PCI DSS 12.6: Vishing and Smishing Scope

Vishing and smishing are not just two labels for voice and SMS phishing for CISOs, IT teams, and compliance leaders in LATAM. When their operational definitions are matched against PCI DSS 12.6, they become a compliance issue that requires a formal, current, and specific program covering phishing, social engineering, and acceptable use of end-user technologies. And when that is compared with evidence from simulations and human measurement, the decision is no longer to give an annual course, but to measure susceptibility, difficulty, and sustained improvement through a Human Risk Management approach.IC3 Coggno NIST Whalemate

What changes when these sources are viewed together

Looked at separately, the sources explain definitions, requirements, or metrics. Put side by side, they show something more uncomfortable: an organization can comply with awareness on paper and still undermeasure its real exposure to voice, SMS, and messaging.Cisco Bait and Phish Proofpoint

What do vishing and smishing mean when viewed as operational risk?

The stable part of the consensus is the channel. The IC3 defines smishing as malicious targeting through SMS or MMS and vishing as malicious targeting through voice memos or voice. Smishing uses text messages to trick people into giving up personal or financial information, vishing is carried out through phone calls or voice messages, and the difference between smishing and vishing is whether the scam uses text or voice support the same basic distinction, text for smishing, calls or voice for vishing.

Whalemate's view is that this channel difference is not a taxonomic detail. It is the basis for deciding which human vectors belong in the program, how they are simulated, and what metrics should be required by channel. If the channel changes, the human controls that should be observed change as well.

Why is a definition not enough?

Definitions describe the fraud, but they do not say how to govern it. Cisco focuses on fraudulent calls or voice messages used to steal credentials, card numbers, or banking data, and on SMS that push users to click links or visit fake sites. both rely on social engineering to get the victim to hand over sensitive information adds that both rely on social engineering to get the victim to hand over sensitive information.

For a CISO or compliance officer, the problem starts when that definition does not turn into an explicit inventory of exposure. If voice, SMS, and messaging are absorbed into the generic phishing category, there is no clear way later to request evidence, design tests, or report progress by vector.

Where does PCI DSS 12.6 enter this discussion?

It enters at the point where awareness stops being a best practice and becomes a programmatic obligation. The PCI Security Standards Council ties its awareness training to compliance with Requirement 12.6. The wording reproduced by SecurITM says a formal security awareness program must be implemented so that all personnel understand the security policy and procedures and their role in protecting the data.

Whalemate's reading is direct: if a formal program is required, vishing and smishing cannot remain marginal examples inside an annual session. They have to be mapped as concrete threats within the program scope, because they are forms of phishing and social engineering applied to end-user channels.

What does PCI DSS 12.6.1 require, and what decision does it enable?

The Bait and Phish summary of PCI DSS 12.6.1 is explicit: a formal security awareness program is needed for all personnel. Coggno agrees that isolated courses are not enough for organizations that store, process, or transmit card data.

The decision it enables is organizational. If the response to vishing and smishing today depends on a one-off campaign, a single vendor, or training without continuity, that does not align well with the requirement for a formal program. The shift is from activity to system.

What does PCI DSS 12.6.2 require, and why does it complicate a static approach?

Bait and Phish cites 12.6.2 as requiring awareness training to be reviewed at least every 12 months and updated for new threats and vulnerabilities that could affect the card data environment. the program must be documented and updated at least every 12 months also notes that the program must be documented and updated at least every 12 months.

That makes any frozen approach weak. If vishing and smishing grow or change form, for example by adding messaging or combining channels, the content and the way it is measured cannot stay the same by inertia. Compliance is not about keeping the same course, but about showing review and adjustment to risk.

What do PCI DSS 12.6.3, 12.6.3.1, and 12.6.3.2 add about voice, SMS, and messaging?

Coggno summarizes PCI DSS 12.6.3 as requiring training at hiring and at least every 12 months, with annual employee acknowledgment. It also says 12.6.3.1 specifically requires coverage of phishing and social engineering, and that 12.6.3.2 includes acceptable use of end-user technologies. mobile device protection, and use of telework technologies among the expected topics lists phishing, social engineering, acceptable use of end-user technologies, mobile device protection, and use of telework technologies among the expected topics.

