M.A., who lives in the central Kocasinan district of Kayseri, was directed to pay a debt of 102 lira and 37 kuruş through the "fake penalty notification link" sent to her mobile phone on June 23, 2026.
Meanwhile, M.A., whose credit card limit was 22 thousand liras, realized that her limit was increased to 400 thousand liras by the bank without her approval and request, and that she was defrauded by unfairly withdrawing 72 thousand 572 liras and 16 kuruş from her card.
Although she informed the bank that she did not request a limit increase, M.A., whose spending objection was rejected, applied to the Kocasinan District Consumer Arbitration Committee, claiming that her credit card limit was increased to 400 thousand liras without her knowledge and approval, and that this situation allowed fraudsters to spend high amounts.
The bank sent a defense to the committee examining the application and requested the rejection of the application, stating that the transaction was made using the 3D Secure (secure shopping) password and that the card holder is responsible for the security of the card information.
The committee, which examined within the scope of the Consumer Protection Law No. 6502 and relevant legislation, determined from bank records that the consumer had not requested a limit increase in the last 6 months.
Convinced that there is a direct connection between the limit increase without the consent of the consumer and the high amount of spending, the delegation decided to refund 72 thousand 572 liras and 16 kuruş to the consumer, considering that the bank's serious service defect and illegal action had a direct causal link with the damage caused by the fraudsters taking advantage of this security vulnerability and unfair limit increase to make the high amount of withdrawals.
"THE LIMIT INCREASE SHOULD HAVE BEEN PREVENTED IMMEDIATELY BY THE BANK"
Consumers Union Chairman Mahmut Şahin said that the use of technology by malicious people exposes consumers to serious risks, and that fraudsters trap citizens with fake links they prepare by imitating banks' phone numbers and websites.
Şahin pointed out that in suspicious cases, the relevant institution should be contacted directly and the incoming links should never be clicked.
Referring to the decision of the Kocasinan District Consumer Arbitration Committee, Şahin stated that the limit of a credit card with a limit of 22 thousand liras was increased to 400 thousand liras after clicking on the fake link and soon more than 72 thousand liras were withdrawn from the card.
Stating that financial institutions are institutions of trust in accordance with the Consumer Protection Law No. 6502, the Bank Cards and Credit Cards Law No. 5464 and the Supreme Court case law, Şahin made the following evaluation:
"The citizen's credit card limit is 22 thousand liras. By clicking on a link sent, the money instantly goes up to 400 thousand liras, and then there is a withdrawal of 72 thousand liras. There is a suspicious transaction here. The bank should have prevented a consumer from instantly increasing to 400 thousand liras while using a credit card with a limit of 22 thousand liras, and a precaution should have been taken there. The trust institution should protect the consumer. The security system already has such a limit." It must prevent the increase immediately. If it does not, this is not a security system. In other words, the bank's defense of saying 'I accepted this because of the 3D Secure security system' does not justify the bank. In fact, the arbitral tribunal here comes to the conclusion that the bank is unfair and should pay the money to the consumer due to the transaction. We witness that the bank is responsible for the consumer damages caused by not making the security system sound, and finally by the Kocasinan District Consumer Arbitration Committee. "It is an extremely good and exemplary decision for consumers in the same situation."
Warning citizens not to click on fake links and giving advice to people who are exposed to cyber fraud about the steps they should follow, Şahin stated that simply calling customer services by phone may be insufficient in the legal process.
Şahin added that in addition to the call, it is critical to contact the institution via e-mail or written notification channels and record the application.
