As Türkiye prepares to implement a landmark age verification requirement for social media users on November 1, 2026, the Center for Combating Disinformation (DMM) has issued an urgent fraud warning to the public. The DMM, which operates under the country’s communications directorate, cautioned citizens that scammers are already exploiting the transition to trick users into revealing sensitive personal and financial information. In particular, fraudsters are reportedly sending fake messages and creating fraudulent links that mimic official notifications, using alarming phrases such as “Your account will be closed” and “Verify your age immediately.” These messages are designed to create panic and urgency, pressuring users into clicking on malicious links before they have time to verify the authenticity of the communication. The DMM’s warning comes as millions of users are expected to undergo age verification on popular social media platforms, making this a uniquely vulnerable period. The center emphasized that no official institution or social media company will ever send unsolicited messages demanding immediate action through unverified links. Citizens are urged to treat any such messages with suspicion, to avoid entering passwords, credit card details, or national identity numbers on any page reached via an email, SMS, or social media message, and to rely exclusively on official channels when completing any verification process.
The fraudulent schemes described by the DMM are sophisticated and multidirectional, targeting users through SMS, email, and social media direct messages. In many cases, the scammers impersonate social media platform administrators or government authorities, crafting messages that closely resemble legitimate security notices. For example, a user might receive a text message warning that their Instagram, X, Facebook, or TikTok account will be permanently deactivated within twenty-four hours unless they immediately verify their age through a provided link. The link then leads to a convincingly designed fake webpage that may ask for login credentials, a Turkish Republic identification number, date of birth, phone number, or even banking information. In some variations, the victim is asked to make a small payment to “confirm their identity,” which is a direct attempt to capture credit card details. The DMM stressed that these messages are not from official institutions and that their sole purpose is identity theft and financial fraud. By capitalizing on a real regulatory change, the attackers exploit both the public’s limited knowledge of the new procedures and natural fear of losing access to important online accounts. The center therefore urged internet users to pause, forward any suspicious messages to official reporting channels, and verify announcements only through DMM statements, government websites, or the official social media accounts of the relevant platforms.
Under the new regulation, age verification will be carried out exclusively through an “age verification token” obtained via the e-Government Gateway, Türkiye’s centralized digital government platform. This is a crucial detail that distinguishes the official process from fraudulent lookalikes. According to the DMM’s statement, users will log in to the e-Government system, verify their identity there, and receive a token that confirms they meet the age requirement. Importantly, social media platforms will not receive any identity information from this process. They will only receive confirmation of whether the user is above the specified age threshold. This design is intended to protect privacy and minimize data exposure: the platform does not learn the user’s legal name, birthdate, or national identification number, and the e-Government system does not receive information about the user’s social media activities. The token functions as a kind of digital proof of age, much like a bouncer checking an ID without recording the details. This privacy-preserving mechanism was chosen to align with both domestic data protection laws and international best practices. The DMM emphasized that any process requiring users to provide full identity information directly to a social media platform should be considered fraudulent, because the official system is purpose-built to avoid such data transfer. Citizens are being urged to understand this mechanism so they can immediately recognize fake websites that attempt to collect personal data under the guise of age verification.
The implementation timeline is also critically important for users to understand, as it affects how individuals should respond to online warnings. Starting on November 1, 2026, the age verification requirement will only apply to newly created social media accounts. Anyone who opens a new account on that date or later will need to complete the verification process through e-Government as part of account setup. However, existing accounts will be given a much longer transition period. The deadline for these existing accounts to complete age verification is March 31, 2027. This means that users who have already had social media accounts for some time will not suddenly lose access on November 1 if they have not yet verified their age. The DMM explicitly warned that messages threatening immediate closure or permanent loss of account access for failure to verify “today” are false and should not be trusted. The extended timeline provides ample time for a measured, orderly transition and reduces the likelihood that users will be forced into hasty decisions under pressure. From a practical standpoint, the DMM advises users to wait, seek official guidance, and not rush into any process unless they are absolutely certain they are using an authorized channel. Scammers often exploit deadlines, and the long transition period is itself evidence that official authorities do not expect or encourage instant verification. Therefore, any message that demands an immediate response or creates a false sense of emergency is a major red flag.
The broader context of the age verification regulation underscores its stated purpose: protecting children in the digital environment and ensuring the security of personal data. For years, governments around the world have struggled with how to shield minors from harmful content, online predation, and excessive data collection. Social media platforms often require users to confirm they are at least thirteen years old, but these self-reported declarations are widely considered ineffective because children can easily lie about their age. The Turkish regulation aims to create a more robust system that verifies age without compromising the privacy of adult users. The token-based model is an attempt to do this responsibly, ensuring that the personal data of users is not transferred to private technology companies. This is particularly important in an era of massive data breaches, corporate surveillance, and cross-border data flows. By keeping identity verification in the hands of the government and giving platforms only a binary answer about age eligibility, the system seeks to strike a balance between safety, privacy, and accountability. International observers and privacy advocates may view this as a constructive example, though implementation will undoubtedly require continuous monitoring and adjustments. For citizens, understanding the rationale behind the regulation can help reduce anxiety and make them less susceptible to phishing scams that rely on misinformation and panic.
In light of these warnings, the DMM has issued a set of clear and practical recommendations for all social media users. First, always access age verification through the official e-Government Gateway by typing the web address directly into the browser or using the official mobile application, rather than clicking links from emails, SMS messages, or social media posts. Second, remember that no social media platform will directly ask for your national identity number, full name, or financial details in connection with age verification; if a site requests this information, it is fraudulent. Third, be extremely skeptical of any message that conveys extreme urgency, such as “verify within fifteen minutes or lose your account forever,” because official institutions give notice and time, not ultimatums. Fourth, verify announcements by visiting the official website of the DMM, the relevant ministry, or the social media platform’s own verified official page. Fifth, never share verification codes, one-time passwords, or e-Government login credentials with anyone, regardless of how official the request appears. Sixth, report suspicious messages to the relevant authorities or platform security teams, and warn family and friends who may be less familiar with digital fraud. As the November 1 implementation date approaches, the DMM’s warning serves as an important reminder that technological transitions are frequently exploited by malicious actors. By staying informed, remaining calm, and relying only on official channels, citizens can protect themselves from fraud and ensure that the new age verification system operates as intended — protecting the vulnerable, preserving data privacy, and preventing scammers from profiting from this significant digital policy shift.