What is Deepfake Fraud? Legal Responsibility for Fake Images and Sounds Generated with Artificial Intelligence

Why has deepfake fraud become a new generation of legal threat?

Deepfake fraudis a new generation of fraud methods that results from the use of artificial intelligence technologies to mimic a person's image, face, or voice in an extremely realistic way.

Using a few seconds of audio recording, the voice of a company executive can be imitated, a fake video can be created in which a person says things they never said, or a real person's face can be used by another person during a video call.

While these technologies can be used for legitimate purposes such as entertainment, art, and education, they also pose serious risks in terms of fraud, identity impersonation, blackmail, reputational attacks, and the unlawful use of personal data.

The Personal Data Protection Authority has also drawn attention to the threats posed by this technology to personal data, detection methods, and possible precautions in its Deepfake Information Note

What is Deepfake?

The term "deepfake" is a combination of the words "deep learning" and "fake".

In its simplest terms, deepfake is the alteration or complete artificial creation of a real person's image, voice, or movements using artificial intelligence and deep learning technologies.

For example;

A company owner's voice is cloned to request a money transfer from an accountant
a fake video meeting being held using the image of a manager,
Creating a fake video containing words that a person never actually said,
Presenting famous or well-known individuals as if they are giving investment advice
the person's face being superimposed onto another image

This could be an example of the misuse of deepfake technology.

With the advancement of technology, not only image but voice cloning has become one of the most important tools for fraud.

How are deepfake scams carried out?

While in classic fraud methods the perpetrator tries to persuade the victim through phone calls, messages, or fake websites, in attacks using artificial intelligence, the identity of a trusted person can be impersonated.

For example, a company employee might receive a phone call that sounds remarkably similar to their manager's voice:

"Please send the payment to this account immediately. I'm in a meeting; we need to complete the transaction urgently."

The employee can transfer money believing that the person seeking them is actually their manager.

Similarly, scammers can use the voice of a family member;

"I had an accident."

"My phone was stolen."

"You need to send money urgently."

Such statements can help the victim make a quick decision.

The common feature of these methods is the use of artificial intelligence to mimic an identity that the person trusts.

A study published in the Journal of the Turkish Academy of Justice in 2026 also points out that AI-powered social engineering attacks have become more realistic, faster, and harder to detect thanks to voice cloning and deepfake technologies.

Is using deepfake technology a crime in Türkiye?

An important distinction must be made here.

The use of deepfake technology alone is not a crime in all cases.

The use of deepfake technology in a film, in comedic content, or in a creative work explicitly described as artificial is evaluated differently.

However, technology;

to deceive someone
to obtain money or economic benefit,
violating his/her privacy,
unlawful use of personal data
insult,
blackmail,
unlawfully interfering with another person's account or information system

If used for this purpose, it may bring into question various types of crimes under the Turkish Penal Code.

Since there is no independent and comprehensive "deepfake crime" law in Türkiye that regulates all aspects of deepfake activities, the legal assessment must be made according to the specific act committed in the concrete case.

Can Articles 157 and 158 of the Turkish Penal Code be applied to deepfake fraud?

One of the most significant applications of deepfake technology is fraud.

Article 157 of the Turkish Penal Code defines fraud as deceiving someone through fraudulent conduct, thereby causing harm to that person or another, and gaining benefit for oneself or another.

Deepfake technology can be a tool used for deceptive behavior to mislead the victim .

For example, if the company owner's voice is cloned to deceive an accounting employee into making a money transfer, the crime of fraud could arise.

In specific cases, if the conditions listed in Article 158 of the Turkish Penal Code are met, such as the use of information systems or banks and credit institutions as tools, aggravated fraud .

Indeed, current criminal law studies indicate that AI-assisted social engineering attacks can be linked to fraud offenses under Articles 157-158 of the Turkish Penal Code, depending on the specifics of the case.

Is soliciting money through voice cloning a form of fraud?

Depending on the specific circumstances of the case, yes.

For example, an attacker could obtain voice samples from a company CEO's online conversations and use artificial intelligence to clone their voice.

Then I called the company's finance manager and said:

“We’ve reached an agreement with the new supplier. Send 1 million TL to the IBAN I provided immediately.”

When this instruction is given, and the employee, believing it to be genuine, makes the payment, the AI-generated fake voice a fraudulent tool .

The legal assessment here concerns not only the generation of the voice using artificial intelligence;

how the victim was deceived,
where the money was sent,
how information and banking systems are used,
the perpetrator's intent,
whether economic benefit is obtained or not

It should be done accordingly.

Deepfake and Personal Data Protection

Deepfakes are usually created using images of real people;

face images,
photos,
videos,
speech recordings,
voice samples

It is used.

This data may be considered personal data.

However, an important legal distinction exists: A facial or voice recording is not automatically "biometric data" in every case.

If data is processed using special technical methods for the purpose of uniquely identifying or verifying an individual, the provisions regarding biometric data and, consequently, special categories of personal data may also come into play.

