--- title: "APWG and PCI DSS: Smishing Is Rising | Whalemate" description: "Smishing is growing on mobile channels while PCI DSS v4.0 requires annual awareness training and explicit phishing and social engineering content." url: https://www.whalemate.com/en/resources/blog/apwg-pci-dss-smishing-rising/ lang: en updated: 2026-10-30 alternates: es: https://www.whalemate.com/recursos/blog/apwg-pci-dss-smishing-alza/ pt-BR: https://www.whalemate.com/br/recursos/blog/apwg-pci-dss-smishing-alta/ index: https://www.whalemate.com/llms.txt --- [Back to blog](https://www.whalemate.com/en/resources/blog/) Blog # APWG and PCI DSS: Smishing Is Rising Smishing is growing on mobile channels while PCI DSS v4.0 requires annual awareness training and explicit phishing and social engineering content. Oct 30, 2026 By [Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) 7 min read [HRM](https://www.whalemate.com/en/resources/blog/topic/hrm/) ![APWG and PCI DSS: Smishing Is Rising](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/apwg-pci-dss-smishing-rising.webp) In this article 1. [Source comparison](#s1) 2. [What does IBM say about smishing?](#s2) 3. [What does Proofpoint add about the vector?](#s3) 4. [Why do Kaspersky and Descope focus on human trust?](#s4) 5. [What changes when smishing is separated from mobile phishing?](#s5) 6. [What do the growth figures show?](#s6) 7. [What does PCI DSS v4.0 require for awareness?](#s7) 8. [What does Whalemate's reading mean for LATAM?](#s8) 9. [Operational takeaway](#s9) 10. [What to read next?](#s10) For CISOs, IT teams, and compliance leaders in LATAM, the useful way to read smishing and phishing is operational, not semantic: mobile has become an expanding attack surface, and PCI DSS v4.0 requires an annual awareness program that includes phishing, related attacks, and social engineering. If human failure rates are also considered, the decision stops being theoretical and becomes a matter of SMS simulations, [exposure metrics](https://www.whalemate.com/en/resources/blog/smishing-vishing-under-pci-dss/) and compliance evidence. Putting the sources together shows a tension none of them covers on its own: some explain what the attack is, others show the channel is growing, and PCI defines what must be trained and how often. APWG recorded 1,069,681 phishing attacks in the second quarter of 2026, up from 971,181 in the first quarter, an increase of 10.1%. That leaves a clear gap between definition, risk, and control, exactly where a security team has to decide what to measure next. ## Source comparison When the sources are crossed, a difference appears between attack description, growth evidence, and control requirements. APWG counted 425,808 phishing attacks in June 2026, the highest monthly total observed since April 2023. That combination is what makes it possible to move from a dictionary explanation to a program decision. [Video](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/clips/dc594443-e65a-49d9-ab97-4f664416e6c7/dGEdc8mVc5E-4.mp4) · Subtitles: [Español](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/clips/dc594443-e65a-49d9-ab97-4f664416e6c7/dGEdc8mVc5E-4.es.vtt), [English](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/clips/dc594443-e65a-49d9-ab97-4f664416e6c7/dGEdc8mVc5E-4.en.vtt), [Português](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/clips/dc594443-e65a-49d9-ab97-4f664416e6c7/dGEdc8mVc5E-4.br.vtt) Phishing, Vishing, and SMiShing |Phishing attacks |Cyber security awareness video |Security Quotient, Security Quotient. [Ver el original](https://www.youtube.com/watch?v=dGEdc8mVc5E&t=4s) | Source | Concept | Channel or vector | Growth | Compliance | Review | Examples | | --- | --- | --- | --- | --- | --- | --- | | IBM | Social engineering attack that [uses fake mobile text messages](https://www.ibm.com/think/topics/smishing) | SMS, mobile text messages | Not specified | Not specified | Not specified | Download malware, share sensitive information, or send money | | Proofpoint | [SMS cyberattack](https://www.proofpoint.com/us/threat-reference/smishing) that appears to come from a trusted source | SMS, text messages | Not specified | Not specified | Not specified | Share personal or financial information, click malicious links, download harmful software | | Kaspersky | [Mobile messaging phishing](https://usa.kaspersky.com/resource-center/threats/what-is-smishing-and-how-to-defend-against-it), based