Legal and Criminal Consequences of Creating a Fake Social Media Account

Entrance

Social media is one of the most important digital spaces that directly affects people's identities, professional reputations, social networks, and business relationships. Accounts opened on platforms such as Instagram, Facebook, X, TikTok, YouTube, LinkedIn, Telegram, and similar sites are no longer just communication tools; they also represent a person's digital identity, reputation, personal data, and business presence. Therefore, creating a fake social media account using a person's name, photograph, profession, title, family information, or elements related to their private life can have serious legal and criminal consequences.

In practice, the act of creating fake social media accounts manifests itself in various ways. Sometimes the perpetrator uses the victim's photo and name to create an account in their name. Other times, they use the victim's old photos, private information, or professional title to damage their reputation. Sometimes, the fake account is used for insults, threats, blackmail, or fraud. And sometimes, the fake account is used to solicit money from the victim's circle, collect private information, or humiliate the victim in public.

Therefore, creating a fake social media account cannot be explained by a single type of crime in every case. Depending on the context of the incident, unlawfully providing or obtaining personal data, access to an information system, violation of privacy, defamation, threat, blackmail, fraud, slander, disrupting a system, or altering data . Particularly if the victim's photograph, name, phone number, workplace information, or private images have been used, a more serious criminal penalty may be imposed.

Is creating a fake social media account a crime?

Whether creating a fake social media account is a crime depends on how the account was created, what information was used, and what actions were taken through that account. Using a pseudonym or aliases without revealing one's real identity is not a crime in itself. However, legal responsibility arises if an account is created using someone else's photograph, name, title, phone number, private information, or identity elements.

For example, creating an account with a generic nickname like "blue bird," "anonymous user," or "book reviews" is not the same as impersonating a specific person using their name, photo, and personal information. While the first case may involve anonymous use, the second could lead to an attack on personal rights, a breach of personal data, and, depending on the specific circumstances, criminal liability.

Even if no posts are made from the fake account, the unauthorized use of someone else's photos and personal information may be illegal. The perpetrator's liability is further increased if the account publishes content that is defamatory, libelous, sexually explicit, fraudulent, threatening, or reveals private information.

Using Someone Else's Photo and Data Protection Crime

The most common act in creating fake social media accounts is the unauthorized use of the victim's photograph. A photograph can be considered personal data because it identifies the person. Therefore, using someone else's photograph without their consent, especially publishing it on a social media account, may constitute a crime under Article 136 of the Turkish Penal Code, namely unlawfully disclosing, disseminating, or obtaining personal data.

According to Article 136 of the Turkish Penal Code, a person who unlawfully gives, disseminates, or obtains personal data of another person shall be punished with imprisonment from two to four years. This provision is important in the context of the unlawful sharing of a victim's photograph, phone number, address, private information, or other personal data on fake social media accounts.

The Supreme Court's practice also accepts that photographs taken in everyday clothing are not always considered within the scope of "privacy," but that these photographs constitute personal data and that their publication without consent may constitute a crime under Article 136 of the Turkish Penal Code. In its decision regarding the publication of the victim's pictures through a fake Facebook account, the 12th Criminal Chamber of the Supreme Court stated that since the photographs are not considered images related to private life, the case should be evaluated under Article 136 of the Turkish Penal Code instead of Article 134.

This distinction is extremely important in practice. The victim's photo may be of them in everyday clothing and may have been previously published on social media. However, this does not mean that another person can take that photo and use it on a fake account. The fact that a photo has been previously shared does not give third parties unlimited rights to use it. Consent, context, and purpose of use must be evaluated separately in each case.

Sharing Private Photos or Videos on a Fake Account

If a fake social media account publishes the victim's private photos, intimate images, audio recordings, private correspondence, or content related to their family life, it may no longer be considered a personal data breach, but a crime of violating the privacy of private life .

According to Article 134 of the Turkish Penal Code, a person who violates the privacy of another individual shall be punished with imprisonment from one to three years. The penalty is increased if the violation of privacy is committed by recording images or sounds. The second paragraph of the same article stipulates that a person who unlawfully discloses images or sounds relating to the private life of another individual shall be punished with imprisonment from two to five years.

