PCI DSS 12.6 Requires Vishing Coverage

Vishing and smishing are not just semantic variants of phishing. They are separate channels that now require separate responses. For CISOs, IT, and compliance teams in LATAM, the key point is that PCI DSS already requires coverage of phishing, related attacks, and social engineering in the awareness program, and it also requires acceptable use of end-user technologies such as mobile devices, while regional risk keeps rising precisely across SMS, WhatsApp and voice. According to the Internet Crime Complaint Center (FBI), the FBI defines smishing as the malicious targeting of individuals through SMS or MMS text messages, and defines vishing as the malicious targeting of individuals through voice messages, which can include voices generated by artificial intelligence. If the program still focuses on email or course completion, it leaves an operational gap in both compliance and real exposure to the CDE. According to the Internet Crime Complaint Center (FBI), the FBI's IC3 2025 report recorded 1,008,597 cybercrime complaints and $20.877 billion in losses, as well as 55,851 complaints under the Phishing/Spoofing category.

What emerges when the sources are put together

The sources describe the terms well on their own, explain PCI on their own, or show the regional pressure in LATAM on their own. What appears when they are combined is a concrete operational gap: the formal requirement is already in PCI DSS and the real pressure has already moved to mobile and voice, but many programs still measure only email or course attendance.

What does it mean exactly that vishing and smishing are variants of phishing?

The overlap across sources is broad: vishing and smishing are phishing subtypes distinguished by channel. CISA defines vishing as phishing through voice communication and smishing as phishing through text messages. NIST reinforces that phishing is no longer limited to email and can appear as fraudulent text messages or fraudulent phone calls.

Experian summarizes that phishing, smishing, and vishing differ by how the attacker contacts the victim, email, text, or phone. SentinelOne and Dexpose argue that phishing, smishing, and vishing are separated by the contact channel, email, text, or phone. Whalemate's reading is that this distinction is not just for an internal glossary. It enables separate metrics by channel, because the behavior to detect and correct is not identical across voice, SMS, and email.

Why does the channel difference change operational risk?

In vishing, the attack pattern is a conversation designed to build trust and get the victim to reveal sensitive information, even by pushing the person to call a specific number. Cisco adds that these calls or voice messages seek credentials, card numbers, or banking details, and attackers also look for MFA codes or transfers.

In smishing, the dominant pattern is different. CISA links it to messages that prompt a click, a file or app download, or the start of a conversation. IBM, Egress, and NCB emphasize the mobile component, links, and the automatic browser launch, email, or call. Whalemate's reading is that a single phishing indicator is not enough if vishing is usually meant to sustain a conversation and smishing is usually meant to trigger an immediate action on the device.

What does PCI DSS 12.6 require, and why is a single course not enough?

The SAQ D Merchant document for PCI DSS v4.0 states that a formal security awareness program must be implemented so all personnel know the security policy and procedures and their role in protecting cardholder data, PCI SSC. Whalemate material, aligned with that requirement, emphasizes that PCI DSS 12.6 requires an awareness program, not an isolated course.

Secondary summaries of ISO 27001 point in the same direction of a continuous process. Control Institute and High Table say people under the organization's control must be aware of the policy, their contribution to the system, and the implications of noncompliance. Guardey, High Table, Cyberzoni, and Advisera add that control 6.3 requires a formal program, broad coverage, regular updates, and evidence of effectiveness. Whalemate's reading is that compliance is already pushing toward continuity and evidence, not toward a once-a-year training disconnected from real behavior.

What do PCI DSS 12.6.3.1 and 12.6.3.2 add to the problem?

Coggno details that under 12.6.3.1, training must include awareness of threats and vulnerabilities that could affect cardholder data, including phishing, related attacks, and social engineering, Coggno. The same source says 12.6.3.2 requires coverage of acceptable use of end-user technologies such as remote access, mobile devices, and removable media, also as of March 31, 2025, Coggno.

That overlap changes how PCI teams should read vishing and smishing. If smishing happens through SMS, messaging, and mobile, and if vishing uses calls, voicemail, VoIP, and even AI-based impersonation, the expected scope of the program cannot stay limited to email phishing. Whalemate's reading is that 12.6.3.1 and 12.6.3.2 together require mapping human risk and technology use by channel, not just proving attendance at a training session.

Where is the tension between NIST's broad recommendation and real execution?

NIST says two relevant things. First, phishing is not limited to email and also appears as smishing and vishing. Second, users must stay vigilant across all communication areas. That wording expands the awareness perimeter.

Whalemate, in its reading of NIST SP 800-50r1, shifts the focus from the talk to the practical exercise. It argues that an enterprise-wide program should include phishing, spear phishing, vishing, and smishing, and that the operational focus is not the lecture but whether the user detects the attempt or clicks, Whalemate blog. The tension is not doctrinal, but operational: NIST expands the channels, but if the organization does not test observable behavior by channel, it ends up with pedagogical intent and no evidence of response.