on human trust | Mobile messaging, SMS | Not specified | Not specified | Not specified | Not specified | | ConnectWise | [Text-message social engineering](https://www.connectwise.com/cybersecurity-center/glossary/smishing) | Text messages | Not specified | Not specified | Not specified | Banks, package deliveries, HR | | Deepstrike | [Smishing is phishing via SMS](https://deepstrike.io/blog/smishing-statistics), mobile phishing is broader | SMS, chat, mobile browsers, QR, PDF, redirects | Not specified | Not specified | Not specified | Text scams and fraud not necessarily tied to phishing | | FTC | Text message fraud measured through consumer reports and losses | Text messages | Losses of [USD 470 million in 2024](https://search.ftc.gov/system/files/ftc_gov/pdf/spotlight-top-text-scams.pdf), more than five times the 2020 figure | Not specified | Not specified | Fake deliveries, fake jobs, fake bank alerts, tolls | | APWG | Smishing as part of phone and mobile fraud | SMS, text messages | [+40 % between Q1 and Q2](https://apwg.org/trendreports) of 2026 | Not specified | Not specified | Expanding mobile attack surface | | PCI Security Standards Council | [Awareness program for staff](https://listings.pcisecuritystandards.org/documents/PCI-DSS-v3-2-1-to-v4-0-Summary-of-Changes-r1.pdf) focused on threats to the CDE | Phishing, related attacks, social engineering | Not specified | Program reviewed and updated at least every 12 months | At least every 12 months | Phishing and related attacks, social engineering | ## What does IBM say about smishing? IBM defines it as a social engineering attack that uses fake mobile text messages to trick people into downloading malware, sharing sensitive information, or sending money. The key is not the channel alone, but the combination of a short message, urgency, and apparent trust. That framing helps explain the mechanism, but it is not enough to prioritize control or training. ## What does Proofpoint add about the vector? Proofpoint describes it as a cyberattack aimed at individuals through SMS or text messages, with messages that appear to come from a trusted source. The practical difference is that it brings the phenomenon down to everyday deception, with concrete outcomes such as sharing personal or financial information, clicking malicious links, or downloading harmful software. For Whalemate, that level of specificity is useful because it turns risk into observable behavior. ## Why do Kaspersky and Descope focus on human trust? Kaspersky and Descope agree that smishing exploits human trust more than technical vulnerabilities. Kaspersky describes it as [mobile messaging phishing](https://usa.kaspersky.com/resource-center/threats/what-is-smishing-and-how-to-defend-against-it), and Descope links it to the idea that the person gives up [sensitive information](https://www.descope.com/learn/post/smishing) without noticing the deception. That matters because it shifts the response away from isolated technical hygiene and toward continuous training and behavior measurement. [Video](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/clips/dc594443-e65a-49d9-ab97-4f664416e6c7/XByR413U58o-72.mp4) · Subtitles: [Español](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/clips/dc594443-e65a-49d9-ab97-4f664416e6c7/XByR413U58o-72.es.vtt), [English](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/clips/dc594443-e65a-49d9-ab97-4f664416e6c7/XByR413U58o-72.en.vtt), [Português](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/clips/dc594443-e65a-49d9-ab97-4f664416e6c7/XByR413U58o-72.br.vtt) How New Phishing Scams Trick You, KristoferYee. [Ver el original](https://www.youtube.com/watch?v=XByR413U58o&t=72s) Whalemate Want to see Whalemate in your organization? Book a demo. We will walk through email and QRishing simulations for your team, and what CISO, IT or compliance can decide from there. [Book a demo](https://www.whalemate.com/en/demo/) ## What changes when smishing is separated from mobile phishing? DeepStrike draws a useful line: smishing is phishing through SMS or text messages, while mobile phishing also includes chat apps, mobile browsers, QR codes, PDF lures, and app-based redirects. That distinction helps avoid underestimating the mobile channel, because a program that looks only at SMS can miss other lures reaching the same user on the same device. ## What do the growth figures show? The FTC reports that losses from text