If personal data is collected and processed unlawfully for the purpose of training a deepfake system or creating fake content, additional liability may arise under Law No. 6698 on the Protection of Personal Data (KVKK).

The Personal Data Protection Authority also considers deepfake technology a clear risk area in terms of personal data. In its statements in 2026, the Authority further emphasized that deepfake and identity impersonation are among the current legal and security risks created by artificial intelligence.

Crimes related to personal data may also occur under the Turkish Penal Code

The manner in which images, audio recordings, or other personal data belonging to an individual are obtained during the creation of a deepfake should also be evaluated from a criminal law perspective.

Depending on the specifics of the case;

Turkish Penal Code Article 135 – Recording of personal data

And

Turkish Penal Code Article 136 – Unlawfully disclosing or obtaining data

The application of these provisions may come into question.

For example, using a private recording of someone's voice that has been illegally obtained to create a deepfake system may not be legally evaluated the same way as using a sample of that person's publicly available speech.

In each case, the source and method of obtaining the data should be examined separately.

Can deepfake technology violate privacy?

Yes.

Creating fabricated images related to a person's private life and publishing them on the internet may constitute a crime of violating the privacy of private life, as defined in Article 134 of the Turkish Penal Code

Specifically, the process of artificially replacing a person's face with a sexually explicit image using artificial intelligence can have extremely serious consequences for the victim.

The fact that the image is not entirely real does not automatically eliminate legal responsibility.

The impression created regarding the person's private life and personal values, the manner in which the image was disseminated, and the perpetrator's motive should all be considered together.

What happens if someone is falsely accused of a crime using deepfake technology?

Deepfake technology is not only used for economic fraud.

For example, by using a person's image and voice;

"I stole money from this company."

"I committed this crime."

Let's assume a fake video was created in this way.

This type of content can seriously damage a person's reputation, professional career, and social life.

Depending on the nature of the content, defamation, libel, violation of personal rights, or other criminal and private law claims may arise.

Therefore, in deepfake cases, it's not just the question of "is the video real?" that matters, but also what perception the content creates about the victim

Is it possible to claim compensation for emotional distress due to a deepfake effect?

Regardless of criminal liability, the unauthorized and unlawful use of a person's image or voice a violation of their personal rights .

Under the provisions of the Turkish Civil Code concerning the protection of personality, the victim may request legal protection depending on the nature of the attack.

Under Article 58 of the Turkish Code of Obligations, compensation for non-pecuniary damages may arise due to the violation of personal rights.

For example, due to a deepfake image, a person;

commercial reputation damaged,
lost his job
humiliated in his/her social circle,
experienced psychological or occupational harm

If applicable, claims for material and moral damages may be evaluated according to the specifics of the incident.

Therefore, the same deepfake case can be the subject of both a criminal investigation and private law claims .

What can be done if deepfake content is spreading on the internet?

One of the primary goals is to prevent the content from spreading further.

The victim should be treated as soon as possible;

saving the URL address of the content,
Identifying the posting date and account,
taking screenshots and screen recordings,
If possible, keep the original file of the content
reporting the violation to the platform
evaluating the necessary legal applications

It is important.

In particular, regarding online publications that violate the privacy of private life, in Article 9/A may come into play depending on the specific circumstances of the case.

However, since legislation regarding internet content has undergone significant changes in recent years, requests for blocking access and removing content should be evaluated based on current legislation.

What should a deepfake victim do first?

In deepfake scams, time is of the essence.

Especially if a money transfer has been made, it is important to contact the bank or payment institution as soon as possible.

In addition, depending on the nature of the event;

notifying the bank and payment institution that the transaction is fraudulent,
Applying to the Public Prosecutor's Office or law enforcement units,
Providing evidence of forged content and correspondence,
making a notification to a social media or internet platform,
protecting account and phone information,
If necessary, applications regarding personal data and personality rights will be made

It should be evaluated.

It should be remembered that evidence may be erased later.

Therefore, it is important not only to take screenshots but also to preserve verifiable digital evidence according to the circumstances of the incident.

How to tell if something is a deepfake?

Due to the development of deepfake technology, it is becoming increasingly difficult to detect artificial content with the naked eye.

The Personal Data Protection Authority's information note on deepfakes also draws attention to certain indicators.

For example;

incoordination of facial and body movements,
unusual facial texture
a mismatch between lip movements and voice,
Unnatural images in glasses or light reflections,
robotic voice,
facial expression not matching what was said

This could be a cause for suspicion.

However, since current AI systems make these errors less and less, relying solely on the image "looking strange" is not enough.

What should companies do against deepfake scams?

Finance departments and senior executives, in particular, need to establish corporate procedures to protect against deepfake attacks.

One of the most important precautions is not to rely on single-channel instructions.

For example, for money transfers within the company exceeding a certain amount;

written confirmation in addition to the phone call,
second manager approval,
pre-determined verification code,
Confirmation through different communication channels,
double signature or double check

The mechanism is applicable.

