In a sophisticated cyber fraud scheme that has impacted dozens of citizens, scammers have successfully defrauded victims of millions of Turkish Lira by creating near-perfect clones of the Istanbul Metropolitan Municipality’s (İBB) official website.

The Modus Operandi The cybercriminals launched fraudulent websites designed to mirror the official "Istanbulkart" application portal. These fake sites appeared at the top of search engine results, tricking unsuspecting users into believing they were interacting with the legitimate municipal platform.

According to reports, the scammers lured victims with the promise of easy "Istanbulkart" applications or renewals, requesting a nominal fee of only 25-30 TL for the card issuance. However, once users entered their credit card details to pay this small amount, the criminals harvested their full financial information.

Victims Face Devastating Financial Losses The consequences for the victims have been severe. Many users, believing they were only authorizing a minor transaction, were shocked to find tens of thousands of liras withdrawn from their accounts shortly after entering their details.

Testimonies from victims highlight the scale of the deception:

One victim, attempting to apply for a "Blue Card," had 42,000 TL withdrawn from their account while expecting to pay only a 25 TL fee.
Another individual, attempting to pay a 39.99 TL fee for a replacement card, failed to notice that the authorization message actually confirmed a transfer of 39,999 TL.

Other cases involved significant unauthorized withdrawals of 74,000 TL and even foreign currency amounts like 874 Euros.

Legal Action and Expert Warnings The Istanbul Anadolu Chief Public Prosecutor's Office has launched an extensive investigation into the matter, with efforts to track down and apprehend the suspects currently ongoing. The fraud has reportedly affected at least 87 individuals over a two-year period.

Security experts are now issuing urgent warnings to the public. They emphasize that citizens should strictly avoid clicking on random links found in search engines for government services. Instead, users are advised to access official services exclusively through verified mobile applications or by typing the official, confirmed web addresses directly into their browsers. Furthermore, experts stress the critical importance of carefully reading the exact amount and the name of the merchant in bank authorization SMS messages before confirming any transaction with a password.