--- title: "PCI DSS 12.6: Vishing and Smishing Scope | Whalemate" description: "Vishing and smishing are no longer just phishing variants. Under PCI DSS 12.6, they require a formal program, channel metrics, and steady improvement." url: https://www.whalemate.com/en/resources/blog/pci-dss-12-6-vishing/ lang: en updated: 2026-10-27 alternates: es: https://www.whalemate.com/recursos/blog/pci-dss-12-6-vishing/ pt-BR: https://www.whalemate.com/br/recursos/blog/pci-dss-12-6-vishing/ index: https://www.whalemate.com/llms.txt --- [Back to blog](https://www.whalemate.com/en/resources/blog/) Blog # PCI DSS 12.6: Vishing and Smishing Scope Vishing and smishing are no longer just phishing variants. Under PCI DSS 12.6, they require a formal program, channel metrics, and steady improvement. Oct 27, 2026 By [Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) 12 min read [HRM](https://www.whalemate.com/en/resources/blog/topic/hrm/) ![PCI DSS 12.6: Vishing and Smishing Scope](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/pci-dss-12-6-vishing.webp) In this article 1. [What changes when these sources are read side by side](#s1) 2. [What do vishing and smishing mean when they are treated as operational risk?](#s2) 3. [Why a definition alone is not enough](#s3) 4. [Where does PCI DSS 12.6 fit into this discussion?](#s4) 5. [What does PCI DSS 12.6.1 require, and what decision does it enable?](#s5) 6. [What does PCI DSS 12.6.2 require, and why does it challenge a static approach?](#s6) 7. [What do PCI DSS 12.6.3, 12.6.3.1, and 12.6.3.2 add about voice, SMS, and messaging?](#s7) 8. [What tension appears between PCI DSS and the usual way of measuring?](#s8) 9. [What tension appears between an email-based model and multichannel campaigns?](#s9) 10. [What do the studies show about the need for sustained improvement?](#s10) 11. [Why is it not enough to look only at clicks?](#s11) 12. [What does this mean for a Human Risk Management program?](#s12) 13. [What operational consequence does this leave for CISOs, IT, and compliance in LATAM?](#s13) 14. [What to read next](#s14) 15. [Smishing for businesses, what changes under PCI DSS 12.6](#s15) For CISOs, IT teams, and compliance staff in LATAM, vishing and smishing are not just two labels for voice and SMS phishing. When their operational definitions are aligned with [PCI DSS 12.6](https://www.whalemate.com/en/resources/blog/pci-dss-12-6-requires/), they become a compliance issue that calls for a formal, current, and specific program covering phishing, social engineering, and acceptable use of end-user technologies. And when that is compared with evidence from simulations and human measurement, the decision is no longer to run an [annual course](https://coggno.com/blog/pci-dss-v4-employee-training-requirements-annual-recertification/), but to measure susceptibility, [difficulty](https://www.nist.gov/publications/nist-phish-scale-user-guide), and sustained improvement through a Human Risk Management approach. ## What changes when these sources are read side by side Viewed separately, the sources explain definitions, requirements, or metrics. Taken together, they point to something less comfortable: an organization can meet [paper-based awareness](https://www.baitandphish.com/blog/pci-dss-phishing-training) and still understate its real [exposure to voice](https://www.cisco.com/site/us/en/learn/topics/security/what-is-vishing.html), SMS, and messaging. | Topic | Channel/vector | Attack or control objective | Multichannel scope | What it requires or lets you measure | Frequency/update | Decision it enables | Source | | --- | --- | --- | --- | --- | --- | --- | --- | | Smishing, operational definition | SMS or MMS, text messages | Malicious targeting through deceptive messages | Not specified | Not specified | Not specified | Treat SMS/MMS as an explicit human risk vector | IC3 | | Vishing, operational definition | Voice memos or voice | Malicious targeting through deceptive messages | Not specified | Not specified | Not specified | Treat voice and voice messages as an explicit human risk vector | IC3 | | Vishing, fraud lens | Calls or voice messages | Obtain credentials, card numbers, or banking data | Not specified | Not specified | Not specified | Include credential and data extraction scenarios by voice | Cisco | | Smishing, fraud lens | SMS with links or fake sites | Induce clicks or visits to fake websites | Not specified | Not specified | Not specified | Include [mobile links](https://www.proofpoint.com/us/threat-reference/smishing) and phone-based browsing in the program | Proofpoint | | PCI DSS 12.6.1 | Not specified | Formal security awareness program for all personnel | Not specified | Implementation of a formal program | Not specified | Move from isolated actions to a formal program | Bait and Phish | | PCI DSS 12.6.2 | New threats and vulnerabilities | Review and update awareness training | Not specified | Program review against new threats | At least every 12 months | Check whether vishing and smishing are covered and updated | Bait and Phish | | PCI DSS 12.6.3, 12.6.3.1, and 12.6.3.2 | Phishing, related attacks, social engineering, end-user technologies | Train staff on specific threats and acceptable use | Yes, by threat type and technology | Training at hire, annually, and annual acknowledgment | Upon hire and at least every 12 months | Bring voice, SMS, and messaging into the