Turkish Supplier Bank Details Changed by Email: Payment Fraud and Invoice Discharge

Act on the suspected diversion without losing the original evidence

The Turkish Banks Association describes company-email compromise involving altered bank account or IBAN instructions in its public fraud guidance. It directs a customer who discovers manipulation of the payment account to notify the bank and make a criminal report. The practical priority is to communicate the suspected diversion promptly while preserving the records needed to identify the transfer.

Contact the sending bank through its established channel and provide the transfer reference, amount, currency, beneficiary information and time. Ask what recovery or protective steps are available and obtain a record of the report. A request to recall funds is not proof that they have been returned. Keep each bank response and update the chronology when the payment’s status changes.

Contact the real supplier through a previously verified channel rather than relying on telephone numbers or links supplied in the disputed message. Preserve the original email and attachments before making a working copy for review. The immediate objective is to establish the facts and prevent additional misdirected payments, while the legal effect of the completed transfer is assessed.

Separate three relationships before deciding who must pay

The buyer’s obligation to the supplier, the bank’s execution of the transfer and the recipient’s entitlement to retain the money are distinct legal relationships. A bank confirmation can prove that funds moved without proving that the supplier received legally effective payment. Conversely, the supplier’s denial of receipt does not, by itself, decide every issue of authority or responsibility.

Start with the source contract and invoice. Identify the legal supplier, buyer, agreed payment terms and original instructions. Then identify the person who purported to change those instructions, the account holder and the actual transfer. A trading name in an email signature should not be treated as proof that the account belongs to the contracting supplier.

Document whether the asserted change concerned the bank account of the same creditor, an authorised collection agent, an assignment of the claim or another arrangement. These categories have different requirements. The assignment of receivables guide explains why an actual transfer of the claim must be distinguished from a payment instruction.

Check whether the supplier authorised the instruction

Article 40 of the Turkish Code of Obligations No. 6098 provides that a legal act performed by an authorised representative in another person’s name and on that person’s account binds the principal directly. Article 41 addresses the source and extent of authority. The relevant inquiry is therefore the person’s authority for the particular act, not merely whether the email looked familiar.

Obtain the supplier’s prior communications identifying authorised contacts and any contractual method for changing payment details. Review corporate representation documents where relevant. Authority to discuss delivery or send invoices should not automatically be equated with authority to direct payment to an unrelated account. The scope needs to be established from the legally relevant authorisation and communications.

The sender address, signature block and previous correspondence are evidence, but they do not alone resolve a disputed instruction. The file should show whether the communication originated from the authorised person, whether the content was altered and what the supplier had communicated about that person’s powers. Technical authenticity and legal authority are related questions that require different evidence.

The supplier’s own communications about authority can matter

Article 41 states that, where authority has been communicated to third persons, its content and extent are determined according to that communication. The buyer should therefore preserve the supplier’s direct confirmations and instructions preceding the disputed transfer. An internal approval rule that was never communicated raises a different issue from an express limitation given to the buyer.

Article 42 allows authority arising from a legal transaction to be limited or withdrawn. Where authority was expressly or indirectly communicated to third persons, the principal cannot invoke an uncommunicated withdrawal against good-faith third persons under the provision. Establish the timing of any withdrawal notice and what the buyer knew when payment was made.

These rules concern legally relevant representations and withdrawal of authority. They should not be treated as a rule that every forged email becomes binding because it uses a company’s name. The analysis must distinguish a genuine representative whose authority changed from an impersonator or an unauthorised alteration of a message. The documentary and technical record determines which question arises.

Approval of an unauthorised act requires its own assessment

Article 46 provides that an act performed without representative authority binds the alleged principal only if the principal approves it. The counterparty can ask for a decision within an appropriate period. The statute does not supply a universal seven-day deadline or make every unanswered message an approval. Any request should identify the precise instruction and transfer submitted for consideration.

Article 47 addresses the consequences where express or implied approval is absent, including a claim against an unauthorised representative subject to its conditions. It also preserves unjust-enrichment rights. The unauthorised representation guide explains that framework. Its application depends on the actual act and parties; not every cyber-fraud fact pattern is resolved solely by those two articles.

Preserve the supplier’s complete response. Confirmation of the invoice, confirmation of the bank change and acknowledgment that payment satisfied the debt have different meanings. A statement agreeing to investigate should not be rewritten as a release. Any subsequent settlement should specify the treatment of the invoice and recovery claims expressly.