Whalemate's reading is that this is where voice, SMS, and messaging come into scope. Even if the standard does not name vishing or smishing by those labels, it does require coverage of the threat types and technologies where those attacks happen. For compliance, that enables asking for evidence of content and practices tied to those specific channels.Whalemate

What tension appears between PCI DSS and the usual way of measuring?

The first tension is that PCI DSS, according to Coggno, expands scope to phishing, social engineering, and end-user technologies, while the NIST Phish Scale in this material is aimed at rating the human difficulty of detecting an email within awareness and phishing training programs.

Whalemate's reading is that an organization can end up with a paradox. It complies with a program that, in theory, should cover broader threats and technologies, but it measures with a reference centered on email. The result is a blind spot for vishing and smishing, right in the channels that the awareness obligation makes relevant.

What tension appears between an email model and multichannel campaigns?

The second tension appears when the logic of the NIST Phish Scale, centered on email, is compared with what smishing is often used alongside voice calls in vishing campaigns, and vishing can be combined with smishing in multichannel campaigns describes in attacker practice. It has observed an increase in these tactics and that smishing can extend into messaging apps such as WhatsApp, WeChat, or Facebook Messenger.

Whalemate's reading is that measuring only the reaction to email leaves out part of the real attack chain. If a user receives an SMS, then a call, or a message that leads into a live conversation, susceptibility appears as a sequence, not as a single click. That is an operational difference, not a semantic one.

What do the studies show about the need to measure sustained improvement?

The simulation evidence cuts against the idea that teaching knowledge is enough. A study hosted by Florian Adamsky reported a 17% initial click-through rate and a drop to 3.5% at the end of the observed period, plus 14.6% measured click rate and 10.7% self-reported among survey respondents. A study from Scientific Research Publishing showed that in one department the average click rate fell from 15.92% to 0.35% with later simulations.

Whalemate's reading is that meaningful improvement is longitudinal. The question is not whether people took the course, but whether susceptibility declines over time and whether that decline can be sustained. That logic matters even more for vishing and smishing, where urgency and impersonation operate in channels that traditional metrics cover less well.

Why is it not enough to look only at clicks?

The OutThink report adds a useful layer: simulations with different difficulty levels produce different combinations of clicks and reports. According to that material, easier simulations tend to be clicked and reported less, while harder ones tend to produce higher reporting rates when users recognize the risk.

Whalemate's reading is that a single metric, such as click rate, can be misleading. A mature program should look at at least difficulty, deception rate, and reporting rate, because the desired behavior is not just avoiding failure, but recognizing and escalating the event. For vishing and smishing, that means capturing what the person did after a call, an SMS, or a messaging app message, not only whether they clicked.

What does this mean for a Human Risk Management program?

According to Whalemate, HRM is not a security awareness course, but a model that simulates, trains, measures, intervenes, and reports. Whalemate's public site Whalemate also describes a risk score that consolidates signals from simulations, courses, reports, and behavior to prioritize interventions, not to punish.

Whalemate's reading is that this model fits the tension between formal obligation and limited measurement better. If real exposure is distributed across voice, SMS, messaging, and email, the program needs a continuous layer of signals and prioritization. The annual course is useful as baseline evidence, but not as a sufficient governance tool.

What operational consequence does this leave for CISOs, IT, and compliance in LATAM?

The decision it enables is to expand the set of metrics and evidence beyond the annual course and email. If PCI DSS 12.6 requires a formal program, and if Bait and Phish and Coggno show that the program must be reviewed, updated, and cover phishing, social engineering, and acceptable use of end-user technologies, then it makes sense to record simulations and human responses by channel, voice, SMS, messaging, and email. It also makes sense to incorporate deception rate, reporting rate, difficulty, and longitudinal change, using iterative HRM programs like the ones Whalemate describes to prioritize interventions.

For an organization in LATAM, where the report records 813 attempted incidents and 718 confirmed breaches in the region, the practical question is not what vishing and smishing mean in the abstract. The question is whether those channels are already in the human risk dashboard with periodic evidence, defined owners, and the ability to show improvement.

What to read next?

• Human Risk Management on the platform
• Whalemate and HRM in security awareness
• APWG and PCI DSS: Smishing Is Rising