The €100 million cyber theft at a French bank raises uncomfortable questions about transaction integrity, third-party dependencies and the limits of conventional cyber defences. For India’s financial institutions, the implications extend well beyond cybersecurity.
The most unsettling aspect of the reported €100 million cyber theft at France’s Crédit Mutuel Arkéa is not the amount involved. It is that the attackers reportedly used the bank’s own account and accessed its infrastructure through a service provider’s platform to execute fraudulent transfers.
Customer accounts were reportedly unaffected. The bank contained the incident and began recovery efforts. Yet an institution entrusted with safeguarding financial transactions found its own operational infrastructure being exploited to move money.
The precise mechanics remain under investigation. Nevertheless, the episode exposes a fundamental weakness in how financial institutions conceptualise cyber risk.
A banking system can be operational, authenticated and technologically sophisticated — yet still execute transactions that should never have occurred.
For Indian banks, NBFCs and fintechs, three questions deserve immediate boardroom attention.
1. Transaction integrity: When legitimate systems execute illegitimate instructions
Financial institutions have invested heavily in authentication, encryption, fraud detection and network security. These controls remain indispensable. But they do not necessarily establish whether an apparently authorised transaction is economically legitimate.
The distinction matters. A transaction may originate from an approved account, pass through recognised infrastructure and satisfy technical validation requirements while remaining fundamentally fraudulent.
Traditional security architecture often concentrates on determining who or what can access a system. Increasingly, the more consequential question is what that system should be permitted to do, even after access has been granted.
This requires stronger transaction-level intelligence: behavioural monitoring, dynamic thresholds, independent authorisation for exceptional movements and automated intervention when transaction patterns depart materially from established norms.
The next frontier of banking security is not merely protecting access. It is protecting the integrity of financial decisions executed through that access.
2. Third-party dependencies: The expanding perimeter of institutional vulnerability
Modern banking depends on an extensive network of technology providers, payment processors, cloud platforms, software vendors and specialist service partners. These relationships generate efficiency and innovation. They also redistribute operational exposure across organisations that may operate under different governance structures and control environments.
The French incident illustrates why outsourcing a function cannot mean outsourcing accountability for its consequences. Vendor due diligence at onboarding is insufficient if institutions cannot continuously assess privileged access, transaction permissions, subcontractor dependencies and the potential financial impact of a compromised service provider.
For India, where financial institutions increasingly rely on interconnected digital infrastructure, this is particularly consequential. A vendor may appear operationally peripheral while possessing access capable of creating substantial financial exposure.
The critical question is no longer how many third parties a bank uses, but how much institutional authority those third parties can exercise.
3. Conventional cyber defences: Detection is not the same as prevention
There is another uncomfortable dimension. Financial institutions frequently measure cybersecurity effectiveness through attempted attacks blocked, vulnerabilities remediated, incidents detected and recovery times achieved.
These indicators are useful, but incomplete. An institution can demonstrate impressive detection capabilities and still experience significant financial losses before containment becomes effective.
The growing automation of attacks further compresses the interval between compromise and financial consequence.
For risk leaders, this demands a shift from infrastructure-centred security towards consequence-centred resilience. Cybersecurity teams must work more closely with treasury, payments, operational risk, fraud management and enterprise risk functions. Scenario exercises should test not only whether systems can be restored, but whether unauthorised value transfers can be interrupted before losses become irreversible.
The board should understand the maximum financial exposure that could accumulate between the initiation of a fraudulent transaction and effective intervention.
The question for Indian risk leadership
India’s digital financial infrastructure has created extraordinary opportunities for scale, inclusion and efficiency. Its interconnectedness also makes the quality of institutional controls increasingly consequential.
The lesson from France is not that digital banking is inherently unsafe, nor that existing cyber investments have failed.
It is that cybersecurity, transaction governance and enterprise risk management can no longer operate as separate disciplines.
A CISO may secure the infrastructure. A technology partner may operate the platform. A treasury function may manage liquidity. A risk committee may oversee operational exposure. But who is accountable when a technically authorised transaction becomes an economically unauthorised loss?
That question deserves a clearer answer than most organisational charts provide.
The next major banking cyber crisis may not begin with a system going down. It may begin with a system doing exactly what it has been instructed to do.
