My Social Media Account Was Hacked: What Should I Do? Preserving Evidence and Legal Remedies in Turkey

1. Which offences can a hacked account involve?

“Account theft” is not a legal term, and Turkish law has no offence specific to social media accounts; the general provisions of the Turkish Criminal Code (TCK) apply. Which offence is committed depends on what was done after the account was entered, and the prosecutor and the court decide this on the facts. Common situations (Criminal Code [1]):

Offences against the confidentiality of communications and private life can only be investigated on the victim's complaint; offences concerning personal data are excluded from this rule (art. 139 [1]).

Terms:

• Offence subject to complaint (şikâyete bağlı suç): an offence that cannot be investigated unless the victim files a complaint. The complaint must be made within six months of learning of the act and of who the offender is (art. 73 [1]).
• Criminal report (suç duyurusu): informing the prosecutor or the police that an offence has been committed. For offences not subject to complaint, the prosecutor must investigate on their own initiative once they learn of facts suggesting an offence (Code of Criminal Procedure art. 160 [2]).

2. First steps after your account is taken over

1. Use the platform's official recovery route. Major platforms have dedicated help pages for hacked accounts, for example Instagram [3], Facebook [4] and X [5]. Some platforms send a security notice to the old address when the account email is changed; that notice may help you reverse the change. The Turkish National Police also advise trying recovery from a secure device and, if that fails, reporting the account to the platform (National Police Cybercrime Department FAQ [6], in Turkish).
2. Check the email account and phone line linked to the account. Social media accounts are usually recovered by email or phone. If your email account has also been taken over, secure it first.
3. Warn your followers through another channel. Use another account, messaging groups or people close to you to say that requests for money, codes or links from your account should be ignored.
4. Do not delete messages from the offender. If money is demanded for returning the account, those messages are evidence. Paying does not mean the account will be returned.
5. Be careful with people or accounts offering paid “account recovery”. The official recovery steps are on the platforms' own help centres.

3. How to preserve evidence

Much of the evidence is not in your hands but on the systems of the platform and internet service providers (login records, IP addresses). The prosecutor can request these. What you can do is keep the evidence you have access to complete and unaltered.

Electronic data counts as documentary evidence in civil proceedings (Code of Civil Procedure art. 199 [7]); how persuasive a piece of evidence is will be assessed by the court. Screenshots can easily be edited and may be challenged on their own, so it helps to keep several pieces of evidence that support each other:

• Security emails from the platform: notices such as “your password was changed”, “your email address was changed” or “new login from a device”. Do not delete them; keep the emails themselves, not only screenshots.
• Screenshots: the profile page, username and link (URL), the offender's posts and messages. Make sure the date and time are visible; do not crop or edit the images.
• Information from followers: screenshots of messages sent to them from your account; if they sent money, the receipts and the details of the recipient account.
• The offender's messages: any messages demanding money or anything else.
• Your correspondence with the platform: automatic replies and case or ticket numbers from your recovery request.
• Login records: once you regain access, save the login history and list of connected devices before clearing them.
• A short timeline: note when you noticed the problem and when you took each step. This makes it easier to write your complaint.

4. Legal remedies

Complaint or criminal report to the prosecutor

A complaint or criminal report can be made to the public prosecutor's office or to law enforcement (police, gendarmerie), in writing or orally to be recorded in minutes (Code of Criminal Procedure art. 158 [2]). The Turkish National Police state that in such cases a signed petition can be submitted to a police station, the prosecutor's office or the Cybercrime Branch, and that it should be handed in in person rather than scanned and emailed (National Police FAQ [6]). People with an electronic signature can also send petitions to prosecutors' offices through the UYAP Citizen Portal (UYAP [8], in Turkish).

It helps if your petition includes: the account's username and link, information showing the account is yours, the date and time of the incident, the changes made and posts published, any person you suspect and why, and a list of your evidence. Be specific: under the law, a report or complaint that clearly does not concern an offence, or that is abstract and general, results in a decision not to open an investigation (art. 158(6) [2]).

You do not need to know who the offender is. The prosecutor must collect evidence both for and against the suspect (art. 160 [2]). Identifying the offender may require records from the platform and internet service providers; obtaining information from platforms based abroad can take time and does not always succeed.

If the prosecutor decides not to prosecute, you may object to the criminal judgeship of peace within two weeks of being notified of the decision (Code of Criminal Procedure art. 173 [2]).

Blocking access if your private content is published

If the offender has published private photos, videos or messages from your account online, you can claim a violation of your private life and apply directly to the Cybersecurity Directorate (Siber Güvenlik Başkanlığı) to have access to the content blocked (Law No. 5651 art. 9/A [9]). Law No. 7590 of 24 July 2026 transferred these applications from the Information and Communication Technologies Authority (BTK) to the Cybersecurity Directorate.