mandatory program | Coggno | | General Requirement 12.6 wording | Not specified | Make staff aware of their role in protecting cardholder data | Not specified | [Formal program implemented](https://service.securitm.ru/docs/pci-dss-v4-0/requirement-12-6) | Not specified | Link awareness to card data protection, not just training | SecurITM | | NIST Phish Scale | Email | Rate human detection difficulty | Not specified | Human detection difficulty in awareness programs | Not specified | Measure human performance beyond document compliance, but in email | NIST | | Experimental simulation study | Phishing simulation | Measure click-through and self-reporting | Not specified | 17 % initial, [3.5 % at the end](https://florian.adamsky.it/research/publications/2024/phishing-simulation.pdf), 14.6 % measured, 10.7 % self-reported | Over the observed period | Validate with longitudinal metrics whether susceptibility declines | Adamsky PDF | | Longitudinal study | Phishing simulation | Measure susceptibility with repeated exposure | Not specified | [15.92 % to 0.35 %](https://www.scienpress.com/Upload/JRC/Vol%2013_1_10.pdf) | Later simulations | Sustain an iterative program | Scientific Research PDF | | CHRM report | Messages with different difficulty levels | Observe how clicks and reports vary | Not specified | Difference between [difficulty, clicks, and reports](https://outthink.io/community/thought-leadership/CHRM-report/) | Not specified | Look beyond clicks and add difficulty plus reporting | OutThink | | HRM as an operating model | Simulate, train, measure, intervene, and report | Manage human risk | Yes, across multiple signals | Consolidation of signals into a risk score | Continuous | Prioritize interventions, not discipline | Whalemate | ## What do vishing and smishing mean when they are treated as operational risk? The stable part of the consensus is the channel. IC3 defines smishing as malicious targeting through SMS or MMS and vishing as malicious targeting through voice memos or voice. [Fraudulent text messages](https://www.experian.com/blogs/ask-experian/phishing-smishing-vishing/) are smishing, [fraudulent phone calls](https://www.csoonline.com/article/567547/smishing-and-vishing-how-these-cyber-attacks-work-and-how-to-prevent-them.html) are vishing, and the [basic distinction](https://www.keepersecurity.com/blog/2023/06/09/smishing-vs-vishing-whats-the-difference/) is text for smishing and voice for vishing. According to CISA, vishing is the social engineering approach that uses voice communication, and advanced attacks can be carried out entirely through voice communications by exploiting VoIP solutions and broadcast services. According to CISA, smishing is a form of social engineering that exploits SMS or text messages, and those messages can include links to web pages, email addresses, or phone numbers. CISA also describes vishing as phishing through voice communication meant to draw the victim into a conversation and build trust, and smishing as phishing through text messages meant to get the victim to click a link, download files or apps, or start a conversation. Whalemate's view is that this channel difference is not a taxonomy detail. It is the basis for deciding which human vectors belong in the program, how they are simulated, and what metrics must be required by channel. If the channel changes, the human controls worth observing change too. ## Why a definition alone is not enough Definitions describe the fraud, but they do not say how to govern it. Cisco focuses on fraudulent calls or voice messages used to steal credentials, card numbers, or banking data, and on SMS messages that push users to click or visit fake websites. Both use [social engineering](https://www.sentinelone.com/cybersecurity-101/threat-intelligence/phishing-vs-smishing-vs-vishing/) to get the victim to hand over sensitive information. According to the FBI/IC3, smishing maliciously targets people through SMS or MMS text messages. For a CISO or compliance officer, the problem starts when that definition is not turned into an explicit exposure inventory. If [voice, SMS, and messaging](https://nordlayer.com/learn/threats/phishing-vs-smishing-vs-vishing/) are absorbed into the generic phishing category, there is no clear way to ask for evidence, design tests, or report vector-specific progress. ## Where does PCI DSS 12.6 fit into this discussion? It enters at the point where awareness stops being a best practice and becomes a programmatic requirement. The PCI Security Standards Council ties its [awareness training](https://www.pcisecuritystandards.org/program_training_and_qualification/requirements_awareness/) to compliance with Requirement 12.6. The wording reproduced by SecurITM says a formal security awareness program must be implemented so all personnel understand the security policy and procedures and their role in protecting the data. Whalemate's reading is direct: if a formal program is required, vishing and smishing cannot remain as marginal examples in an annual presentation. They must be mapped as concrete threats within the program's scope, because they are forms of phishing and social engineering delivered through end-user channels. ## What does PCI DSS 12.6.1 require, and what decision does it enable? Bait and Phish's summary of PCI DSS 12.6.1 is explicit: there must be a formal security awareness program for all personnel. Coggno agrees