French Election 2027: Tackling Everyday Cybercrime

Ransomware, fake bank advisers and identity theft now target individuals, very small businesses and associations. Two companies, Secuserve and SoSafe, outline the technical, educational and insurance-related measures that a future government should deploy to make cybercrime a matter of public safety.

An article published as part of the CYBER 2027 initiative.

Over the years, French cybersecurity policy has been built around large corporations, operators of vital importance and essential services (OIV/OSE), as well as hospitals. Its main instruments include ANSSI (the French National Cybersecurity Agency), the Cybermalveillance.gouv.fr initiative, funding allocated through France 2030, the NIS2 Directive, which is currently being transposed into French law, and, more recently, the 17Cyber service.

Yet cyber threats now reach citizens in their everyday lives, through text messages, phone calls and emails. This shift presents the next government with a delicate balancing act: protecting the population without turning cybersecurity into a mass policy. Such a policy would impose mandatory training and widespread checks on everyone, following the model of regulatory requirements currently placed on businesses.

AI and data breaches make everyday fraud more convincing

Artificial intelligence has changed the nature of these attacks. Fraudulent emails no longer contain spelling mistakes and faithfully reproduce bank logos. Deepfakes (AI-generated or manipulated content) imitate the voice of a relative requesting an urgent bank transfer. Criminal networks, including those involved in drug trafficking, also rent automated ransomware. Data breaches affecting certain operators (Free in 2024, Bouygues Telecom in 2025), third-party healthcare payment intermediaries (Viamedis and Almerys in 2024) and public administrations (France Travail in 2024 and the French public finance authorities’ Ficoba database in 2026) are fuelling this phenomenon.

“Hackers have obtained a certain amount of information that gives them enough credibility to interact with citizens. They know their first and last names, phone numbers and bank account details. It then becomes easy to alert them to supposedly unusual transactions. It is no longer even the fake adviser who makes the call. It is the citizen who dials the number they have been given,” says Stéphane Bouché, CEO of Secuserve, a company belonging to the Hexatrust collective.

Telephony remains fertile ground for these tactics. Since the Naegelen Law of 2020, operators have been required to authenticate displayed phone numbers. Arcep (France’s Regulatory Authority for Electronic Communications, Postal Services and Press Distribution) strengthened this requirement on January 1, 2026: calls originating from abroad that display an unauthenticated French mobile number now appear as withheld numbers. Stéphane Bouché nevertheless believes that this framework is insufficient to secure networks. He is calling for the full application to telephony of the principle already used in email communications, where SPF, DKIM and DMARC protocols make it possible to authenticate the sender’s domain.

He also expects several technical measures from the government. Multifactor authentication (MFA) would become mandatory for all email accounts to prevent account takeovers. France Identité should also be extended to the entire population, as older French national identity cards can easily be forged. Finally, the secure digitisation of administrative procedures vulnerable to benefits fraud, such as scams targeting tradespeople in connection with MaPrimeRénov’, would help limit fraudulent activity.

Behavioural education tailored to each audience

Awareness-raising is the second lever, provided its approach is reconsidered. SoSafe, a behavioural science-based platform used by more than 5.4 million employees, has made this its speciality. “Most public awareness campaigns provide information but fail to establish reflexes. A citizen who saw a phishing campaign the day before is no better protected six months later if they have not practised anything in the meantime. An effective public policy would replace a major annual campaign with regular micro-reminders throughout the year, following the road safety model, with greater frequency and personalisation,” explains Arnaud Loubatiere, Director for France and Southern Europe at SoSafe, also a member of Hexatrust.

According to him, very small businesses, associations and local authorities suffer more from a lack of resources than a lack of willingness. In this context, SoSafe recommends very short training modules compatible with the schedules of local government employees or association volunteers. The company also advocates differentiated learning paths based on actual exposure to risk, since a town hall receptionist does not face the same threats as a tradesperson. Stéphane Bouché would extend this approach to the national education system, calling for cybersecurity awareness to begin in middle and high school.

Compensating victims and sharing responsibility among stakeholders

According to the two experts interviewed, victim support is the weakest point of the current system. Stéphane Bouché recounts the experience of a woman who was defrauded of €24,000 that she had intended for her grandchildren. Following the scam, her bank told her that she was entirely to blame.

“When someone calls 17Cyber to report that they have been the victim of a scam, the first step should be to find insurance-based solutions, depending on the amounts involved. This does not necessarily mean reimbursing them in full, but at least offering some compensation. Banks have sufficient resources to finance this. Then, as soon as the victim files a complaint, they should be invited to attend a free awareness training course to prevent it from happening again,” says Stéphane Bouché.

Arnaud Loubatiere also rejects the idea of placing all responsibility on the user and divides the roles among three stakeholders: “Citizens have a responsibility to remain vigilant, provided they have received the necessary training and tools. Companies, whether banks, operators or platforms, have a responsibility by design. They must make every user action secure by default, rather than placing the burden of detecting fraud on the user. Finally, the State must harmonise and finance large-scale training, instead of limiting itself to imposing sanctions after the fact.”

The two executives differ, however, on the role of regulation. Stéphane Bouché believes it should remain focused on the most sensitive entities, particularly through NIS2, while protecting the general public and small organisations should rely more heavily on practical awareness-raising and security measures. Arnaud Loubatiere, by contrast, envisages drawing inspiration from this directive, which holds executives accountable for cybersecurity awareness, to establish a framework tailored to banks and telecom operators. Their proposals nevertheless point towards a common approach: placing the burden on operators, banks and the State rather than on citizens alone.

Finally, tackling everyday cybercrime must also take into account the protection of individual freedoms, which the CNIL (French Data Protection Authority) oversees in relation to the processing of personal data. “France is a leader when it comes to civil liberties. I agree that they must be protected, but we also need to think about security. At certain points, the CNIL will have to ease off a little. The political debate will then be about determining the appropriate level of freedom in light of security and cybersecurity challenges. Trust does not exclude control, and cybersecurity does not exclude productivity. This is the principle of Zero Trust, which is fundamental,” concludes Stéphane Bouché.