message fraud reached [USD 470 million in 2024](https://search.ftc.gov/system/files/ftc_gov/pdf/spotlight-top-text-scams.pdf), more than five times the 2020 figure, and warns that the number likely reflects only a fraction of the real harm. Those losses rose even as the number of reports declined, and the share of reports with money lost went from 5% in 2020 to 11% in 2024. Among the most reported campaigns are fake package deliveries, fake job offers, fake fraud alerts from banks, and unpaid toll notices. APWG adds that smishing increased [40 % between Q1 and Q2](https://apwg.org/trendreports) of 2026. APWG recorded 971,181 phishing attacks in the first quarter of 2026, compared with 853,244 in the fourth quarter of 2025, an increase of 13.8%. Read together, the numbers show a channel that is growing in volume according to APWG and in losses according to the FTC, not an isolated case. ## What does PCI DSS v4.0 require for awareness? The PCI DSS v4.0 summary of changes says the awareness program must be reviewed and updated at least every 12 months, and the content must cover threats and vulnerabilities that affect CDE security, including phishing and related attacks and social engineering. [12.6.1, 12.6.2 and 12.6.3](https://www.baitandphish.com/blog/pci-dss-phishing-training) require a formal program, annual review, and training at hiring and every 12 months. Since March 31, 2025, training must explicitly cover phishing and social engineering in [12.6.3.1](https://cyberaware.com/blog/how-to-align-security-awareness-training-with-pci-dss). ## What does Whalemate's reading mean for LATAM? The implication is direct: if the mobile channel is growing and PCI requires annual awareness with an explicit focus on phishing and social engineering, then the program should not stop at a course. Whalemate proposes a Human Risk Management model that simulates, trains, measures, intervenes, and reports, with a risk score used to prioritize interventions, not to discipline people. That supports a concrete decision for CISOs, IT, and compliance teams: use SMS simulations, consolidate signals from courses, reports, and behavior, and document evidence of reduced exposure. ## Operational takeaway Starting tomorrow, a security team can decide three things. First, treat mobile as a priority surface within the awareness program. Second, measure clicks and reports in SMS simulations as a sign of human failure, alongside training completion and repeat behavior. Third, use that evidence to support PCI DSS v4.0 compliance and prioritize exposed groups, without turning the score into a disciplinary tool. [Video](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/clips/dc594443-e65a-49d9-ab97-4f664416e6c7/XByR413U58o-73.mp4) · Subtitles: [Español](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/clips/dc594443-e65a-49d9-ab97-4f664416e6c7/XByR413U58o-73.es.vtt), [English](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/clips/dc594443-e65a-49d9-ab97-4f664416e6c7/XByR413U58o-73.en.vtt), [Português](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/clips/dc594443-e65a-49d9-ab97-4f664416e6c7/XByR413U58o-73.br.vtt) How New Phishing Scams Trick You, KristoferYee. [Ver el original](https://www.youtube.com/watch?v=XByR413U58o&t=73s) ## What to read next? - [Human Risk Management on the platform](https://www.whalemate.com/en/human-risk-platform/) - [Security awareness: measure clicks, not courses](https://www.whalemate.com/en/resources/blog/security-awareness-training-measure-clicks/) - [Human Risk Management platform](https://www.whalemate.com/en/resources/blog/whalemate-hrm-security-awareness/) [See the full topic guide](https://www.whalemate.com/en/human-risk-platform/) Questions ## Frequently asked questions **Are smishing and phishing the same thing?** No. Smishing is a form of phishing that uses SMS or text messages, while phishing is the broader umbrella. DeepStrike further separates mobile phishing, which includes other mobile channels such as chat apps, QR, and browsers. That difference matters because a program that only measures email can leave out the mobile vector. **What specific examples of smishing appear in the material?** ConnectWise mentions messages impersonating banks, package deliveries, and HR. It also gives textual examples such as “Your account has been suspended. Click here to reactivate” and “FedEx: Your package delivery failed. Reschedule here”. The pattern is always the same: urgency, apparent trust, and a link or request for data. **What does PCI DSS v4.0 say about phishing and social engineering?