Digital threats to Turkey’s financial sector

Phishing, fake loan ads, unlicensed gambling, and money mule networks are exploiting Turkish financial brands at industrial scale. Read the report to learn what your organization can do about it.

8,400+

phishing domains

targeting Turkish banks

6,600

scam ads

on Facebook and Instagram in a single month

23,000+

victim complaints

recorded across Turkey

Key trends

Scam advertising has industrialized. Turkish banks are the primary target.

Between November 2025 and March 2026, Group-IB documented five interconnected scam schemes impersonating dozens of Turkish banks across phishing pages, Meta ads, gambling platforms, and money mule networks. Over 80% of the activity ran through Facebook and Instagram, with infrastructure rotating weekly and ads lasting as little as 30 minutes before being replaced.

Phishing kits are sold as a service for $250.

A single commercially distributed kit powers over 6,700 domains impersonating Turkey's government services portal, supports the majority of Turkish banks, and is sold on underground channels in cryptocurrency. At least four distinct campaign clusters share this infrastructure.

The laundering chain ends in crypto — and starts with a social media ad.

Recruitment ads promise 30,000–50,000 TL for “renting” a bank account. Operators fragment stolen funds across sets of 3–5 accounts and convert them to cryptocurrency through exchanges. Court records confirm sentences of up to 10 years.

What’s inside

Full analysis data from November 2025 through April 2026 covering phishing, scam advertising, unlicensed gambling, and money laundering targeting Turkish financial institutions

5 interconnected scam schemes documented end-to-end with technical evidence, victim data, and infrastructure analysis

Court records, law enforcement actions, and real victim cases including losses up to $16,000

Actionable recommendations for users and financial institutions

Digital Risk Protection coverage mapped to each threat category

The five schemes in this report form a single criminal value chain: housing phishing and loan scams harvest credentials, age-based payout schemes feed vishing operations, gambling platforms extract direct losses, and IBAN rental provides the laundering infrastructure to cash everything out through crypto. If your brand operates in Turkey’s financial sector, this is the research your team needs.

Olga Ulchenko

Head of CERT-GIB, META

Frequently asked questions

Where does the data in this report come from?

arrow_drop_down

All data is sourced from Group-IB’s Digital Risk Protection platform, CERT-GIB, Group-IB Threat Intelligence, and open-source intelligence including Meta Ad Library analysis, over 23,000 victim complaints on Şikayetvar, court records, honeypot registrations, and technical analysis of phishing kit source code.

What time period does the report cover?

arrow_drop_down

The report covers the investigation period from November 2025 through April 2026, with historical context tracing back to August 2023 when the first malicious activity was observed.

Who is this report for?

arrow_drop_down

The report is designed for fraud and security teams at Turkish financial institutions, digital risk protection practitioners, compliance officers, platform trust and safety teams, and regulators responsible for financial crime enforcement in Turkey.