that one-off courses are not enough for organizations that store, process, or transmit card data. The decision it enables is organizational. If the response to vishing and smishing depends on an isolated campaign, a single vendor, or training without continuity, that does not align well with a formal program requirement. The shift is from activity to system. ## What does PCI DSS 12.6.2 require, and why does it challenge a static approach? Bait and Phish cites 12.6.2 as requiring awareness training review at least every 12 months and updates for new threats and vulnerabilities that could affect the card data environment. The program must be documented and updated [at least every 12 months](https://www.securitymetrics.com/blog/security-awareness-training). That makes any frozen approach weak. If vishing and smishing grow or change form, for example by adding messaging or combining channels, the content and the way it is measured cannot stay the same by inertia. Compliance is not keeping the same course; it is demonstrating review and adjustment in response to risk. ## What do PCI DSS 12.6.3, 12.6.3.1, and 12.6.3.2 add about voice, SMS, and messaging? Coggno summarizes PCI DSS 12.6.3 as requiring training upon hire and at least every 12 months, with annual employee acknowledgment. It also says 12.6.3.1 requires coverage of phishing and social engineering specifically, and 12.6.3.2 includes acceptable use of end-user technologies. Ransomleak lists phishing, social engineering, acceptable use of end-user technologies, [mobile device protection](https://ransomleak.com/compliance/pci-dss/), and the use of remote-work technologies among the expected topics. Whalemate's reading is that this is where voice, SMS, and messaging risk enters fully. Even if the standard does not name vishing or smishing by those labels, it does require coverage of the threat types and technologies where those attacks occur. For compliance, that makes it reasonable to ask for evidence of content and exercises that address those specific channels. Whalemate Want to see Whalemate in your organization? Book a demo. We will walk through email and QRishing simulations for your team, and what CISO, IT or compliance can decide from there. [Book a demo](https://www.whalemate.com/en/demo/) ## What tension appears between PCI DSS and the usual way of measuring? The first tension is that PCI DSS, according to Coggno, expands the scope to phishing, social engineering, and end-user technologies, while the [NIST Phish Scale](https://www.nist.gov/publications/nist-phish-scale-user-guide) in this material is oriented to rating the human detection difficulty of email within awareness and phishing training programs. Whalemate's reading is that an organization can end up with a paradox. It meets a program that, in theory, should cover broader threats and technologies, but it measures against a reference centered on email. The result is a visibility gap for vishing and smishing, precisely the channels that the awareness requirement makes relevant. ## What tension appears between an email-based model and multichannel campaigns? The second tension appears when the NIST Phish Scale's email-centered logic is compared with what Proofpoint describes about attacker behavior: smishing is often used alongside voice calls in [multichannel campaigns](https://www.proofpoint.com/us/threat-reference/vishing), and vishing can be combined with smishing. Kroll observed an increase in these tactics and noted that smishing can extend to [messaging apps](https://www.kroll.com/en/publications/cyber/monitor/vishing-smishing-attacks) such as WhatsApp, WeChat, or Facebook Messenger. Whalemate's reading is that measuring only email reactions leaves out part of the real attack chain. If a user gets an SMS, then a call, or a message that turns into a live conversation, susceptibility appears as a sequence, not a single click. That is an operational difference, not a semantic one. ## What do the studies show about the need for sustained improvement? Simulation evidence argues against the idea that training alone is enough. The study hosted by Florian Adamsky reported an initial [17 % click-through rate](https://florian.adamsky.it/research/publications/2024/phishing-simulation.pdf) and a drop to 3.5 % by the end of the observed period, along with 14.6 % measured click rate and 10.7 % self-reported among survey respondents. The Scientific Research Publishing study showed a [drop in average click rate](https://www.scienpress.com/Upload/JRC/Vol%2013_1_10.pdf) from 15.92 % to 0.35 % in one department after later simulations. Whalemate's reading is that the meaningful improvement is longitudinal. The question is not whether people took the course, but whether susceptibility declines over time and whether that decline can be sustained. That logic matters even more for vishing and smishing, where urgency and impersonation operate in channels that are less covered by traditional metrics. ## Why is it not enough to look only at clicks? The OutThink report adds a useful layer: simulations with different difficulty levels produce different combinations of clicks and reports. According to that material, easier simulations tend to draw fewer clicks and fewer reports, while harder ones tend to produce higher reporting rates when users recognize the risk. Whalemate's reading is that a single metric, such as click