** The summary of changes indicates that awareness must be reviewed at least every 12 months and cover threats that impact the CDE, including phishing and related attacks and social engineering. CyberAware adds that from March 31, 2025, training must explicitly cover phishing and social engineering in 12.6.3.1. The requirement is not an isolated course, but a documented and recurring program. **What should CISO, IT, or compliance measure?** They should measure exposure and response, not just attendance. That includes clicks on SMS simulations, timely reports, training completion, repeat behavior, and progress by user segment. The material also suggests consolidating those signals into a risk score to prioritize interventions, because the real value lies in deciding where to reinforce controls and training. **Why is this reading relevant for LATAM?** Because it combines concrete regulatory pressure with a vector that is already growing and hitting mobile users. In LATAM, where teams often handle many responsibilities and fragmented programs, this forces them to organize priorities, document evidence, and prevent awareness from being reduced to an annual campaign without behavior measurement. Whalemate Is this risk in your program? If this article describes something you already faced — or that the board is asking you to explain — book a demo. [Book a demo](https://www.whalemate.com/en/demo/) ## Would you like to go deeper on this topic? Open this article directly in Claude or ChatGPT — ask questions, get a summary, or explore related ideas. - [Open with Claude](https://claude.ai/new?q=I%27m%20reading%20a%20Whalemate%20article%20titled%20%E2%80%9CAPWG%20and%20PCI%20DSS%3A%20Smishing%20Is%20Rising%E2%80%9D.%20Explain%20the%20key%20ideas%20and%20what%20an%20IT%20team%20or%20CISO%20should%20do%20next.%20Reply%20in%20English%2C%20clearly%20and%20with%20actionable%20steps.) - [Open with ChatGPT](https://chatgpt.com/?q=I%27m%20reading%20a%20Whalemate%20article%20titled%20%E2%80%9CAPWG%20and%20PCI%20DSS%3A%20Smishing%20Is%20Rising%E2%80%9D.%20Explain%20the%20key%20ideas%20and%20what%20an%20IT%20team%20or%20CISO%20should%20do%20next.%20Reply%20in%20English%2C%20clearly%20and%20with%20actionable%20steps.) In this article 1. [Source comparison](#s1) 2. [What does IBM say about smishing?](#s2) 3. [What does Proofpoint add about the vector?](#s3) 4. [Why do Kaspersky and Descope focus on human trust?](#s4) 5. [What changes when smishing is separated from mobile phishing?](#s5) 6. [What do the growth figures show?](#s6) 7. [What does PCI DSS v4.0 require for awareness?](#s7) 8. [What does Whalemate's reading mean for LATAM?](#s8) 9. [Operational takeaway](#s9) 10. [What to read next?](#s10) Whalemate Is this risk in your program? [Book a demo](https://www.whalemate.com/en/demo/) ## Related articles [!\[Fortinet awareness metrics go beyond completion\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/fortinet-awareness-metrics-go-beyond.webp)](https://www.whalemate.com/en/resources/blog/fortinet-awareness-metrics-go-beyond/) HRM Oct 7, 2026 By Federico Hombre ### Fortinet awareness metrics go beyond completion NIST, Fortinet, and the 2025 survey show a gap: behavior and event-based remediation can be measured, but many companies still track activity. Read more [!\[LATAM human risk management company metrics\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/latam-human-risk-management-company.webp)](https://www.whalemate.com/en/resources/blog/latam-human-risk-management-company/) HRM Oct 5, 2026 By Federico Hombre ### LATAM human risk management company metrics For CISOs, IT, and compliance teams in LATAM, HRM means tracking continuous behavior, turning it into risk, and keeping evidence for ISO 27001 and PCI DSS. Read more [!\[ISO 27001 and human risk management platforms\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/iso-27001-human-risk-management.webp)](https://www.whalemate.com/en/resources/blog/iso-27001-human-risk-management/) HRM Oct 2, 2026 By Federico Hombre ### ISO 27001 and human risk management platforms ISO 27001 requires continuous, effective programs. HRM turns them into behavior metrics, risk prioritization, and evidence for leadership. Read more [See all articles](https://www.whalemate.com/en/resources/blog/)