For example, Article 134 of the Turkish Penal Code may be applied if intimate photos from a past relationship are shared on a fake account, screenshots of the victim's private correspondence are published, secretly recorded audio is shared, images from inside the home are published, or information relating to the victim's private life is disclosed.

It is particularly important to note here that the victim may have previously sent a photo or video to the perpetrator with their consent. However, this consent does not imply consent to the content being shared on social media, published on a fake account, or sent to third parties. Consent is limited to a specific purpose and scope. Exceeding this scope may result in illegality.

Insult, threat, or blackmail through a fake account

Fake accounts are often used not only for identity theft but also to commit crimes against victims or third parties. Insulting someone, sending threatening messages, blackmailing with private images, or making derogatory posts in the victim's name through a fake account constitutes a separate crime.

If the fake account posts insults, derogatory remarks, or statements targeting the honor and dignity of the victim or third parties, it may be considered a crime of defamation under Article 125 of the Turkish Penal Code. If the fake account uses threatening language such as "I will find you," "I will harm your family," "I will send you to your workplace," or "I will share your images," it may constitute a crime of threat. If the perpetrator uses the fake account to force the victim to send money, continue the relationship, send sexually explicit content, or perform an unwanted act, it may be considered a crime of blackmail.

In these crimes committed through fake accounts, the fact that the perpetrator's true identity is concealed does not absolve them of responsibility. During the prosecution phase, IP and login records, email or phone information linked to the account, device records, and any payment or bank transactions may be requested from the relevant platform. Even if the perpetrator used a VPN, a fake email address, or a temporary phone number, the investigation can proceed with technical evidence.

Fraud using a fake account

One of the most dangerous ways fake social media accounts are used is for fraud. The perpetrator can impersonate the victim and solicit money from their friends, relatives, clients, customers, or followers. Messages such as "I need money urgently," "My account is blocked," "Can you send it to this IBAN?", "There's an investment opportunity," or "You've won a raffle" can be used to deceive people.

In this case, the crime of fraud as defined in Article 157 of the Turkish Penal Code (TCK), or, if the conditions are met, the crime of aggravated fraud as defined in Article 158 of the TCK, comes into play. According to Article 158/1-f of the TCK, committing fraud by using information systems, banks, or credit institutions as tools is considered an aggravated offense. When the internet, social media accounts, bank accounts, mobile payment systems, or digital platforms are used as tools in committing the crime, an assessment of aggravated fraud can be made.

For example, impersonating someone's Instagram account to solicit money from their network, collecting payments by pretending to sell products through a fake boutique account, raising cryptocurrency with a fake investment advisor account, or requesting payments with a fake lawyer/institution account could all be considered within this scope.

In fraud cases, simply closing the fake account is not enough. Evidence must be collected including the IBAN, payment institution, cryptocurrency wallet address, phone number, sent receipt, correspondence, account URL, username, profile pictures, and money transfer records. The prosecutor's office should be requested to block the recipient account, identify subsequent accounts to which the money was transferred, and obtain transaction records from banks and payment institutions.

Taking over someone else's account and using it as a fake account

In some cases, the perpetrator does not create a new fake account; instead, they take over the victim's existing social media account and use that account to commit the crime. In this situation, the crime of unauthorized access to an information system , and if the conditions are met, the crime of disrupting the system or altering data, may come into play.

According to Article 243 of the Turkish Penal Code, a person who unlawfully accesses or remains in all or part of an information system shall be punished with imprisonment for up to one year or a judicial fine. Social media accounts, email accounts, mobile applications, or digital platform accounts may be considered within the scope of an information system, depending on the nature of the specific case.

If the perpetrator has changed the account password, deleted the account's content, made posts on behalf of the victim, sent messages to followers, transferred data elsewhere, or rendered the account inaccessible, then Article 244 of the Turkish Penal Code may come into play. Article 244 of the Turkish Penal Code punishes acts such as obstructing or disrupting the functioning of an information system, or corrupting, destroying, altering, rendering inaccessible, inserting data into, or transferring existing data within a system.

Therefore, it is important to distinguish between "my account was impersonated" and "my account was compromised." In the former, the creation of a fake account and a personal data breach are prominent, while in the latter, unauthorized access to an information system and interference with account security become more evident.

