When Banks Say An Attack Is Contained, What Has Actually Stopped? – Analysis

November 9, 2026

By Burak Oktenli

Key Takeaways:

On 5 November Reuters reported that Crédit Mutuel Arkéa lost roughly €100 million in fraudulent transactions via a service provider’s platform, with customer assets unaffected but some transfers delayed.

The incident illustrates that containment is not a single switch: a bank may block one path while other payments remain in motion, and shutting everything can harm legitimate customers.

The piece argues that future financial cyber stress tests should measure the gap between a stop decision and verified enforcement at each payment route, tracking both residual unauthorized activity and preserved legitimate capacity.

A French bank cyberattack illustrates why financial supervisors should measure the limits of emergency controls, not merely the speed of recovery. The test is whether risky payment routes are closed while legitimate transactions remain usable.

A bank can announce that a cyberattack is contained while customers are still waiting for payments to clear. Those two statements are not necessarily contradictory. Stopping a suspected intrusion, preventing further unauthorized transfers, and keeping legitimate financial services available are three different tests of control.

The distinction became concrete in France this week. On November 5, Reuters reported that Crédit Mutuel Arkéa had lost approximately €100 million in fraudulent transactions using an account belonging to the bank. In its own explanation, the lender said attackers reached it through a service provider’s platform, not its online banking subsidiary Fortuneo. It said customer assets were unaffected, although some transfers were delayed while additional checks were carried out.


That public record does not establish that the bank failed to revoke a particular permission or that AI caused the intrusion. The investigation is not a license to invent a technical mechanism. It does reveal why the next generation of financial cyber stress tests must ask a sharper question: when an institution declares the danger contained, what exactly has been prevented, what remains unsettled, and how can an independent party verify the difference?

Containment is not one switch

A modern bank is not a single payment application. It depends on customer channels, internal authorization services, counterparties, payment infrastructures, outsourced technology providers, and instructions that may already have left its own systems. Turning off a compromised interface may remove one path while leaving other commitments in motion. Conversely, shutting down every channel may reduce exposure but unnecessarily disrupt salaries, suppliers, and households.

A bank may be able to disable a credential immediately while lacking the power to reverse a transfer that has already settled. It may have to request action from another institution or payment system. The reach of any emergency control is therefore bounded by technology, contract, law, and the stage of the transaction. A useful containment claim must state those boundaries rather than hide them behind an all-clear indicator.

That is not an argument for banking supervisors to demand omnipotence. It is an argument for evidence about the controls that actually exist. A declaration of containment should identify whether a path has been blocked, is awaiting confirmation from an outside party, or has not yet been verified.

Stress tests have a missing measurement

Regulators already test the cyber resilience of banks. In an April 2026 review, the Bank for International Settlements described two complementary approaches: exercises centered on individual firms and those examining system-wide disruption. In June, European supervisors published their first annual report on major ICT incidents under the Digital Operational Resilience Act, emphasizing the interconnected and cross-border nature of digital risk. Neither development means that the specific containment test proposed here is already mandatory.

The missing measurement is the gap between a decision to restrict activity and independently verified enforcement at each consequential payment route. An exercise can start its containment clock when an authorized official issues a restriction, but it must stop that clock only when the tested route demonstrably rejects further unauthorized activity. Detection time and management decision time should be reported separately, so a favorable score cannot be produced merely by starting late.

Time by itself is a poor result. Supervisors should also know the simulated value of unauthorized payments that still escaped after the stop decision, which routes could not be checked, and which legitimate transactions were blocked or delayed. A bank that shuts down everything may prevent an immediate loss while failing its customers. A bank that maintains perfect availability by accepting unverified instructions has the opposite problem.

The useful standard is two-sided: contain the unsafe activity and preserve as much lawful payment capacity as the circumstances permit. Neither objective can be inferred from the other.

Make the test follow a disputed payment

In a controlled exercise, begin with a compromised but apparently valid instruction originating through a service provider. The bank identifies the risk and orders a narrowly defined restriction. Evaluators then observe whether the original session remains usable, whether already queued instructions advance, whether alternative application interfaces accept the same authority, and whether an external counterparty has acknowledged the bank’s request. No real customer funds need to be put at risk.

Next, introduce a false alarm. A legitimate batch of payments resembles the suspicious pattern, and an overly broad restriction would block it. The exercise should measure how much authorized business continues safely, how quickly the mistake is detected, and whether a designated official can narrow the restriction without re-opening the compromised route.

Finally, examine settlement and restoration. A payment request is not proof of a completed transfer; an intermediary acknowledgment is not necessarily proof of final settlement. Before restarting a suspended process, the institution should reconcile queued requests against actual outcomes and prevent duplicates. It should verify that revoked access remains invalid and that permissions restored to legitimate users are no broader than intended.

The resulting report should not be a single red or green score. For every material payment path, it should specify the restriction ordered, the enforcement point, the test performed, the result, the unresolved dependencies, and the person accountable for closing them. Independent checking matters most when the institution’s own visibility has been impaired.

The international rules provide an opening

The European Central Bank’s July 7 supervisory letter asked significant banks to submit AI-cybersecurity action plans by October 31, focusing on third-party risk, crisis management, response, and recovery. The request did not prescribe the precise payment-path metric described above. But it creates an opportunity to make future supervisory reviews more concrete: not only whether an emergency procedure exists, but whether its effect can be demonstrated under stress.

The problem is inherently international. In January 2026, EU and UK financial regulators agreed to cooperate on oversight of critical technology providers across borders. The Financial Stability Board has also urged stronger response and recovery capabilities and attention to critical suppliers as frontier AI changes the cyber threat landscape. These arrangements do not erase national differences in settlement law or institutional authority. They make it more useful to share a common description of what each jurisdiction has actually verified.


That approach would serve emerging markets as well as major financial centers. A bank should not have to adopt an identical technology stack to communicate that a payment route is disabled, that an external freeze remains pending, or that a critical supplier cannot yet confirm containment. The language of the finding can be common while the powers available to act remain national.

The International Monetary Fund’s October 2026 financial stability assessment warns that sophisticated cyber incidents can disrupt financial services and confidence as institutions become more interconnected. That is the strategic reason to avoid both premature all-clear messages and indiscriminate shutdowns. A statement that admits what remains unresolved can be more stabilizing than a confident declaration that later proves too broad.

Do not certify what cannot be seen

A sound exercise will sometimes end with uncertainty. A third-party channel may be unreachable, a payment may be pending elsewhere, or the available evidence may be insufficient to establish its final status. Supervisors should require that uncertainty to appear in the result, accompanied by a responsible owner, a containment limit, and a plan for further verification.

A useful bank cyber stress test should leave supervisors and customers with more than a recovery-time target. It should answer two measurable questions together: how much unauthorized activity remained possible after the order to stop, and how much legitimate financial service remained safely available?

Banks have spent decades engineering payments to go through. Financial resilience now requires equal discipline in proving when a payment must not go through, and in keeping everyone else’s money moving.

About Burak Oktenli

Burak Oktenli holds an MBA and a Master of Professional Studies in Applied Intelligence from Georgetown University. His research addresses the governance of authority in autonomous and AI-enabled systems, and his writing has appeared at the Modern War Institute at West Point, RUSI, RealClearDefense, RealClearMarkets, and Geopolitical Monitor. He is the author of Authority Architectures for Autonomous Systems, a ten-volume series on how authority in autonomous systems is delegated, monitored and recovered, at authority-architecture.me.
View all posts by Burak Oktenli →