For CISOs, IT teams, and compliance leaders in LATAM, the useful way to read smishing and phishing is operational, not semantic: mobile has become an expanding attack surface, and PCI DSS v4.0 requires an annual awareness program that includes phishing, related attacks, and social engineering. If human failure rates are also considered, the decision stops being theoretical and becomes a matter of SMS simulations, exposure metrics and compliance evidence.
Putting the sources together shows a tension none of them covers on its own: some explain what the attack is, others show the channel is growing, and PCI defines what must be trained and how often. APWG recorded 1,069,681 phishing attacks in the second quarter of 2026, up from 971,181 in the first quarter, an increase of 10.1%. That leaves a clear gap between definition, risk, and control, exactly where a security team has to decide what to measure next.
Source comparison
When the sources are crossed, a difference appears between attack description, growth evidence, and control requirements. APWG counted 425,808 phishing attacks in June 2026, the highest monthly total observed since April 2023. That combination is what makes it possible to move from a dictionary explanation to a program decision.
Phishing, Vishing, and SMiShing |Phishing attacks |Cyber security awareness video |Security Quotient, Security Quotient. Ver el original
Program reviewed and updated at least every 12 months
At least every 12 months
Phishing and related attacks, social engineering
What does IBM say about smishing?
IBM defines it as a social engineering attack that uses fake mobile text messages to trick people into downloading malware, sharing sensitive information, or sending money. The key is not the channel alone, but the combination of a short message, urgency, and apparent trust. That framing helps explain the mechanism, but it is not enough to prioritize control or training.
What does Proofpoint add about the vector?
Proofpoint describes it as a cyberattack aimed at individuals through SMS or text messages, with messages that appear to come from a trusted source. The practical difference is that it brings the phenomenon down to everyday deception, with concrete outcomes such as sharing personal or financial information, clicking malicious links, or downloading harmful software. For Whalemate, that level of specificity is useful because it turns risk into observable behavior.
Why do Kaspersky and Descope focus on human trust?
Kaspersky and Descope agree that smishing exploits human trust more than technical vulnerabilities. Kaspersky describes it as mobile messaging phishing, and Descope links it to the idea that the person gives up sensitive information without noticing the deception. That matters because it shifts the response away from isolated technical hygiene and toward continuous training and behavior measurement.
How New Phishing Scams Trick You, KristoferYee. Ver el original
What changes when smishing is separated from mobile phishing?
DeepStrike draws a useful line: smishing is phishing through SMS or text messages, while mobile phishing also includes chat apps, mobile browsers, QR codes, PDF lures, and app-based redirects. That distinction helps avoid underestimating the mobile channel, because a program that looks only at SMS can miss other lures reaching the same user on the same device.
What do the growth figures show?
The FTC reports that losses from text message fraud reached USD 470 million in 2024, more than five times the 2020 figure, and warns that the number likely reflects only a fraction of the real harm. Those losses rose even as the number of reports declined, and the share of reports with money lost went from 5% in 2020 to 11% in 2024. Among the most reported campaigns are fake package deliveries, fake job offers, fake fraud alerts from banks, and unpaid toll notices. APWG adds that smishing increased 40 % between Q1 and Q2 of 2026. APWG recorded 971,181 phishing attacks in the first quarter of 2026, compared with 853,244 in the fourth quarter of 2025, an increase of 13.8%. Read together, the numbers show a channel that is growing in volume according to APWG and in losses according to the FTC, not an isolated case.
What does PCI DSS v4.0 require for awareness?
The PCI DSS v4.0 summary of changes says the awareness program must be reviewed and updated at least every 12 months, and the content must cover threats and vulnerabilities that affect CDE security, including phishing and related attacks and social engineering. 12.6.1, 12.6.2 and 12.6.3 require a formal program, annual review, and training at hiring and every 12 months. Since March 31, 2025, training must explicitly cover phishing and social engineering in 12.6.3.1.
What does Whalemate's reading mean for LATAM?
The implication is direct: if the mobile channel is growing and PCI requires annual awareness with an explicit focus on phishing and social engineering, then the program should not stop at a course. Whalemate proposes a Human Risk Management model that simulates, trains, measures, intervenes, and reports, with a risk score used to prioritize interventions, not to discipline people. That supports a concrete decision for CISOs, IT, and compliance teams: use SMS simulations, consolidate signals from courses, reports, and behavior, and document evidence of reduced exposure.
Operational takeaway
Starting tomorrow, a security team can decide three things. First, treat mobile as a priority surface within the awareness program. Second, measure clicks and reports in SMS simulations as a sign of human failure, alongside training completion and repeat behavior. Third, use that evidence to support PCI DSS v4.0 compliance and prioritize exposed groups, without turning the score into a disciplinary tool.
How New Phishing Scams Trick You, KristoferYee. Ver el original
No. Smishing is a form of phishing that uses SMS or text messages, while phishing is the broader umbrella. DeepStrike further separates mobile phishing, which includes other mobile channels such as chat apps, QR, and browsers. That difference matters because a program that only measures email can leave out the mobile vector.
What specific examples of smishing appear in the material?
ConnectWise mentions messages impersonating banks, package deliveries, and HR. It also gives textual examples such as “Your account has been suspended. Click here to reactivate” and “FedEx: Your package delivery failed. Reschedule here”. The pattern is always the same: urgency, apparent trust, and a link or request for data.
What does PCI DSS v4.0 say about phishing and social engineering?
The summary of changes indicates that awareness must be reviewed at least every 12 months and cover threats that impact the CDE, including phishing and related attacks and social engineering. CyberAware adds that from March 31, 2025, training must explicitly cover phishing and social engineering in 12.6.3.1. The requirement is not an isolated course, but a documented and recurring program.
What should CISO, IT, or compliance measure?
They should measure exposure and response, not just attendance. That includes clicks on SMS simulations, timely reports, training completion, repeat behavior, and progress by user segment. The material also suggests consolidating those signals into a risk score to prioritize interventions, because the real value lies in deciding where to reinforce controls and training.
Why is this reading relevant for LATAM?
Because it combines concrete regulatory pressure with a vector that is already growing and hitting mobile users. In LATAM, where teams often handle many responsibilities and fragmented programs, this forces them to organize priorities, document evidence, and prevent awareness from being reduced to an annual campaign without behavior measurement.
Would you like to go deeper on this topic?
Open this article directly in Claude or ChatGPT —
ask questions, get a summary, or explore related ideas.
By 