Hearing a manager's voice or seeing their face during a video call should no longer be considered the sole method of authentication.

Can Company Executives' Social Media Posts Pose Risks?

Developing deepfake systems may not always require very large amounts of data.

Conversations on social media, podcasts, YouTube videos, or meeting recordings can be used for audio and video imitation.

The Turkish Personal Data Protection Authority's (KVKK) Deepfake Information Note also points out that facial and voice content on social media platforms can be used as a source in deepfake production.

Therefore, in particular;

company executives
public figures,
financial officials,
employees authorized to issue payment instructions

They may be at higher risk of deepfake attacks.

Are there any new legal regulations regarding deepfake technology in Türkiye?

Legislative discussions on this issue are ongoing in Türkiye.

A bill submitted to the Turkish Grand National Assembly on December 3, 2025, proposed a regulation requiring that fake content generated using artificial intelligence (AI) be labeled with a mark or statement indicating that it was created by AI.

However, as of September 4, 2026, the proposal is still in committee and is not yet a law.

Another bill submitted on January 8, 2026, proposes administrative sanctions against digital platforms that allow the sharing of audio, written, or visual content created using artificial intelligence tools without the individual's consent. This bill is also currently under consideration by the committee as of the same date.

Therefore, in existing disputes, assessments are primarily made based on the provisions of the current Turkish Penal Code, Personal Data Protection Law, Turkish Civil Code, Turkish Code of Obligations, and other relevant legislation.

What does the European Union AI Act propose for deepfake content?

The European Union has adopted a more specific regulatory approach than Türkiye on this issue.

Article 50 of the EU AI Actimposes an obligation on certain individuals who use AI systems to produce or manipulate deepfake image, audio, or video content to disclose that the content has been artificially produced or altered.

These transparency obligations came into effect on August 2, 2026.

Therefore, for technology companies operating in the European Union market, the issue of deepfakes has become not only a matter of criminal penalties or privacy rights, but also obligation of AI compliance and transparency .

Are all AI-generated videos illegal?

No.

Deepfake technology;

cinema,
advert,
education,
art,
humor,
game,
visual effects

There are many legally permissible uses for this, such as those listed above.

In a legal assessment, the purpose for which the content was created, the rights of the data subject, the method by which personal data was obtained, how the content was presented, and whether it misleads third parties are all important factors.

For example, a video explicitly described as an "AI-generated parody" cannot be judged the same way as a fake video created to give the impression that a company executive is actually giving payment instructions.

Frequently Asked Questions

Is creating deepfake videos a crime?

The mere use of deepfake technology is not automatically a crime. However, depending on the purpose for which the content is created and used, it may constitute fraud, violation of privacy, defamation, crimes related to personal data, or other offenses.

Is it a crime to imitate someone's voice using artificial intelligence?

The method by which the sound was obtained and the purpose for which it was used are important. Using it to deceive someone or to obtain economic gain may result in criminal liability.

I was scammed with a deepfake video, can I get my money back?

Depending on the circumstances of the incident, legal and criminal proceedings may be initiated. If a money transfer has taken place, it is important to notify the bank as quickly as possible and to contact the judicial authorities. The likelihood of recovering the money depends on the nature of the transaction, the accounts to which the money was received, and how quickly the process is initiated.

Can a compensation lawsuit be filed due to deepfake content?

In cases of violation of personal rights or material damage, it may be possible to claim compensation for both material and moral damages, depending on the circumstances of the incident.

Is it possible to create a deepfake using my photo from social media?

Technically, it's possible. However, the fact that a photograph is publicly available on the internet or social media doesn't give third parties the right to use it for any purpose they want.

Can deepfake content be evaluated under the Turkish Personal Data Protection Law (KVKK)?

Yes. Faces, voices, images, and other information belonging to real individuals may be considered personal data. The collection and processing of this data by the AI system must be evaluated separately in terms of the Turkish Personal Data Protection Law (KVKK).

Conclusion: Legal and technical measures must be taken together against deepfake fraud

Deepfake fraudhas become a significant problem in both information technology and criminal law, affecting both individuals and companies, with the advancement of artificial intelligence technologies.

Nowadays, hearing someone's voice or seeing their face during a video call may not definitively prove that the person is actually on the other end of the line.

If deepfake technology is used for fraudulent purposes, depending on the specifics of the case, charges may include fraud and aggravated fraud, crimes related to personal data, violation of privacy, and other criminal provisions

In addition, victims whose personal rights have been violated may also have access to private law and compensation remedies.

It is particularly important for companies to develop additional authentication mechanisms and not rely solely on audio or video instructions for payment and money transfer procedures.

Individuals who fall victim to deepfake or AI-powered fraud may need to act before digital evidence is lost, report the incident to their banks and the platform, and consider criminal, data protection, and compensation legal remedies depending on the nature of the incident.

Related Fields of Law

You can find information about related services on our IT law and criminal law pages, and you can submit your consultation request through our contact page .

Law Articles