PCI DSS 12.6 Requires Vishing Coverage

Vishing and smishing are not just semantic variants of phishing. They are separate channels that now require separate responses. For CISOs, IT, and compliance teams in LATAM, the key issue is that PCI DSS already requires awareness training to cover phishing, related attacks, and social engineering, and it also requires acceptable use of end-user technologies such as mobile devices, while regional risk keeps growing in SMS, WhatsApp, and voice. If the program still centers on email or course completion, it leaves an operational gap in both compliance and real exposure to the CDE, Coggno, Segurilatam, Kaspersky.

What emerges when the sources are read together

The sources do a good job defining the terms separately, or explaining PCI, or showing the regional pressure in LATAM. What becomes clear when they are read together is a concrete operational gap: the formal obligation is already in PCI DSS and the real pressure has already shifted to mobile and voice, but many programs still measure only email or course attendance.

What exactly does it mean that vishing and smishing are phishing variants?

The overlap across sources is broad: vishing and smishing are phishing subtypes distinguished by channel. CISA defines vishing as voice-based phishing and smishing as phishing by text message, CISA PDF. NIST reinforces that phishing is no longer limited to email and can also appear as fraudulent text messages or fraudulent phone calls.

Experian sums it up by saying phishing, smishing, and vishing differ in how the attacker reaches the victim, email, text, or phone, Experian. SentinelOne and Dexpose also say phishing, smishing, and vishing are distinguished by the contact channel, email, text, or phone. Whalemate's reading is that this distinction is useful for more than an internal glossary: it makes separate channel-level metrics possible, because the behavior you want to detect and correct is not the same in voice, SMS, or email.

Why does the channel difference change operational risk?

In vishing, the dynamic is a conversation designed to build trust and get the victim to disclose sensitive information, including by pushing them to call a specific number. Cisco adds that these calls or voice messages seek credentials, card numbers, or banking data, and attackers also look for MFA codes or transfers.

In smishing, the dominant pattern is different. CISA links it to messages that lead the victim to click, download files or apps, or start a conversation, CISA PDF. IBM, Egress, and NCB highlight the mobile component, links, and the automatic opening of the browser, email, or a call, IBM, Egress, NCB. Whalemate's reading is that a single phishing indicator is not enough if the goal of vishing is usually to sustain a conversation and the goal of smishing is usually to trigger an immediate action on the device.

What does PCI DSS 12.6 require, and why is a single course not enough?

The PCI DSS v4.0 SAQ D Merchant document says a formal security awareness program must be implemented so that all personnel know the security policy and procedures and their role in protecting cardholder data, PCI SSC. Whalemate's material, aligned with that requirement, stresses that PCI DSS 12.6 requires a program of awareness, not a one-off course.

Secondary summaries of ISO 27001 point in the same continuous-process direction. Control Institute and High Table note that people under the organization's control must be aware of the policy, their contribution to the system, and the implications of noncompliance, Control Institute, High Table. Guardey, High Table, Cyberzoni, and Advisera add that control 6.3 requires a formal program, broad coverage, regular updates, and evidence of effectiveness, Guardey, High Table Annex A 6.3, Cyberzoni, Advisera. Whalemate's reading is that compliance is already pushing toward continuity and evidence, not toward annual training disconnected from real behavior.

What do PCI DSS 12.6.3.1 and 12.6.3.2 add to the problem?

Coggno details that under 12.6.3.1, training must include awareness of threats and vulnerabilities that could affect cardholder data, including phishing, related attacks, and social engineering, Coggno. The same source says 12.6.3.2 requires acceptable use of end-user technologies such as remote access, mobile devices, and removable media, also beginning March 31, 2025, Coggno.

That overlap changes how vishing and smishing should be read by PCI teams. If smishing happens through SMS, messaging, and mobile, and if vishing uses calls, voicemail, VoIP, and even AI-based impersonation, then the expected scope of the program cannot stop at email phishing. Whalemate's reading is that 12.6.3.1 and 12.6.3.2 together require mapping human risk and technology use by channel, not just proving course attendance.

Where is the tension between NIST's broad recommendation and real-world execution?

NIST says two relevant things. First, phishing is not limited to email and also appears as smishing and vishing. Second, people need to stay alert across all communication areas. That wording expands the awareness perimeter.

Whalemate, in its reading of NIST SP 800-50r1, shifts the focus from the talk to the practical exercise. It argues that the enterprise-wide program should include phishing, spear phishing, vishing, and smishing, and that the operational focus is not the presentation but whether the user detects the attempt or clicks, Whalemate blog. The tension is not doctrinal, it is about execution: NIST expands the channels, but if the organization does not test observable behavior by channel, it is left with pedagogical intent and no evidence of response.

Where is the tension between PCI DSS and LATAM reality?

PCI DSS, according to Coggno, already requires phishing, related attacks, social engineering, and acceptable use of mobile devices in the minimum content of the program, Coggno. At the same time, Segurilatam reports 286 million mobile fraud attempts via SMS and WhatsApp in 2023 and says 74% of organizations in Latin America were victims of smishing in the last year, Segurilatam. Kaspersky adds 1.291 billion phishing blocks in Latin America between 2023 and 2024, an 85% increase, Kaspersky.