Where is the tension between PCI DSS and the reality in LATAM?

PCI DSS, according to Coggno, already requires phishing, related attacks, social engineering, and acceptable use of mobile devices in the minimum program content, Coggno. At the same time, Segurilatam reports 286 million mobile fraud attempts via SMS and WhatsApp in 2023 and says 74% of organizations in Latin America were victims of smishing over the last year, Segurilatam. Kaspersky adds 1.291 billion blocks of phishing attacks in Latin America between 2023 and 2024, an 85% increase, Kaspersky.

The tension is direct. The requirement already covers the risk and the channel, but regional incidence shows that practice is still failing precisely in mobile and messaging. Whalemate's reading is that a program centered on email can both comply worse and protect worse, because it leaves out the channel where regional volume is already visible.

Why is course completion alone not enough?

Whalemate argues that HRM is not a security awareness course, but an approach that models context, simulates, trains, measures, intervenes, and reports. That distinction matters because SecureCodingHub material on PCI DSS 12.6.1 recommends recognition patterns, reporting procedures, and explicit current examples, including QR-code phishing, AI voice impersonation, and pretexting in Teams and Slack.

If the content must reflect current techniques and if the risk appears in user behavior, course completion is an incomplete signal. It does not show whether the person recognized a suspicious SMS, ended a pretexting call, reported an attempt, or shared a one-time code. Whalemate's reading is that a learning metric by itself does not prove operational resilience against vishing and smishing.

What should be measured by channel for vishing and smishing?

The material points to four minimum measurement groups: exposure, detection, reporting, and response. This comes from combining CISA's, NIST's, Proofpoint's, and Adaptive Security's channel-based characterization with PCI DSS content requirements and the continuous measurement approach of HRM.

In smishing, exposure refers to users and roles that operate more through mobile or messaging. Detection focuses on recognizing fraud signals in SMS, WhatsApp, or apps. Reporting measures whether the attempt reaches internal security channels. Response records whether there was a click, download, callback, credential handoff, or code sharing. In vishing, the logic changes: what matters is whether the user continues or ends the conversation, whether they verify identity through another channel, and whether they escalate the incident in time.

Why do mobile and voice open a specific gap in the CDE?

SecureCodingHub says phishing and social engineering were responsible for a significant share of the documented compromises in the CDE during the 2024 to 2025 window, although it does not give a specific percentage. Adaptive Security and Acronis show that vishing can target credentials, MFA, transfers, or installation of remote access tools. That expands the impact from data theft to initial access and movement across systems.

In smishing, the mobile vector is often left outside classic corporate email controls. IBM and Egress emphasize links, malware, and urgent requests on mobile devices, IBM, Egress. Whalemate's reading is that if staff involved in card-related processes also use mobile devices to authenticate, approve workflows, or answer messages, then the awareness gap by channel can become a direct gap in the CDE.

What does HRM add to that gap?

Whalemate describes HRM as an approach that models context, simulates, trains, measures, intervenes, and reports, Whalemate HRM. It also says its public modules include advanced simulations, adaptive training, human risk analytics, and an awareness agent. For this problem, that makes it possible to move from generic awareness to an operational cycle focused on vishing and smishing.

The gain is not only simulating more channels. It is connecting signals. Whalemate says the risk score consolidates data from simulations, courses, reports, and behavior, and that it is used to prioritize interventions, not to discipline, Whalemate HRM. Whalemate's reading is that, applied to vishing and smishing, that score can show which users are more exposed or respond worse on mobile and voice, so the organization can intervene with adaptive training or compensating controls instead of using the data as punishment.

What decision does this enable for CISOs, IT, and compliance teams in LATAM?

The decision is not semantic. It is about program design. If vishing and smishing are phishing by voice and SMS, if PCI DSS 12.6 requires a formal program, if 12.6.3.1 requires coverage of phishing, related attacks, and social engineering, and if 12.6.3.2 requires acceptable use of mobile devices, then the program has to be measured by channel and not only by email or course completion, PCI SSC, Coggno.

For a CISO in LATAM, that means defining exposure, detection, reporting, and response metrics for SMS, voice, and messaging, in addition to email. For IT, it means adding simulations and reporting paths that account for mobile devices, calls, and combined campaigns, something Proofpoint says is common when smishing is used alongside voice calls, Proofpoint Vishing. For compliance, it means asking for evidence of effectiveness by channel, not just evidence of attendance. An HRM approach makes it possible to operationalize that transition with multichannel simulations, adaptive training, and a risk score used to prioritize interventions without turning the score into a disciplinary tool, Whalemate, Whalemate HRM.

What to read next

• Human Risk Management in the platform
• Human Risk Management platform
• APWG and PCI DSS: smishing on the rise