For a CISO, IT team, or compliance function in LATAM, the useful way to read smishing and phishing is operational, not semantic: the mobile channel is already an expanding attack surface, and PCI DSS v4.0 requires an annual awareness program that includes phishing, related attacks, and social engineering. If human failure rates are also considered, the decision stops being theoretical and becomes SMS simulations, exposure metrics, and compliance evidence.
Putting the sources side by side shows a tension none of them covers alone: some explain what the attack is, others show that the channel is growing, and PCI defines what has to be trained and how often. That leaves a clear gap between definition, risk, and control, exactly where a security team has to decide what to measure tomorrow.
Source comparison
When they are cross-referenced, a difference emerges between attack description, growth evidence, and control requirements. That combination is what makes it possible to move from a dictionary explanation to a program decision.
Phishing, Vishing, and SMiShing |Phishing attacks |Cyber security awareness video |Security Quotient — Security Quotient. Ver el original
Awareness program for staff focused on threats to the CDE
Phishing, related attacks, social engineering
Not specified
Program reviewed and updated at least every 12 months
At least every 12 months
Phishing and related attacks, social engineering
What does IBM say about smishing?
IBM defines it as a social engineering attack that uses fake mobile text messages to trick people into downloading malware, sharing sensitive information, or sending money. The key is not the channel alone, but the combination of short messages, urgency, and apparent trust. That framing helps explain the mechanism, but it is not enough to prioritize control or training.
What does Proofpoint add about the vector?
Proofpoint describes it as a cyberattack aimed at individuals through SMS or text messages, with messages that appear to come from a trusted source. The practical difference is that it brings the phenomenon down to everyday deception with concrete outcomes: sharing personal or financial information, clicking malicious links, or downloading harmful software. For Whalemate, that level of specificity is useful because it turns risk into observable behavior.
Why do Kaspersky and Descope focus on human trust?
Kaspersky and the person gives up sensitive information without noticing the deception agree that smishing exploits human trust more than technical vulnerabilities. Kaspersky labels it phishing through mobile messaging, and Descope ties it to that idea. That reading matters because it shifts the response from isolated technical hygiene to continuous training and behavior measurement.
How New Phishing Scams Trick You — KristoferYee. Ver el original
What changes when smishing is separated from mobile phishing?
DeepStrike draws a useful line: smishing is phishing via SMS or text messages, while mobile phishing also includes chat apps, mobile browsers, QR codes, PDF lures, and app-based redirects. That distinction avoids underestimating the mobile channel, because a program that looks only at SMS can miss other lures that reach the same user on the same device.
What do the growth figures show?
Smishing complaints grew 50% between 2022 and 2023, with fake package deliveries, fake banking alerts, and toll requests among the campaigns. The same material cites Proofpoint and says 76% of organizations experienced smishing attacks in 2023, up from 61% in 2022. Smishing increased 40% between Q1 and Q2 of 2026. Read together, the figures show channel expansion rather than an isolated case.
What does PCI DSS v4.0 require in awareness training?
The implication is direct: if the mobile channel is growing and PCI requires annual awareness with explicit focus on phishing and social engineering, then the program should not stop at a course. Whalemate proposes a Human Risk Management model that simulates, trains, measures, intervenes, and reports, with a risk score to prioritize interventions, not to discipline people. That enables a concrete decision for CISO, IT, and compliance: use SMS simulations, consolidate signals from courses, reports, and behavior, and document evidence of reduced exposure.
Operational consequence
Starting tomorrow, a security team can decide three things. First, treat mobile as a priority surface within the awareness program. Second, measure clicks and reports in SMS simulations as a sign of human failure, along with training completion and repeat behavior. Third, use that evidence to support PCI DSS v4.0 compliance and prioritize exposed groups, without turning the score into a disciplinary tool.
How New Phishing Scams Trick You — KristoferYee. Ver el original
No. Smishing is a form of phishing that uses SMS or text messages, while phishing is the broader umbrella. DeepStrike further separates mobile phishing, which includes other mobile channels such as chat apps, QR, and browsers. That difference matters because a program that only measures email can leave out the mobile vector.
What specific examples of smishing appear in the material?
ConnectWise mentions messages impersonating banks, package deliveries, and HR. It also gives textual examples such as “Your account has been suspended. Click here to reactivate” and “FedEx: Your package delivery failed. Reschedule here”. The pattern is always the same: urgency, apparent trust, and a link or request for data.
What does PCI DSS v4.0 say about phishing and social engineering?
The summary of changes indicates that awareness must be reviewed at least every 12 months and cover threats that impact the CDE, including phishing and related attacks and social engineering. CyberAware adds that from March 31, 2025, training must explicitly cover phishing and social engineering in 12.6.3.1. The requirement is not an isolated course, but a documented and recurring program.
What should CISO, IT, or compliance measure?
They should measure exposure and response, not just attendance. That includes clicks on SMS simulations, timely reports, training completion, repeat behavior, and progress by user segment. The material also suggests consolidating those signals into a risk score to prioritize interventions, because the real value lies in deciding where to reinforce controls and training.
Why is this reading relevant for LATAM?
Because it combines concrete regulatory pressure with a vector that is already growing and hitting mobile users. In LATAM, where teams often handle many responsibilities and fragmented programs, this forces them to organize priorities, document evidence, and prevent awareness from being reduced to an annual campaign without behavior measurement.
Would you like to go deeper on this topic?
Open this article directly in Claude or ChatGPT —
ask questions, get a summary, or explore related ideas.
By 