• The application must include the exact address (URL) of the content, an explanation of how your rights are violated and information proving your identity; incomplete applications are not processed.
• You must submit your request to a criminal judgeship of peace within 24 hours of applying. The judge decides within 48 hours at the latest; otherwise the blocking measure lapses automatically (art. 9/A).

The platform's duty to respond

Under an amendment made by Law No. 7578, from 1 November 2026 social network providers with more than one million daily accesses from Turkey must give a positive or negative answer to applications by individuals within 48 hours, with reasons for a negative answer (Law No. 5651 additional art. 4(3) [9]; Official Gazette, 1 May 2026, No. 33240 [10], in Turkish). Before that date the duty was limited to applications concerning content that violates personality rights or private life. Whether the duty also covers account recovery requests is not yet clear.

Compensation claim

If the takeover caused you financial loss (for example lost sales on a business account or the cost of new advertising) or non-pecuniary harm through damage to your personality rights, you can claim compensation from the offender (Code of Obligations arts. 49 and 58 [11]; Civil Code arts. 24 and 25 [12]).

• Court: as a rule, the civil court of first instance (asliye hukuk mahkemesi) (Code of Civil Procedure art. 2 [7]); if the dispute is a commercial case relating to both parties' businesses, the commercial court of first instance (asliye ticaret mahkemesi) (Turkish Commercial Code arts. 4 and 5 [13]).
• Venue: a claim for the protection of personality rights can be brought where you live or where the defendant lives (Civil Code art. 25).
• Time limit: two years from learning of the loss and of the person liable, and in any case ten years from the act. If the act is an offence with a longer limitation period under criminal law, that longer period applies (Code of Obligations art. 72 [11]).
• Mediation: such tort claims are not on the general list of disputes requiring mediation before filing suit (Law No. 6325 art. 18/B [14]). However, if the dispute is a commercial case relating to both parties' businesses and a sum of money is claimed, applying to a mediator first is mandatory (Turkish Commercial Code arts. 4 and 5/A [13]).

A compensation claim requires the offender to have been identified, so the outcome of the criminal investigation often directly affects this route.

5. If others were harmed through your account

• If your followers sent money: they are the victims of the fraud. Each of them needs to file their own complaint with receipts and messages. Your records showing that the account was taken over will also support their cases.
• If insulting, threatening or other unlawful content was posted from your account: a complaint may be filed against you because of those posts. Records showing that the account was not under your control at that time (security emails, recovery request, your criminal report) are important for your defence. Reporting promptly gets the incident on record early.

6. After you regain access

• Save the login records and changes made before clearing them.
• Change the password of the account and of the linked email account; turn on two-factor authentication.
• Remove unknown sessions, connected devices and third-party apps with access to the account.
• Check for any email address, phone number or admin rights the offender may have added.

7. Time limits at a glance

8. Hypothetical example

This example is purely hypothetical. A sells homemade products through a social media account. One morning A receives a notice from the platform that the account email was changed, and can no longer log in. Soon after, posts appear asking followers to pay into a bank account for a “discount campaign”, and A receives a message demanding money to return the account. A keeps the security email, takes screenshots of the posts and messages, warns followers from another account and fills in the platform's recovery form. A asks the two followers who paid for their receipts. The next day A files a petition with the public prosecutor's office describing the events in date-and-time order with a list of evidence. The prosecutor investigates unauthorised access, altering data, aggravated fraud and blackmail together. The followers file their own complaints. If the offender is identified, A may consider a compensation claim for lost sales.

9. FAQ

I got my account back. Should I still report it?

It is not compulsory; the decision is yours. But regaining the account does not undo the offence. Because the offences in arts. 243 and 244 are not subject to complaint, withdrawing after you report does not by itself end the investigation. If others were harmed through the account, having the incident on record is also useful for you.

Can there be an investigation in Turkey if the offender is abroad?

An offence is deemed committed in Turkey if the act is committed wholly or partly in Turkey or its result occurs in Turkey (Criminal Code art. 8 [1]). Identifying and trying the offender may, however, depend on cooperation with foreign authorities and platforms and can take a long time.

How long do platforms and internet providers keep records?

Access providers (internet service providers) in Turkey must keep traffic data for a period set by regulation of no less than six months and no more than two years, and hosting providers for no less than one year and no more than two years (Law No. 5651 arts. 5 and 6 [9]). Platforms based abroad follow their own retention policies. Since records are not kept indefinitely, reporting without delay matters for obtaining evidence.

Can I log into the offender's account to collect evidence?

No. Entering someone else's account without permission may itself be an offence under art. 243, even if your aim is to collect evidence. Collecting the offender's records is the prosecutor's job; you can name the account you suspect, and why, in your petition.

Do I need a lawyer to file a criminal report?

No. You can submit the petition yourself or make your complaint orally to the police to be recorded in minutes (Code of Criminal Procedure art. 158(5)). Legal support can make things easier in a compensation claim or where several offences are involved.