Get 24/7 incident response assistance from our global team
Your guide to AI innovation, adoption, and acceleration in cybersecurity
Modern fraud isn't an event. It's an industrialised campaign that begins weeks before the payment. The transaction is where fraud ends, not where it happens. This paper shows how to disrupt the campaign weeks before the payment, not document it after.
Your guide to AI innovation, adoption, and acceleration in cybersecurity
Learn more
Scam advertising has industrialized. Turkish banks are the primary target.Phishing kits are sold as a service for $250.The laundering chain ends in crypto — and starts with a social media ad.Full analysis data from November 2025 through April 2026 covering phishing, scam advertising, unlicensed gambling, and money laundering targeting Turkish financial institutions5 interconnected scam schemes documented end-to-end with technical evidence, victim data, and infrastructure analysisCourt records, law enforcement actions, and real victim cases including losses up to $16,000Actionable recommendations for users and financial institutionsDigital Risk Protection coverage mapped to each threat category
All data is sourced from Group-IB’s Digital Risk Protection platform, CERT-GIB, Group-IB Threat Intelligence, and open-source intelligence including Meta Ad Library analysis, over 23,000 victim complaints on Şikayetvar, court records, honeypot registrations, and technical analysis of phishing kit source code.
The report covers the investigation period from November 2025 through April 2026, with historical context tracing back to August 2023 when the first malicious activity was observed.
The report is designed for fraud and security teams at Turkish financial institutions, digital risk protection practitioners, compliance officers, platform trust and safety teams, and regulators responsible for financial crime enforcement in Turkey.
Yes. The full report is available for download after completing the form.
We see the full picture of the evolving cyber threat landscape thanks to unique tools for monitoring the infrastructure used by cybercriminals and data from battlefields:
