Asutay Duhan Meydan
14 August 2026
Artificial intelligence has not created a new form of dishonesty. Fraud remains fraud. The offender deceives another person and obtains an unlawful benefit as a result.
What has changed is the means by which deception can be carried out.
Voice cloning can imitate a relative, a bank employee or a company executive. Generative video can create a convincing visual presence where none exists. Large language models can produce personalised messages in large numbers and adapt them to the profile of each victim. Synthetic identities can be created with a degree of consistency that was previously difficult to maintain.
These technologies do not alter the legal essence of fraud. They do, however, affect its reach, credibility and cost.
The legal question should therefore not begin with whether artificial intelligence creates a separate category of fraud. In most cases, it does not. The proper question is how existing criminal law applies when AI becomes part of the fraudulent conduct and, separately, whether the provider of the AI system can bear responsibility for the way its technology is used.
The first issue can largely be addressed through existing criminal law. The second is more difficult.
AI as an Instrument of Deception under Turkish Criminal Law
Turkish criminal law does not currently contain a separate offence of “AI fraud”.
The starting point remains Article 157 of the Turkish Penal Code No. 5237. Fraud requires deceptive conduct, damage suffered by the victim or another person, and a benefit obtained by the offender or a third party.
AI-generated content can become part of the deceptive conduct.
A cloned voice used to convince a victim that a family member urgently needs money is one example. A synthetic video of a company director instructing an employee to make a transfer is another. AI-generated correspondence may also be used to support a false identity or maintain a fabricated commercial relationship.
The legal classification depends on the way the deception is carried out.
Article 158(1)(f) is particularly important because it covers fraud committed through the use of information systems, banks or credit institutions as instruments.
This provision should not be applied merely because AI was used somewhere in the factual background. Artificial intelligence is not itself listed as an aggravating circumstance. The statutory element still has to be established.
Where a deepfake, cloned voice or AI-generated message is transmitted through an information system and that system forms part of the mechanism through which the victim is deceived, Article 158(1)(f) may apply.
The distinction developed in Court of Cassation case law remains relevant. Fraud requires deception of a person. An information system is not itself the subject of deception in the sense required by the offence. Where the offender manipulates a system without deceiving a natural person, the legal analysis may move away from fraud and towards offences concerning information systems.
This distinction will become more important as AI systems become more autonomous.
If an employee watches a synthetic video of the chief executive and transfers company funds because he believes the instruction to be genuine, the deception is directed at a human being.
If an offender instead manipulates an automated system so that money is transferred without any meaningful human decision being involved, a different criminal-law analysis may be necessary.
The use of a bank also requires care.
Court of Cassation decisions distinguish between cases in which a bank or banking infrastructure is used as an instrument of the fraudulent scheme and cases in which the bank merely serves as the place to which the victim sends the money after being deceived by other means.
The fact that the proceeds ultimately enter a bank account does not by itself determine the aggravated form of the offence.
That distinction should not disappear merely because AI has been added to the factual scenario.
Impersonation, Deepfakes and Article 158(1)(l)
AI-assisted impersonation also brings Article 158(1)(l) into consideration.
The provision covers certain forms of fraud in which the offender presents himself as a public official or as an employee of a bank, insurance company or credit institution, or falsely claims a connection with those institutions.
Voice cloning and deepfake technology can make this form of deception substantially more convincing.
A victim may receive what appears to be a video call from a bank employee. The voice may correspond to a real employee whose recordings were obtained online. Corporate logos and internal terminology may be reproduced accurately. Personal information taken from previous data breaches may be added to increase credibility.
The AI element makes the deception stronger. It does not create the aggravating circumstance.
The aggravating circumstance arises from the identity or institutional relationship falsely represented by the offender.
This also means that not every AI impersonation falls within Article 158(1)(l). A cloned voice of a friend, business partner or family member may still form the basis of fraud, but the application of Article 158(1)(l) depends on the statutory categories set out in the provision.
The distinction is simple but important. The fact that the technology is sophisticated cannot replace the elements required by the Penal Code.
Article 245/A and AI Tools Designed for Criminal Use
Article 245/A deserves more attention in the context of artificial intelligence.
The provision concerns devices, computer programs and similar instruments created or adapted for the commission of certain offences involving information systems.
Its relevance depends heavily on purpose.
A general-purpose language model cannot sensibly be treated in the same way as software built for the exclusive or predominant purpose of committing cyber-enabled offences. A general-purpose model may be used for legal research, translation, education, coding or ordinary commercial work. The possibility that it may also be misused does not change the nature of the product.
A different question arises where a service is developed around criminal functionality.
Consider software designed specifically to clone executives’ voices, generate fraudulent payment instructions and automate communications with employees authorised to transfer company funds. Or a service that produces bank-impersonation scripts, synthetic identification material and customised phishing content as an integrated package.
In that situation, Article 245/A becomes materially more relevant.
There does not appear to be an established body of Turkish case law applying Article 245/A directly to generative AI products. It would therefore be wrong to present the provision as if its application to such systems were already settled.
The more defensible point is narrower.
Turkish criminal law already distinguishes between ordinary technology that may be misused and tools created for criminal purposes. That distinction can become important when AI products are designed specifically around fraudulent conduct.
The Provider Is Not the Fraudster
The difficult issue begins when attention moves from the user of the AI system to the company that provides it.
A provider should not become criminally responsible merely because its technology was useful to the offender.
Article 20 of the Turkish Penal Code is the starting point. Criminal responsibility is personal. A person cannot be held criminally responsible for another person’s conduct simply because there is some factual connection between them.
Participation must therefore be established under the ordinary rules of criminal law.
Article 39 is relevant because aiding may include providing the means used for the commission of an offence or otherwise facilitating its execution.
The fact that an AI provider supplies a tool does not resolve the issue.
The central question remains whether the provider, or the relevant natural persons acting within the provider, intentionally contributed to the offence in a manner capable of satisfying the rules on participation.
There is a clear difference between two factual situations.
In the first, a general-purpose AI company operates a service used by millions of people for lawful purposes. A user circumvents safeguards and employs the model in a fraud scheme without the provider having specific knowledge of that operation.
In the second, persons within a provider know that a particular customer is operating a fraud campaign, continue to supply specialised functionality for that campaign and actively assist in overcoming restrictions designed to prevent the misuse.
The first situation does not become criminal participation simply because the technology made the offence easier.
The second requires a much closer examination of intent and assistance.
This is where discussions of AI provider liability often become imprecise. The fact that misuse was technically foreseeable is not the same as participation in the offence. Nor is the mere capacity to block a user necessarily sufficient to establish criminal liability.
Criminal law requires more than hindsight.
It requires proof of the elements attached to the relevant form of participation.
The distinction between natural persons and the company itself must also be preserved. Turkish law does not impose criminal penalties on legal persons in the same way as it does on natural persons, although security measures and other legal consequences may apply where the statutory conditions are met.
The phrase “criminal liability of the AI company” should therefore be used carefully.
Civil Liability and the Failure to Intervene
The absence of criminal participation does not end the inquiry.
Provider conduct may also be considered under the general principles of civil liability.
Article 49 of the Turkish Code of Obligations requires unlawful and culpable conduct, damage and a sufficient causal link.
In AI-related fraud cases, the difficult part is often not the existence of damage. It is identifying the legally relevant conduct attributable to the provider.
A general allegation that a provider “should have prevented fraud” is not enough.
The analysis becomes more serious where the facts are more specific.
Assume that a voice-cloning service receives repeated and credible complaints concerning the same account. The account is allegedly being used to impersonate bank employees and obtain money from victims. The provider can suspend the account without disabling the service for lawful users. It nevertheless allows the account to continue operating.
Whether civil liability follows would still depend on the applicable legal elements. The factual position, however, is clearly different from the position of a provider that has no specific knowledge of the offending use.
Knowledge and practical ability to intervene may therefore matter, but they do not remove the need to prove fault and causation.
This is an area in which Turkish law currently offers general doctrines rather than an AI-specific liability rule.
Personal Data Used in AI-Assisted Fraud
AI-assisted impersonation frequently depends on personal data.
Voice samples, photographs, videos, social-media material and biographical information may all be used to produce convincing synthetic content.
Law No. 6698 on the Protection of Personal Data may therefore apply independently of the fraud offence.
The Turkish Personal Data Protection Authority has already identified deepfake technologies as a source of risks involving fraud, manipulation and misuse of personal information.
The liability of an AI provider under data-protection law, however, depends on its role in the processing activity.
It would be inaccurate to assume that every AI provider is automatically the data controller for every item of personal data uploaded by every user.
The relevant question is who determines the purposes and essential means of the processing.
Where the provider itself determines how biometric-like voice or image data is collected, stored, reused or incorporated into its own systems, its obligations may be substantial. Where it merely provides infrastructure for processing determined entirely by another actor, the legal characterisation may be different.
The analysis must therefore remain activity-specific.
The European Union: Duties Before the Fraud Occurs
The European Union regulates the same risk through a broader combination of criminal law, data-protection rules and AI-specific obligations.
Fraud itself remains primarily a matter for Member State criminal law, while Directive (EU) 2019/713 deals with fraud and counterfeiting involving non-cash means of payment.
The more significant difference appears at provider level.
The AI Act introduces obligations that apply before a particular victim has been deceived.
Article 50 is especially relevant to synthetic content. It imposes transparency-related obligations concerning certain AI-generated or manipulated content, including deepfakes.
The provision is important because it addresses the architecture of the system rather than waiting until the fraud has been completed.
That does not mean an AI provider becomes financially responsible whenever a criminal removes a watermark or misuses generated content.
Article 50 is not a shortcut to civil liability.
It is a regulatory obligation. Its breach and the civil consequences of a particular fraud remain separate legal questions.
The same caution is necessary when considering the provisions applicable to general-purpose AI models with systemic risk. The AI Act contains obligations concerning model evaluation, risk assessment and mitigation, cybersecurity and serious incidents. Those obligations are significant, but they do not convert providers into guarantors against every unlawful use of their systems.
The Digital Services Act may also become relevant where AI-generated fraudulent material is distributed through a service falling within its scope.