Slander and Accusations Using a Fake Account

If false accusations are made against a victim through a fake account, either in their name or targeting the victim, the crime of defamation may also come into play. For example, if a fake account makes untrue and accusatory posts claiming that a person is a "fraudster," "thief," "abuser," or "bribe-taker," this could be considered not only insult but also defamation or an attack on personal rights, depending on the nature of the incident.

If false reports or complaints are made to official authorities using a fake account, this can have more serious consequences. Not every serious accusation made on social media automatically constitutes defamation; however, posts that accuse someone of a crime they did not commit, and that could lead to an investigation or administrative action, should be examined separately.

Legal Consequences of Creating a Fake Account

Creating a fake social media account incurs liability not only under criminal law but also under private law. If the victim's personal rights have been violated, claims for cessation of the attack, prevention of the attack, determination of illegality, moral damages, and material damages may arise under the Turkish Civil Code and the Turkish Code of Obligations.

For example, if the victim's professional reputation has been damaged, clients lost, family relationships disrupted, psychological harm suffered, or social humiliation caused by the fake account, compensation for moral damages may be claimed. If commercial transactions were conducted in the victim's name through the fake account, resulting in client loss, damage to brand reputation, or financial loss, compensation for material damages may also be considered.

For companies, brands, lawyers, doctors, influencers, artists, and individuals practicing public professions, fake accounts can also constitute a violation of commercial reputation and trademark rights. For example, creating a fake account using a lawyer's name and photo to solicit consultation fees, sharing fake treatment recommendations in a doctor's name, or organizing a fake campaign in a brand's name can result in both criminal and civil liability.

Content Removal and Account Closure

When a fake social media account is created, the victim's most urgent need is often to have the account closed or the content removed. Platforms have their own complaint mechanisms. On platforms like Instagram, Facebook, X, TikTok, and LinkedIn, complaints can generally be made under headings such as "impersonation," "personal data breach," "privacy violation," or "fraud.".

However, evidence must be gathered before a platform application is submitted. Because when an account is closed or content is deleted, it can be difficult to obtain evidence for a criminal investigation and a compensation claim. Therefore, the account's username, profile URL, profile picture, biography information, posts, correspondence with followers, date and time information, and how the victim's personal data was used must be recorded.

If images or sounds that violate the right to privacy are published, an application to block access due to the violation of privacy may be filed under Article 9/A of Law No. 5651. This application must clearly state the full URL address of the publication causing the violation, the specific aspects of the violation, and the applicant's identification information.

What should a victim of a fake account do?

Upon discovering a fake social media account, the first step should be to gather evidence without panicking. Reporting and immediately closing the account could result in the loss of evidence. Therefore, the initial steps should include recording the account's full username, URL link, profile picture, descriptions used, posts, messages, how the victim's name and photo were used, and any defamatory or fraudulent content.

A report of a fake account can then be made to the platform. However, if a crime has been committed through the account, a complaint to the platform alone is not sufficient. A criminal complaint must be filed with the Public Prosecutor's Office. The criminal complaint must clearly state on which platform the account was created, which personal data was used, when the account was discovered, to whom messages were sent from the account, which posts were made, and how the victim was harmed.

A request should be sent to the relevant platform by the prosecutor's office to obtain the account creation date, login IP records, associated email and phone information, device information, and user activity data. If money was requested through the fake account, the IBAN, payment institution, cryptocurrency wallet address, and bank records should also be investigated. If private images were shared, methods of content removal and access restriction should also be considered.

How should evidence be collected?

The process of gathering evidence in fake social media account cases must be carried out meticulously. A single screenshot may often not be sufficient. The screenshot should show the date and time, URL, username, and account profile information.

The main evidence that needs to be collected is as follows:

The fake account's username, profile URL, profile picture, biography text, photos of the victim used, posts, stories, comments, people followed, messages sent from the fake account, money requests made in the victim's name, IBAN information, phone numbers, email addresses, links sent, insulting or threatening content, private images, and all records showing a connection between the account and the victim.

