I Was Charged via PayU Without Consent After My Spouse's Mobile Was Hacked

On the night of October 7, 2023, sometime between 11:00 PM and midnight, my spouse became the victim of what we believe was a cyberattack. We use Türk Telekom, and our mobile payments were turned off by default. After inserting the SIM card into a new phone and installing apps, the device started behaving abnormally—apps closed by themselves and the phone became unresponsive.

Suddenly, we received a message saying, “Your mobile payment feature has been activated.” We immediately called Türk Telekom support to report this unauthorized activation and were told, “Our systems are currently down, please try again later.” Meanwhile, money started being withdrawn from the line balance.

We hadn’t even downloaded the Türk Telekom app yet when we received another SMS from PUBG Mobile confirming a successful in-app purchase—despite never making such a purchase. A total of ₺1,255 was withdrawn.

Shortly after, a message from PayU/Paycell arrived, stating: “₺1,255 has been charged. If this was not you, contact us.” We called the number right away and said the charge wasn’t ours, but they claimed we had “confirmed the purchase” and hung up on us. We never confirmed anything.

We are disabled individuals, already struggling financially, and this experience has added even more pain. This was not our fault—it happened due to a security flaw in Türk Telekom’s system and was processed through PayU without any real verification or consent.