Crédit Mutuel Arkéa cyberattack: the wave of scams to anticipate

After the cyberattack on Crédit Mutuel Arkéa announced on November 4, 2026, the bank warned its customers. It reports phishing attempts impersonating it. This is a common pattern: a high-profile attack serves as a pretext for fraudsters with no connection to it. Advisors and employees must prepare for it.

This article recalls what is known about the attack, without extrapolating. It explains why such news feeds scams and what to do in each role. It is dated November 5, 2026: the investigation is ongoing and the figures are moving.

What do we know about the cyberattack on Crédit Mutuel Arkéa?

According to AFP, relayed by Boursorama on November 4, 2026, the group announced that it had been the victim of a cyberattack and had filed a complaint that same morning. Franceinfo detailed the case on November 5.

On the amount, the bank confirms only an order of magnitude of “several tens of millions of euros”, still being assessed. AFP mentions close to 100 million euros as a provisional estimate. Specialists put forward a higher figure, which is not confirmed.

On the method, the bank describes a sophisticated external attack that went through the platform of one of its service providers. The attackers reportedly used the bank's own account for transactions to other institutions, then converted the funds into cryptocurrency. The bank rules out human error.

For customers, the bank states that there is no impact on their assets, with a few transfers delayed. The Paris public prosecutor's office, cybercrime section, has opened an investigation entrusted to the Office anticybercriminalité (OFAC), the French police cybercrime unit.

What is confirmed stops there. Nothing in this information points to a social engineering technique against the bank's teams, and this article does not suggest it.

Why does a high-profile cyberattack trigger scams?

News of this scale creates three conditions that favor fraudsters. They come from psychology, not technology.

• Maximum attention. Customers read the news and worry about their money. A message about the security of their account is expected.
• A ready-made pretext. “Following the incident, we are checking accounts” is believable, because the incident is real and known.
• A deliberate confusion. Victims do not distinguish between the attack on the bank and the fraud aimed at them. They think they are responding to an official service.

Fraudsters do not need to have taken part in the attack, nor to hold any of the bank's data. They rely on the day's headline. The bank did anticipate this by warning its customers about phishing attempts in its name.

What forms can these scams take?

The forms are well known and combine: a text message or email announcing a “blocked” account, with a link to a fake login page. Add to that a call from a supposed advisor or the “security department” asking you to approve transactions. The article on the fake bank advisor scam method details that last case, step by step.

The 2025 activity report from Cybermalveillance.gouv.fr, the French national cybersecurity support service, shows the scale of the phenomenon: more than 500,000 assistance requests, up around 20% over a year. According to this report, fake bank advisor fraud continued to rise by 159%, and phone number spoofing by 517%.

These figures predate the attack on Arkéa and describe the general trend. They show that the ground is already very active before any news event, and that a high-profile cyberattack only has to seize it.

What should bank advisors do?

Advisors are on the front line: their customers will call, worried, or have been called by fake services. Their role is to reassure without giving anything to grab.

1. Never ask for a code or password by phone. According to Cybermalveillance.gouv.fr, a real advisor does not. Say so explicitly to customers.
2. Announce the official channel: app, branch, number printed on the back of the card.
3. Offer to call the customer back on the registered number, never on the one they quote.
4. Listen to the full account of a customer who thinks they were called, and note the details for the report.
5. Escalate immediately any doubtful transaction, without waiting for the end of the conversation.

A useful phrase: “I will never ask you for a code, by phone or by message. If someone asks you for one, hang up and call us back through the app or the branch.”

What signals show that a message exploits the news?

An opportunistic message has recurring traits. Spotting them in advance avoids depending on the reflex of the moment.

• It cites the recent incident as the reason for its request.
• It sets a short deadline: “within the hour”, “before the end of the day”.
• It demands immediate action: click, call a number, approve a transaction.
• It supplies the number to call or the link to open itself.
• It asks you not to talk about it, or not to contact your usual branch.

None of these traits is enough alone. Their combination, with the news as backdrop, should trigger the callback.

What should you tell a worried customer, concretely?

A customer who calls after reading the press wants to be reassured and guided. A three-part answer works well.

1. Acknowledge the concern: “I understand this news worries you.”
2. Give the confirmed fact: what the bank has publicly stated, nothing more. Do not speculate on causes or amounts.
3. Give the rule: “We will never ask you for a code. If in doubt, go through the app or the branch.”

The discipline of the “confirmed fact” is essential. A rumor repeated by an advisor becomes official information in the customer's eyes, and can be picked up by a fraudster.

What should other employees do?

In a bank as elsewhere, any employee can receive a call that exploits the news: a supposed service provider, a fake internal check, a call “from head office” about exceptional verifications.

• Assume that big news raises the probability of an opportunistic call, and say so within the team.
• Apply the callback through an independent channel without exception for any unusual request.
• Refuse any request to bypass procedure in the name of an “exceptional situation”.
• Report calls, even failed ones, using the checklist of information to remember.

That last point is the most valuable: several reports close together let the security team recognize a campaign in progress.

What should a security team do in the first days?

When news of this kind appears, the first hours decide what follows. A security team can act on four points without waiting for an internal incident.

• Remind people with a short message of the callback rule and the reporting channel.
• Warn the teams in contact with the public: reception, support, advisors, accounting.
• Collect and cross-check reports, to spot a campaign.
• Check that transfer approval and reset procedures are applied without exception.

The message to employees should stay factual: what is confirmed, the rule, the channel. It does not need to be alarmist to be heard.

How do you prepare before the next news event?

Opportunistic scams come back with every big story. Teams that have already spoken their refusal phrases and practiced the callback react better than those rereading a document that day.

Spoken practice suits this. In a role-play, an advisor or an employee receives a call from a persona. The persona presents as the security department “after the incident”, pressing and guilt-tripping. The learner must verify, refuse, then report. With Face Up, a trainer writes the scenario from the calls their organization has actually received. The debrief shows what was said, what should have been said, and the action plan. The learner then replays as often as needed.

To place this in a complete approach, see the guide to security awareness training and vishing.

Frequently asked questions

Was the attack on Arkéa a phone attack?

Nothing indicates so. The bank describes a sophisticated external attack that went through a service provider's platform, and rules out human error. The scams discussed here are separate: they target customers and employees of other organizations by taking advantage of the news.

What should you do if you receive a message in a bank's name after an attack?

Do not click, do not call the number in the message, and contact your bank through the app or the branch. According to Cybermalveillance.gouv.fr, never approve a transaction that you did not initiate.

Should customers worry about their assets?

According to the bank, the attack had no impact on customers' assets, with a few transfers delayed. The point of vigilance concerns messages and calls that exploit the affair.

Do you want to train advisors and employees to hold their reflexes when the news gets involved? Book a Face Up demo.