Again, legal roles matter.
A model developer is not necessarily a hosting service provider. A hosting service provider is not necessarily the developer of the model that generated the content. The same company may sometimes perform several roles, but they should not be assumed.
The GDPR creates an additional layer where the production or dissemination of synthetic content involves personal data.
The European model therefore differs from the Turkish position mainly because provider obligations are more specifically regulated at system level.
The difference should not be overstated. EU law still does not establish a general rule that an AI provider must compensate every victim of fraud committed with its technology.
The United States: Fraud Law and Sectoral Regulation
The United States reaches similar conduct through a more fragmented body of law.
Federal offences such as wire fraud and bank fraud can apply where the statutory elements are satisfied. Aggravated identity theft may also become relevant in cases involving another person’s means of identification.
Federal aiding-and-abetting principles are important for provider liability for the same reason that Turkish participation rules are important. Supplying technology is not identical to intentionally assisting an offence.
AI-generated voices are also subject to communications regulation.
The Federal Communications Commission has confirmed that AI-generated human voices fall within the relevant rules concerning artificial or prerecorded voices under the Telephone Consumer Protection Act.
That matters for automated calls using cloned voices.
The Federal Trade Commission’s rules concerning government and business impersonation create another regulatory layer where artificial intelligence is used to support false institutional identities.
The Rytr proceeding is also useful in understanding the limits of provider liability.
The FTC had pursued an AI service capable of generating consumer reviews. In December 2025, the Commission reopened and set aside its previous final order.
The case does not establish broad immunity for AI providers. It does show that the fact that a technology can produce deceptive material does not, without more, resolve the legal responsibility of the company providing it.
That point is equally relevant outside the United States.
Factors Relevant to Provider Liability
A single formula is unlikely to resolve provider liability across criminal, civil and regulatory law.
Some factors nevertheless recur.
The first is knowledge. General awareness that a product can be misused is different from specific knowledge that an identifiable service, account or customer is engaged in repeated fraud.
The second is control. A provider capable of disabling a particular feature or account without disrupting lawful uses is differently situated from a company that has no meaningful ability to identify the relevant activity.
The third is purpose. General-purpose AI should not be treated in the same way as a system developed substantially around criminal impersonation or fraudulent conduct.
The fourth is causation. The existence of AI somewhere in the chain of events does not establish that the provider’s own conduct caused the victim’s loss in the legally required sense.
These are not elements of a new legal test. They are factual considerations that may affect the application of existing rules.
Their importance will vary depending on the legal question.
Criminal participation requires particular attention to intent and assistance. Civil liability requires fault and causation. Regulatory law may impose obligations without requiring proof that the provider participated in the underlying offence.
Those distinctions should remain separate.
Does Türkiye Need a New AI Fraud Offence?
Probably not as the first response.
Turkish criminal law already contains provisions capable of addressing a large part of AI-assisted fraud.
Articles 157 and 158 address the underlying deception. Article 245/A may become relevant where tools are specifically created for criminal use. Other offences concerning information systems, payment instruments and personal data may apply depending on the facts.
The more significant regulatory gap concerns the obligations of the companies that design and operate AI systems capable of high-risk forms of impersonation.
Türkiye does not currently have a horizontal AI statute comparable to the EU AI Act.
This does not mean providers operate outside the law. Criminal-law participation rules, the Turkish Code of Obligations, Law No. 6698 and sector-specific legislation continue to apply.
What remains less developed is the point at which a provider must take preventive action against a form of misuse that is no longer hypothetical.
That question cannot be answered by saying either that providers are always responsible or that they are never responsible.
The answer depends on what the provider knew, what it was capable of doing and what role its conduct actually played in the offence.
Conclusion
AI-assisted fraud should not be treated as an entirely new species of crime.
In Turkish law, the existing structure of fraud and aggravated fraud remains capable of dealing with many of the most obvious scenarios involving voice cloning, deepfakes and AI-generated communications.
The use of AI does not itself satisfy Article 158. The statutory aggravating circumstance must still be established. The role of the information system, the identity being impersonated and the use of banking infrastructure must be analysed on the facts of each case.
The more difficult problem concerns the provider.
A general-purpose AI company should not be treated as an accomplice merely because a criminal found a way to misuse its product. Existing principles of personal criminal responsibility do not support such an approach.
The position may change where the provider’s connection to the offence becomes more direct. Specific knowledge of ongoing fraud, deliberate assistance, specialised functionality designed for the criminal operation or continued support despite clear evidence of misuse may materially alter the legal assessment.
EU law is already imposing more detailed preventive obligations at provider level. The United States continues to rely on a combination of criminal law and sectoral regulation. Türkiye still approaches the issue mainly through existing general doctrines.
For Turkish law, the immediate question is therefore not whether a new offence called “AI fraud” should be enacted.
The more difficult question is whether the current legal framework adequately identifies the point at which a technology provider ceases to be a neutral supplier and becomes legally responsible for its own contribution to a fraudulent operation.
That issue will become harder to avoid as voice cloning, synthetic video and autonomous AI systems become cheaper and easier to use.
Asutay Duhan Meydan