Legal Liability of Banks in ATM Fraud Cases in Turkiye

With advancements in technology, automated teller machines (ATMs) have become an integral part of modern banking, offering ease and accessibility. However, as technology evolves, so do methods of fraud, and ATM-related scams have emerged as a significant concern. This article will explore the legal liability of banks in ATM fraud cases within the framework of the Turkish Civil Code (Article 2), the Turkish Commercial Code (Article 20/2), and relevant Court of Cassation (Yargıtay) rulings.

Methods of ATM Fraud

Fraudsters employ various techniques to exploit ATMs. The most common methods include:

1. Skimming (Card Cloning): A device installed on the ATM’s card slot copies the card details without the user’s knowledge.

2. Shimming: A more advanced method where thin devices extract data from chip-based cards, bypassing their security.

3. Card Trapping: Devices placed inside the ATM cause the card to get stuck, allowing fraudsters to retrieve it later.

4. Shoulder Surfing: Fraudsters observe users inputting their PIN codes, often in conjunction with other methods.

5. Phishing (Data Harvesting): Users are misled into sharing personal information via fraudulent emails or websites, enabling unauthorised transactions.

The Legal Liability of Banks

The liability of banks in ATM fraud cases is shaped by the following legal principles:

1. The Principle of Trust – Turkish Civil Code, Article 2 As institutions of trust, banks are obligated to implement robust security measures to safeguard customer data and funds. Banks are expected to adopt internationally recognised security standards and the latest technology. Failure to do so constitutes negligence.

2. The Prudent Merchant Rule – Turkish Commercial Code, Article 20/2 Banks must act with the diligence of a prudent merchant in their commercial activities. According to Yargıtay's decision (11th Civil Chamber, 2021/4810 E., 2022/485 K.): “Banks are required to establish mechanisms to detect suspicious transactions and take immediate preventative measures. A failure to do so will render the bank liable, regardless of the presence of security systems like 3D Secure.”

3. Liability Under the Turkish Code of Obligations

   • Exemption Clauses (Article 99): Banks cannot rely on exemption clauses that limit their liability for gross negligence. Such clauses are subject to judicial review and are deemed void if found unreasonable. Legal liability of banks in ATM fraud cases in Turkiye

   • Vicarious Liability (Article 100): Banks are strictly liable for any misconduct or errors caused by their employees or systems.

Customer Negligence and Bank’s Duty of Care

In determining liability, the courts assess both the customer’s conduct and the bank’s duty of care:

1. Customer’s Responsibility: Customers are expected to take reasonable precautions to safeguard their cards and PINs. However, if fraud occurs due to the bank’s security failures, liability shifts to the bank. For instance, where banks fail to implement robust SMS verification systems or identify suspicious transactions, their duty of care is breached, regardless of customer conduct.

2. Bank’s Enhanced Duty of Care:

   • Technical Security: Banks must implement industry-standard measures such as EMV chip technology, anti-skimming devices, and comprehensive fraud detection systems.

   • Physical Security: Banks should secure ATM locations with CCTV surveillance and prevent unauthorised devices from being installed.

   • Customer Awareness: Banks have a responsibility to provide clear and comprehensive information regarding fraud risks and preventive measures.

Significant Court Decisions

• Yargıtay 11th Civil Chamber (2021/4810 E., 2022/485 K.): In a case involving unauthorised transactions, the court ruled that the bank was partially liable due to its failure to detect a suspicious transaction, despite 3D Secure protocols being in place.

ATM fraud poses a serious threat to both individuals and financial institutions. Under Turkish law, banks are held to a high standard of care, requiring them to adopt the latest technological and physical security measures. Exemption clauses attempting to limit liability are generally void under judicial scrutiny.

While customers must exercise care in protecting their information, the bank’s failure to anticipate fraud risks, detect suspicious activity, or adopt modern security measures will render it liable. As highlighted by recent Yargıtay rulings, banks must uphold their duty of care as institutions of trust, ensuring both system integrity and customer protection.

To mitigate the risks associated with ATM fraud, banks should focus on security innovations, customer awareness campaigns, and swift remedial actions. By doing so, they can uphold their legal and ethical responsibilities, maintaining public confidence in the financial system.

If you have been a victim of ATM fraud or are facing challenges related to unauthorised transactions, CCS Law is here to provide expert legal guidance and support. Our experienced team of solicitors specialises in banking law and consumer rights, offering comprehensive advice tailored to your unique situation. Whether you need assistance in navigating the complexities of Turkish Civil and Commercial Law, pursuing compensation, or ensuring your rights are upheld, we are dedicated to achieving the best outcomes for our clients. Contact CCS Law today to schedule a consultation and let us safeguard your financial interests with professionalism and expertise.

Disclaimer: This article is intended for informational purposes only and does not constitute legal advice.

#ATMFraudTurkiye #BankingLawTurkiye #LegalLiabilityTurkiye #TurkishLawyers #FraudPreventionTurkiye #BankingFraudCases #IstanbulLawyer #AnkaraLawyer #IzmirLawyer #AntalyaLawyer #BursaLawyer #LegalAdviceTurkiye #TurkishCivilCode #ConsumerRightsTurkiye #YargıtayDecisions #LawFirmTurkiye #BankingFraudSolutions #TurkishLegalSystem #FinancialFraudLaw