Nobody tricked a customer. The bank paid itself out.

Audience / at-risk group

Bank security, payments and fraud teams, companies that give suppliers access to their systems, and anyone who reads 'AI heist' headlines

What you can notice

• On 27 October the bank detected signs that a supplier's information system was compromised and cut the link between the two systems; at that point, the chair says, nothing suggested the attackers could reach the bank.
• From Sunday 1 November, the attackers generated fake IBANs in the name of Fortuneo, the group's online bank, to trigger payment orders from Crédit Mutuel Arkéa's own account, not from client accounts.
• They chose instant transfers which, the chair notes, by nature carry fewer checks than ordinary transfers, and a weekend start.
• The money went first to real accounts opened in advance at other European banks, then to crypto platforms to blur the trail; the chair reads the advance account opening as a sign the attack was long prepared.
• Crypto specialists noticed abnormal transactions on the Sunday and Monday, and the investigator ZachXBT made the fraud public, but the bank only measured the scale on the Tuesday morning and then cut all external access.

What the source reports

Crédit Mutuel Arkéa announced on 4 November 2026 that a 'sophisticated attack coming from the outside' had caused fraudulent transfers of around €100 million from its own account to other banks, that the attack was contained and that clients suffered no losses (AFP). The Paris prosecutor opened an investigation into an attack on an automated data processing system by an organised group. Le Télégramme reported a higher figure (133 million), which the bank did not confirm. In an AFP interview on 13 November, reported by Silicon.fr and INCYBER, chair Julien Carmona described the timeline: supplier compromise detected on 27 October; fake Fortuneo IBANs used from 1 November to trigger payment orders from the bank's own account; instant transfers to real accounts at other European banks, then crypto platforms; discovery of the scale on 3 November. He put the loss at about €100 million, around 1% of the group's equity, said part of the money had been recovered or frozen, called the attack unprecedented in sophistication and 'very probably' assisted by advanced artificial intelligence, and said the perpetrators are unknown.

What this evidence cannot tell us

This case rests on the bank's own statements and press reporting; no court has ruled and the perpetrators are unidentified. The role of artificial intelligence is the chair's assessment ('very probably'), and none of the sources publishes evidence of what, if anything, AI did; the headline figure of $110 million is a currency conversion of about €100 million, and the gross amount diverted may be higher. It is not public how the supplier was breached or how the fake IBANs were accepted. Nothing here suggests that Fortuneo or Crédit Mutuel Arkéa customers lost money; they were not the targets.