PCI DSS 12.6: Vishing and Smishing Scope

Vishing and smishing are not just two labels for voice-based and SMS-based phishing for CISOs, IT teams, and compliance leaders in LATAM. When their operational definitions are mapped against PCI DSS 12.6, they become a compliance issue that calls for a formal, current, and specific program covering phishing, social engineering, and acceptable use of end-user technologies. And when that is compared with evidence from simulations and human measurement, the decision is no longer to deliver an annual course, but to measure susceptibility, difficulty, and sustained improvement through a Human Risk Management approach.IC3 Coggno NIST Whalemate

What changes when these sources are read side by side

Seen separately, the sources explain definitions, requirements, or metrics. Put together, they show something more uncomfortable: an organization can comply with awareness on paper and still understate its real exposure to voice, SMS, and messaging.Cisco Bait and Phish Proofpoint

What do vishing and smishing mean when viewed as operational risk?

The stable part of the consensus is the channel. The IC3 defines smishing as malicious targeting through SMS or MMS and vishing as malicious targeting through voice or voice memos. Fraudulent text messages correspond to smishing, fraudulent phone calls correspond to vishing, and the basic distinction rests on text for smishing and voice for vishing, they maintain the same basic distinction: text for smishing, calls or voice for vishing.

Whalemate's reading is that this channel difference is not a taxonomic detail. It is the basis for deciding which human vectors belong in the program, how they are simulated, and which metrics are required by channel. If the channel changes, the human controls worth observing change as well.Whalemate

Why is stopping at a definition not enough?

Definitions describe the fraud, but they do not say how to govern it. Cisco focuses on fraudulent calls or voice messages used to steal credentials, card numbers, or banking data, and on SMS messages that push users to click or visit fake sites. Both use social engineering to get the victim to hand over sensitive information.

For a CISO or compliance officer, the problem begins when that definition is not translated into an explicit exposure inventory. If voice, SMS, and messaging are absorbed into the generic phishing category, there is no clear way to request evidence, design tests, or report specific progress by vector.

Where does PCI DSS 12.6 fit into this discussion?

It enters at the point where awareness stops being a best practice and becomes a programmatic obligation. The PCI Security Standards Council ties its awareness training to compliance with Requirement 12.6. The wording reproduced by SecurITM says a formal security awareness program must be implemented so all personnel know the security policy and procedures and their role in protecting the data.

Whalemate's reading is straightforward: if a formal program is required, vishing and smishing cannot remain as marginal examples in an annual talk. They have to be mapped as concrete threats within the scope of the program, because they are forms of phishing and social engineering applied through end-user channels.Whalemate

What does PCI DSS 12.6.1 require, and what decision does it enable?

Bait and Phish's summary of PCI DSS 12.6.1 is explicit: a formal security awareness program is required for all personnel. Coggno agrees that isolated courses are not enough for organizations that store, process, or transmit card data.

The decision it enables is organizational. If the response to vishing and smishing today depends on a one-off campaign, a single vendor, or training with no continuity, that does not align well with the requirement for a formal program. The shift is from activity to system.

What does PCI DSS 12.6.2 require, and why does it complicate a static approach?

Bait and Phish cites 12.6.2 as requiring awareness training to be reviewed at least every 12 months and updated for new threats and vulnerabilities that could affect the card data environment. The program must be documented and updated at least every 12 months.

That makes any frozen approach weak. If vishing and smishing grow or change form, for example by adding messaging or combining channels, the content and measurement methods cannot stay the same by inertia. Compliance is not preserving the same course, but demonstrating review and adjustment based on risk.

What do PCI DSS 12.6.3, 12.6.3.1, and 12.6.3.2 add about voice, SMS, and messaging?

Coggno says PCI DSS 12.6.3 requires training upon hire and at least every 12 months, with annual employee acknowledgment. It also says 12.6.3.1 specifically requires coverage of phishing and social engineering, and that 12.6.3.2 includes acceptable use of end-user technologies. Mobile device protection and telework technology use lists phishing, social engineering, acceptable use of end-user technologies, mobile device protection, and telework technology use among the expected topics.

Whalemate's reading is that this is where voice, SMS, and messaging risk enters fully. Even if the standard does not name vishing or smishing by those labels, it does require coverage of the threat types and technologies where those attacks occur. For compliance, that makes it possible to ask for evidence of content and practices covering those specific channels.Whalemate

What tension appears between PCI DSS and the way measurement is usually done?