If necessary, notarized documentation, expert reports, screen recordings, or digital forensics reports may be obtained. Technically strengthening the evidence is particularly important in cases where commercial reputation has been damaged, a fake account has reached a wide audience, private images have been disseminated, or fraud has been committed.

What crimes should be listed in the complaint letter?

In cases involving the creation of fake social media accounts, the complaint should not be limited to a single crime. Depending on the specific circumstances, the following crimes may be considered:

Unlawful disclosure or acquisition of personal data, unauthorized access to an information system, obstruction of the system or alteration of data, violation of privacy, defamation, threat, blackmail, aggravated fraud, libel, and trademark infringement.

However, instead of randomly listing the crimes in the petition, it should be explained which action each crime stems from. For example, it should be specified as follows: "The suspect opened a fake account using the client's photograph and name; therefore, the unlawful dissemination of personal data is at issue. Money was requested from the client's relatives through the same account; therefore, an investigation should be conducted regarding qualified fraud. Private images belonging to the client were published on the account; therefore, the crime of violating the privacy of private life has occurred.".

Perpetrator Identification and IP Records

The biggest challenge with fake accounts is identifying the perpetrator. The perpetrator may have used a fake email address, a temporary phone number, a VPN, a foreign IP address, or a device belonging to someone else. However, this does not mean that investigation is impossible.

The prosecutor's office may request account creation and login records from the platform. IP records may be used to contact the internet service provider. If the account is linked to a phone number, subscription information may be requested from the GSM operator. If fraud is involved, the perpetrator can be traced through bank accounts and money transfers. Shipping, delivery, payment institution, cryptocurrency exchange, advertising account, or device records may also be used to identify the perpetrator.

However, an IP address alone does not always provide definitive identification of the perpetrator. Possibilities such as using a shared internet network, family home, workplace, cafe, dormitory, VPN, or someone else's device should be considered in the case. Therefore, IP records, message content, financial transactions, device analysis, account connections, and witness statements should be examined together.

How should the defense of someone who creates a fake account be evaluated?

In fake account files, suspects often offer defenses such as "I didn't open the account," "Someone else used my phone," "The photo was already on the internet," "I opened it as a joke," "I had no intention of causing harm," or "I closed the account immediately.".

These defenses are not automatically accepted or rejected. The court makes its assessment based on concrete evidence. Factors considered include: the device from which the account was accessed, the IP address used, the email or phone information, the account's connection to the suspect, previous disputes with the victim, posts made on the account, the content of messages, whether money was requested, the source of the photos used, and how long the account remained active.

The defense that "the photo was on the internet" alone does not guarantee legal validity. The mere fact that a photo is found on the internet does not mean it can be used to impersonate someone else or create a fake account. Consent, purpose, context, and the manner of use are the determining factors.

Conclusion

Creating a fake social media account is an act that can have serious legal and criminal consequences, depending on the specifics of the case. Using an anonymous account without revealing one's identity may not be a crime in itself; however, creating an account using someone else's name, photograph, personal information, professional title, or content related to their private life is unlawful.

In such cases, the crime of unlawfully disclosing or obtaining personal data under Article 136 of the Turkish Penal Code (TCK) frequently comes to the fore. If private images or sounds have been shared, the crime of violating the privacy of private life under Article 134 of the TCK applies; if the existing social media account has been hacked, the crime of unauthorized access to an information system under Article 243 of the TCK applies; if data has been deleted or altered from the account, the crime of unauthorized access under Article 244 of the TCK applies; if money has been demanded, the crime of aggravated fraud under Article 158 of the TCK applies; and if insult, threat, or blackmail has occurred, the relevant crimes are evaluated separately.

The most important aspect for the victim is preserving the evidence before the fake account is closed. All digital traces, such as the account URL, username, profile information, photos used, posts, messages, date and time information, IBAN or phone number, should be preserved; then, complaints to the platform, filing a criminal complaint with the Public Prosecutor's Office, content removal, and, if necessary, compensation should be considered together.

In conclusion, creating a fake social media account should not be seen as a simple internet prank. This action can directly affect a person's identity, reputation, privacy, personal data, and assets. Therefore, the process, for both the victim and the suspect/defendant, should be conducted with knowledge of cyber law and criminal law, ensuring that evidence is not lost and that the legal classification is made correctly.