The tension is direct. The requirement already covers the risk and the channel, but regional incidence shows that practice is still failing precisely in mobile and messaging. Whalemate's reading is that a program centered on email can both comply less well and protect less well, because it leaves out the channel where regional volume has already become visible.

Why isn't measuring only course completion enough?

Whalemate argues that HRM is not a security awareness course, but an approach that models context, simulates, trains, measures, intervenes, and reports, Whalemate HRM. That contrast matters because SecureCodingHub's material on PCI DSS 12.6.1 recommends recognition patterns, reporting procedures, and explicit current examples, including QR-code phishing, AI voice impersonation, and pretexting in Teams and Slack.

If the content must reflect current techniques and the risk is expressed in user behavior, course completion is an incomplete signal. It does not show whether the person recognized a suspicious SMS, hung up on a pretext call, reported an attempt, or shared a one-time code. Whalemate's reading is that a learning metric by itself does not prove operational resilience against vishing and smishing.

What should be measured by channel for vishing and smishing?

The findings point to four minimum measurement groups: exposure, detection, reporting, and response. This comes from combining the channel-based characterization from CISA, NIST, Proofpoint, and Adaptive Security with PCI DSS content requirements and the continuous measurement approach of HRM, CISA News, Proofpoint Social Engineering, Adaptive Security, Whalemate HRM.

In smishing, exposure refers to users and roles that operate more heavily in mobile or messaging. Detection looks at recognizing fraud signals in SMS, WhatsApp, or apps. Reporting measures whether the attempt reaches internal security channels. Response records whether there was a click, download, callback, credential handoff, or sharing of codes. In vishing, the logic changes: what matters is whether the user keeps talking or hangs up, verifies identity through another channel, and escalates the incident in time, Proofpoint Vishing, Canadian Centre for Cyber Security.

Why do mobile and voice create a specific gap in the CDE?

SecureCodingHub says phishing and social engineering were responsible for a meaningful share of recorded CDE compromises in the 2024-2025 window, though it does not give a specific percentage, SecureCodingHub. Adaptive Security and Acronis show that vishing can target credentials, MFA, transfers, or the installation of remote access tools, Adaptive Security, Acronis. That expands the impact from data theft to initial access and movement across systems.

In smishing, the mobile vector often sits outside classic corporate email controls. IBM and Egress emphasize links, malware, and urgent requests on mobile devices, IBM, Egress. Whalemate's reading is that if staff who touch card-environment processes also use mobile devices to authenticate, approve workflows, or answer messages, then a channel-level awareness gap can become a direct CDE gap.

What does HRM add against that gap?

Whalemate describes HRM as an approach that models context, simulates, trains, measures, intervenes, and reports, Whalemate HRM. It also says its public modules include advanced simulations, adaptive training, human risk analytics, and an awareness agent. For this issue, that makes it possible to move from generic awareness to an operational cycle around vishing and smishing.

The value is not only in simulating more channels. It is in connecting signals. Whalemate says the risk score consolidates data from simulations, courses, reports, and behavior, and is used to prioritize interventions, not to discipline, Whalemate HRM. Whalemate's reading is that, applied to vishing and smishing, that score can show who is most exposed or responds poorly on mobile and voice, so training or compensating controls can be targeted instead of using the data as punishment.

What decision does this enable for CISOs, IT, and compliance in LATAM?

The decision is not semantic, it is about program design. If vishing and smishing are phishing by voice and SMS, if PCI DSS 12.6 requires a formal program, if 12.6.3.1 requires phishing, related attacks, and social engineering, and if 12.6.3.2 requires acceptable use of mobile devices, then the program has to be measured by channel and not just by email or course completion, PCI SSC, Coggno.

For a CISO in LATAM, that means defining exposure, detection, reporting, and response metrics for SMS, voice, and messaging, not just email. For IT, it means including simulations and reporting paths that account for mobile devices, calls, and blended campaigns, something Proofpoint says is common when smishing is used in tandem with voice calls, Proofpoint Vishing. For compliance, it means asking for evidence of effectiveness by channel, not just attendance records. An HRM approach can operationalize that shift with multichannel simulations, adaptive training, and a risk score to prioritize interventions without turning the score into a disciplinary tool, Whalemate, Whalemate HRM.

What to read next

• Human Risk Management on the platform
• Whalemate: Human Risk Management platform
• APWG and PCI DSS: smishing on the rise

How should a tool like Guardey be evaluated for AI-based email impersonation?

It should be evaluated on whether it is limited to email or whether it also covers human risk in a multichannel way. In this area, a useful solution does not measure only completed courses, but simulation, training, measurement, intervention, and reporting of human risk.

The article already shows why that matters, because PCI DSS requires formal awareness and the operational risk in LATAM is shifting to mobile, SMS, WhatsApp, and voice. If the evaluation stays tied only to email, the program can remain blind to vishing and smishing even though the real exposure has already changed.