Identify who received the funds before choosing a restitution claim

Article 77 requires return of enrichment obtained from another person’s assets or labour without a valid legal basis. Article 78 regulates voluntary performance of an obligation not owed, including the requirement to prove the mistaken belief in indebtedness within its scope. The payment records and alleged legal basis must be examined before selecting the restitution claim.

Identify the account holder and trace the receipt through lawful evidence channels. The person whose name appears in correspondence may differ from the recipient or the person controlling the account. A civil claim must be directed at the person legally responsible under the cause of action relied upon; a similar name or contact number is not enough.

Article 79 distinguishes the remaining enrichment from situations involving disposal without good faith or with an expectation of having to return it. The recipient’s position therefore needs factual examination. Article 82 states a two-year period from learning of the right to restitution and an absolute ten-year period from enrichment. Those dates should be recorded separately from the banking report and criminal investigation.

Liability depends on the relevant duty, conduct and causal connection

Article 49 regulates liability for culpable unlawful conduct causing loss. Article 112 addresses non-performance or defective performance of a contractual obligation, with the debtor’s statutory absence-of-fault defence. A claim against the perpetrator, supplier, intermediary or bank must identify the applicable duty and how its breach caused the claimed loss. The fact that a fraud occurred does not establish identical liability for every participant in the payment chain.

Articles 51 and 52 address assessment of compensation and the injured party’s contribution to the occurrence or increase of loss. The review should therefore include the payment-change process, verification communications, warnings received and action taken after discovery. The purpose is to establish legally relevant conduct, rather than allocate fault solely according to whose email account was named.

Keep the technical incident findings separate from legal conclusions. Evidence of account compromise can explain how a message was sent, while contractual allocation, authority and causation still require assessment. A report that uses the word compromised should not be converted automatically into a conclusion that the supplier must bear the full invoice loss.

Ask the bank to identify the payment it actually executed

The bank file should include the instruction submitted, authentication record available to the customer, beneficiary details, execution status and recovery correspondence. Distinguish a payment the customer authorised after receiving a fraudulent instruction from a transaction allegedly executed without the customer’s authorisation. Those descriptions raise different questions and should not be used interchangeably in the complaint.

A cross-border transfer can involve more than one institution. Identify the sending and receiving banks and any available transaction references linking their records. The contract, payment service and applicable national rules determine the duties and remedies to be examined. This article does not prescribe one refund period or chargeback entitlement for every international bank transfer.

Request confirmation of the steps taken and any further information needed. Keep recovery attempts and actual returned funds separate in the account. Reporting the transaction promptly assists the factual and operational response, but a bank’s acceptance of the report is not an admission of liability or a guarantee that the recipient’s balance remains available.

Confirm whether the original transfer was completed, rejected, reversed or returned only in part. A pending instruction and a final credit are different events. The amount actually received can also differ from the sending instruction because of conversion or charges, so preserve both sides of the available banking trail. These facts affect the alleged enrichment and remaining loss. A later return to the buyer should be recorded separately from any payment that ultimately reaches and satisfies the supplier.

Preserve electronic evidence in a form that can be examined

Article 199 of the Code of Civil Procedure recognises electronic data as documents. Preserve original messages, attachments, available headers and the full conversation. Screenshots can help explain the sequence, but a cropped image can omit sender information, timing or qualifications relevant to authenticity and authority.

Keep the original invoice and each changed version separately. Record who received the bank-change request, who approved the payment and which information was checked. Obtain relevant technical records through authorised personnel and lawful channels. The objective is to preserve evidence of what happened, without altering source material while preparing a readable chronology.

Article 400 permits preservation of evidence where its conditions, including legal interest, are met. Articles 219 and 221 regulate production of relevant documents held by parties and third persons. Requests should identify the data and the fact it supports. A focused request for the disputed instruction and its transmission records is more useful than an unexplained demand for an organisation’s entire email archive.

Report the conduct with specific facts and payment identifiers

Article 158 of the Criminal Procedure Code No. 5271 permits reports or complaints to the public prosecutor or law-enforcement authorities, in writing or orally for recording. The report should provide the transfer details, disputed instructions, discovery chronology and available identity information. State which facts are established and which remain under investigation.

Article 157 of the Criminal Code No. 5237 addresses obtaining benefit through deceptive conduct causing loss. Article 158(1)(f) addresses the qualified use of information systems or banking or credit institutions as instruments of fraud. Articles 243–244 regulate specified unlawful system access and interference with systems or data. The authorities determine the appropriate legal classification from the evidence.

An account holder should not be labelled the proven perpetrator solely because the transfer reached an account in that name. Preserve the identifying information for investigation and distinguish it from a conclusion about criminal responsibility. The criminal report and the civil recovery file can use common evidence, but filing the report does not itself discharge the supplier invoice or produce repayment.

