institutions | CMK 128/A(2) and (3); CMK 128/A(7) obliges a reply within ten days |
| 24–48 | Press for the judicial seizure decision before the suspension lapses | Suspension is capped at forty-eight hours |
| 48–72 | If funds moved onward, repeat the sequence at the next institution; consider preliminary attachment for the civil claim | Recovery rarely ends at the first account |
Two habits distinguish files that recover from files that do not. The first is treating the beneficiary bank and the prosecutor as parallel tracks rather than consecutive ones — Article 128/A was drafted precisely so that the institution can act before the prosecutor does. The second is building the identity-of-funds evidence at the outset rather than when the court asks for it, because Article 128/A(5) returns the money to the victim only where it is understood to belong to the victim, and that understanding is produced by documents.
Payment diversion fraud is not, in Türkiye, a problem without a remedy. It is a problem with a very short remedy, and the difference between a full recovery and a written-off receivable is usually measured in hours rather than in the eventual merits of the case.
Where the payment has already left your account, the criminal complaint and the civil recovery run side by side: our commercial fraud and asset tracing practice works on tracing and freezing the funds, and our criminal law practice on the complaint and the investigation file.