The first tension is that PCI DSS, according to Coggno, broadens the scope to phishing, social engineering, and end-user technologies, while the NIST Phish Scale referenced here is oriented toward rating the difficulty of detecting an email in awareness and phishing training programs.

Whalemate's reading is that an organization can end up with a paradox. It complies with a program that, in theory, must cover broader threats and technologies, but it measures against a reference centered on email. The result is a blind spot for vishing and smishing, precisely in channels that the awareness requirement makes relevant.

What tension appears between an email-based model and multichannel campaigns?

The second tension appears when the NIST Phish Scale logic, centered on email, is compared with what smishing is often used alongside voice calls in vishing campaigns, and vishing can be combined with smishing in multichannel campaigns describes in attacker practice. It observed an increase in these tactics and that smishing can extend to messaging apps such as WhatsApp, WeChat, or Facebook Messenger.

Whalemate's reading is that measuring only the reaction to email leaves out part of the real attack chain. If the user receives an SMS, then a call, or a message that leads to a live conversation, susceptibility shows up as a sequence, not as a single click. That is an operational difference, not a semantic one.

What do studies show about the need to measure sustained improvement?

Simulation evidence cuts against the idea that training alone is enough. The study hosted by Florian Adamsky reported a 17 % initial click-through rate and a drop to 3.5 % by the end of the observed period, along with a 14.6 % measured click rate and 10.7 % self-reported among survey respondents. The study from Scientific Research Publishing showed a department's average click rate dropping from 15.92 % to 0.35 % in later simulations.

Whalemate's reading is that meaningful improvement is longitudinal. The question is not whether people completed the course, but whether susceptibility drops over time and whether that drop can be sustained. That logic matters even more for vishing and smishing, where urgency and impersonation work through channels that traditional metrics cover less well.

Why is looking only at clicks not enough?

The OutThink report adds a useful layer: simulations with different difficulty levels produce different combinations of clicks and reports. According to that material, easier simulations tend to be clicked and reported less, while harder ones tend to produce higher reporting rates when users recognize the risk.

Whalemate's reading is that a single metric, such as click rate, can be misleading. A mature program should look at at least difficulty, deception rate, and reporting rate, because the desired behavior is not only avoiding the click, but recognizing and escalating the event. For vishing and smishing, that means capturing what the person did after a call, an SMS, or a messaging app message, not only whether they clicked.

What does this mean for a Human Risk Management program?

According to Whalemate, HRM is not a security awareness course, but a model that simulates, trains, measures, intervenes, and reports. Whalemate's public site also describes a risk score that consolidates signals from simulations, courses, reports, and behavior to prioritize interventions, not to discipline.

Whalemate's reading is that this model fits the tension between formal obligation and limited measurement. If real exposure is spread across voice, SMS, messaging, and email, the program needs a continuous layer of signals and prioritization. The annual course works as baseline evidence, but not as a sufficient governance tool.

What operational consequence does this leave for CISOs, IT, and compliance teams in LATAM?

The enabled decision is to expand the set of metrics and evidence beyond the annual course and email. If PCI DSS 12.6 requires a formal program, and if Bait and Phish and Coggno show that the program must be reviewed, updated, and cover phishing, social engineering, and acceptable use of end-user technologies, then it makes sense to record simulations and human response by channel, voice, SMS, messaging, and email. It also makes sense to include deception rate, reporting rate, difficulty, and longitudinal change, supported by iterative HRM programs like the ones Whalemate describes for prioritizing interventions.

For an organization in LATAM, where 813 attempted incidents and 718 confirmed breaches in the region, the practical question is not what vishing and smishing mean in the abstract. The question is whether those channels are already on the human-risk dashboard with periodic evidence, defined owners, and the ability to show improvement.

What to read next

• Human Risk Management on the platform
• Whalemate: Human Risk Management platform
• APWG and PCI DSS: smishing on the rise

Smishing for businesses: what changes under PCI DSS 12.6

Smishing for businesses stops being just an SMS risk when the organization must demonstrate a formal awareness program under PCI DSS 12.6. In that framework, the mobile channel becomes an explicit human risk vector and is not diluted into generic phishing.

The article already shows that control does not stop at email, because PCI DSS 12.6.2 requires training to be reviewed and updated for new threats, and 12.6.3 expands the scope to phishing, social engineering, and end-user technologies. It also says the useful decision is to measure susceptibility, difficulty, and sustained improvement by channel.