Address the supplier’s outstanding invoice without assuming the answer

The supplier may continue to claim payment while the diversion is investigated. The response should explain the disputed instruction, payment and authority position with supporting records. The governing contract and applicable law determine whether the obligation was discharged and whether separate damages or set-off issues arise. Neither an automatic instruction to pay twice nor an automatic refusal to pay follows from the fraud label alone.

Article 117’s default rules remain relevant to a debt that is legally due and unpaid. Preserve any agreed standstill, extension or settlement in its actual terms. Informal discussions about investigating the incident should not be treated as a binding suspension of every payment or procedural obligation.

Where a payment order or lawsuit is served, record the service evidence and obtain the response deadline from the applicable procedure. A bank recall request or criminal report does not itself constitute an objection in the supplier’s proceeding. The authority dispute and procedural response need to be coordinated while recovery attempts continue.

Maintain a single chronology and separate recovery accounts

For overseas buyers, Article 24 of Law No. 5718 is relevant to the supply contract’s governing law. The bank relationship, recipient claim and criminal jurisdiction require their own assessment. The currency and amounts should remain traceable through the original records; the foreign-currency debt guide explains the separate proof and calculation issues.

Reconcile all returned funds, settlements and invoice credits as they occur. The completed file should distinguish the outstanding contractual price, loss already recovered and claims still pursued against each relevant person. That structure supports a defensible legal response without counting the same loss twice or treating an uncompleted recovery request as money received.

Frequently asked questions

Does paying the IBAN in a fraudulent email settle the supplier invoice?

Not automatically. The authority of the person giving the instruction, the recipient, the supplier’s communications and any approval must be assessed. The banking transfer and legal discharge of the invoice are different questions.

What should I do when I discover the changed details were fraudulent?

Notify the sending bank promptly with the transfer identifiers, contact the supplier through an established channel and preserve the original records. The Turkish Banks Association also advises a criminal report. A recall request should be tracked separately from actual recovery.

Does an email from the supplier’s usual domain prove authority?

The address is evidence but does not resolve a disputed instruction by itself. Articles 40–41 require assessment of representative authority and its scope. Technical authenticity, alteration and the supplier’s own communications must be examined.

What if the supplier says the employee’s authority had already ended?

Article 42 contains a rule protecting good-faith third persons against an uncommunicated withdrawal of authority previously communicated to them. The actual notices and timing matter. This is distinct from an impersonator forging an instruction.

Can the supplier approve an instruction after the event?

Article 46 provides for approval of an unauthorised act within its scope. The precise act and the competent person’s response must be identified. A promise to investigate or silence should not automatically be treated as approval or a debt release.

Can the recipient be sued to return the money?

Unjust enrichment under Articles 77–82 is one potential legal basis requiring proof of the recipient, enrichment and absence of a valid basis. Article 79’s scope and the recipient’s good faith can matter. The proper defendant must be identified from evidence.

Does the bank have to refund every fraud-induced transfer?

The transaction, authorisation, bank duties and applicable payment-services rules require separate review. A customer-authorised payment induced by deception is not automatically the same as an unauthorised transaction. No universal refund or chargeback rule is stated here.

Where can a criminal report be made in Turkey?

Criminal Procedure Code Article 158 permits a report or complaint to the public prosecutor or law-enforcement authorities, in writing or orally for recording. Include the transaction identifiers and original communications rather than only a general allegation.

Does a criminal report stop the supplier’s debt claim?

The report does not itself discharge the invoice or file an objection in civil or enforcement proceedings. The supplier claim, criminal investigation and recovery efforts have separate procedural requirements. Preserve and respond to any served documents through the applicable route.

What is the limitation rule for unjust enrichment?

Article 82 provides two years from learning of the right to restitution and, in all circumstances, ten years from enrichment. The claim and dates must be assessed precisely. Other contractual or tort claims can involve different rules and should not be merged into that timeline.

Official legal sources

• Code of Obligations No.6098 — Articles 40, 41, 42, 46, 47, 49, 51, 52, 77, 78, 79, 82, 112, 117
• Criminal Code No.5237 — Articles 157, 158(1)(f), 243, 244
• Criminal Procedure Code No.5271 — Articles 158(1), 158(5)
• Civil Procedure Code No.6100 — Articles 199, 219, 221, 400
• Private International and Procedural Law No.5718 — Articles 24

Recorded primary-source check dates: 26 October 2026. The official Turkish legislation controls. A new publication-date check is still required.