Is the Person Asking for Money on WhatsApp Really Someone You Know? — Attorney Aylin Esra Eren

One of the methods that should be paid attention to recently is the takeover of people's WhatsApp accounts or the creation of accounts that impersonate acquaintances.

Scammers can send messages to friends, family members, and business associates using the person's profile photo and name. If the account has been truly compromised, they may also try to build trust by using forms of address and personal details learned from past communications.

For example, they can send messages to the person's inner circle by addressing them with a form of address they constantly use, such as "My dear, I need to make an urgent payment," "I can't access my account right now, I'll send you an IBAN," or "I will pay you back in a little while, can you help me?"

The goal here is to prevent the other party from being suspicious and to ensure they make a quick decision. The most important point our citizens need to know is that the name and photo appearing on WhatsApp do not prove that the person sending the message is truly that person.

There are different methods for this. Users' information can be captured through fake links, verification codes can be obtained from people through various social engineering methods, or access to users' devices can be obtained.

One should be especially careful against people who introduce themselves as the WhatsApp support team, a bank official, or an employee of another institution.

Another method, instead of taking over the person's account, is to create a fake account using a different phone number by using their photo and name.

Therefore, with every request for money, you must first verify whether the account really belongs to your relative.

Depending on how the incident occurs, more than one crime may be involved.

Article 243 of the Turkish Criminal Code regulates the crime of illegally accessing or remaining in an information system. In cases such as interfering with the operation of the system or changing data, Article 244 may also come into question.

If, through the compromised account, people are deceived into sending money, then the crime of fraud is evaluated. Fraud committed by using information systems as a tool can constitute qualified fraud within the scope of Article 158/1-f of the Turkish Criminal Code.

However, the legal nature of each incident is determined according to its own circumstances. Account takeover, creation of fake accounts, money transfer, and the use of personal data must be examined separately.

The victim has the right to resort to legal remedies and demand compensation for their damage. However, it is not possible to say that the money will definitely be recovered.

First of all, as soon as it is noticed that money has been sent, the bank must be contacted, the transaction must be reported, and it must be requested to stop the transfer or recall it if possible.

At the same time, law enforcement units or the Chief Public Prosecutor's Office should be applied to identify the recipient account, investigate account activities, and evaluate protective measures regarding the relevant accounts when necessary.

Time is very important here. Since money obtained through fraud can be transferred to other accounts in a short time, it is necessary to act without delay.

First of all, the bank should be contacted immediately and the transaction should be recorded. Then, a criminal complaint can be filed with the police station, gendarmerie, or directly with the Chief Public Prosecutor's Office.

During the application, the following evidence must be preserved:

• WhatsApp messages sent for fraudulent purposes,
• The phone number and profile information from which the messages came,
• The IBAN to which money was sent and account holder information,
• Bank receipts and transaction dates,
• Phone call records and voice messages if any,
• Other correspondence and screenshots regarding the fraud.

It is important to preserve the original correspondence and digital records, especially alongside screenshots. Because during the investigation phase, it may be necessary to verify digital data and identify the relevant accounts.

An important distinction needs to be made on this matter.

The fact that a person's WhatsApp account has been taken over and others are defrauded through this account does not mean that the account holder is automatically guilty or responsible.

Personal liability is essential in criminal law. Whether the person participated in the fraud act, whether they were aware of the incident, their intent, and other conditions of the specific case must be evaluated.

The person whose account was taken over may also be a victim of this situation. Therefore, it is important that they file a complaint, notify the platform, and warn their relatives as soon as they realize their account is being used without authorization.

The fact that the bank account belongs to someone else does not automatically eliminate that person's legal liability, nor does it mean that they are automatically guilty.

It must be investigated for what purpose the account was used, whether the account holder was aware of the fraud activity, whether they knowingly mediated money transfers, and the benefit they obtained.

Especially persons who let others use their bank accounts in exchange for a commission may face serious legal risks.

Our citizens should definitely not let others use their bank accounts, cards, mobile banking information, and verification codes.

First of all, WhatsApp's official account recovery process must be used.

The person should re-register using their own phone number and enter the six-digit verification code sent by SMS or phone call. This may end sessions on other devices using the account.

Unrecognized sessions in the linked devices section should also be checked and terminated. In addition, two-step verification should be enabled, the security of the email account should be checked, and transactions should not be made via suspicious links.

If money has been requested from relatives as a result of the account being seized, just getting the account back is not enough. The incident must also be evaluated in its legal and criminal dimensions.

Our most important rule should be this: Do not consider any money request coming through WhatsApp as verified just by looking at the sender's name and photo.

I particularly recommend the following precautions:

1. Verify the person asking for money by making a normal phone call to their registered old phone number.
2. Be careful against pressure to send money urgently.
3. Do not share WhatsApp's six-digit verification code with anyone.
4. Enable two-step verification.
5. Do not click on links you do not know.
6. Regularly check linked devices on WhatsApp.
7. Confirm suspicious money requests from your relatives through another communication channel.

Furthermore, setting a verification question or a security word known only to close family members can be an additional precaution.

Cyber fraud methods are no longer limited to fake messages alone. The trust people have in one another is also abused.

The use of a person's photograph, name, and contact information does not mean that person actually sent the message. Therefore, especially in money transfer requests, a secondary verification must definitely be made.

Our citizens who are exposed to fraud should not give up on filing a complaint out of shame or hesitation. Bank records, message contents, and digital traces can be important in terms of the investigation.

It must not be forgotten that the first step to security in the digital world is verifying the identity of the person in front of us. A few minutes of checking can prevent serious financial losses.