rate, can mislead. A mature program should look at at least difficulty, deception rate, and reporting rate, because the desired behavior is not only avoiding the click but recognizing and escalating the event. For vishing and smishing, that means capturing what the person did in response to a call, an SMS, or a messaging app message, not only whether they clicked. ## What does this mean for a Human Risk Management program? According to Whalemate, HRM is not a security awareness course, but a model that simulates, trains, measures, intervenes, and reports. Whalemate's public site also describes a risk score that consolidates signals from simulations, courses, reports, and behavior to prioritize interventions, not to discipline. Whalemate's reading is that this model fits the tension between formal obligation and limited measurement better. If real exposure is distributed across voice, SMS, messaging, and email, the program needs a continuous layer of signals and prioritization. The annual course is a baseline evidence point, but it is not enough as a governance instrument. ## What operational consequence does this leave for CISOs, IT, and compliance in LATAM? The enabled decision is to expand metrics and evidence beyond the annual course and beyond email. If [PCI DSS 12.6](https://service.securitm.ru/docs/pci-dss-v4-0/requirement-12-6) requires a formal program, and if Bait and Phish and Coggno show that the program must be reviewed, updated, and cover phishing, social engineering, and acceptable use of end-user technologies, then it makes sense to record simulations and human responses by channel, voice, SMS, messaging, and email. It also makes sense to incorporate deception rate, reporting rate, difficulty, and longitudinal change, supported by iterative HRM programs like the ones Whalemate describes for prioritizing interventions. For an organization in LATAM, where the RH-ISAC report shows [813 attempted incidents](https://rhisac.org/wp-content/uploads/TLPCLEAR-2026-RHISAC-Verizon-DBIR-Comparison.pdf) and 718 confirmed breaches in the region, the practical question is not what vishing and smishing mean in the abstract. The question is whether those channels are already on the human risk dashboard with periodic evidence, assigned owners, and the ability to show improvement. ## What to read next - [Human Risk Management on the platform](https://www.whalemate.com/en/human-risk-platform/) - [Human Risk Management platform](https://www.whalemate.com/en/resources/blog/whalemate-hrm-security-awareness/) - [APWG and PCI DSS: smishing on the rise](https://www.whalemate.com/en/resources/blog/apwg-pci-dss-smishing-rising/) ## Smishing for businesses, what changes under PCI DSS 12.6 Smishing for businesses stops being only an SMS risk when the organization has to demonstrate a formal awareness program under PCI DSS 12.6. In that framework, the mobile channel becomes an explicit human risk vector and does not get blurred into generic phishing. The article already shows that the control is not limited to email, because PCI DSS 12.6.2 calls for training review and updates for new threats, and 12.6.3 expands the scope to phishing, social engineering, and end-user technologies. It also shows that the useful decision is to measure susceptibility, difficulty, and sustained improvement by channel. [See the full topic guide](https://www.whalemate.com/en/human-risk-platform/) Questions ## Frequently asked questions **What do vishing and smishing refer to in cyber security?** In cyber security, smishing refers to phishing attacks carried out through SMS or MMS, and vishing to phishing attacks carried out through calls, voice messages, or voice in general, according to IC3 and Cisco. For security teams, the key is not only the name, but that each channel requires specific controls, measurements, and training. **Why are vishing and smishing a compliance issue and not just an awareness issue?** Because the material from Coggno and Bait and Phish shows that PCI DSS 12.6 requires a formal program, reviewed and updated, that covers phishing, social engineering, and acceptable use of end-user technologies. That brings voice, SMS, and messaging into the program’s operational scope, not as optional examples. **What fails in practice when a company measures only email phishing?** Coverage of the real risk fails. The NIST Phish Scale in the cited material is oriented toward email, while Proofpoint and Kroll describe multichannel campaigns that combine SMS, calls, and messaging. A company can measure email well and still not see how its people respond to voice or mobile text. **Which metrics should you ask for as soon as tomorrow?** At a minimum, it makes sense to ask for evidence of coverage by channel, simulation results, deception rate or click rate when applicable, reporting rate, test difficulty level, and longitudinal evolution. The studies by Adamsky, Scientific Research Publishing, and the report from OutThink show that sustained improvement and difficulty matter as much as the point-in-time result. **What decision does a Human Risk Management approach enable?** It enables a shift from a logic of isolated training to one of continuous prioritization. According to Whalemate, HRM simulates, trains, measures, intervenes, and reports, and its site describes a risk score that consolidates signals to prioritize interventions. That makes it possible to treat vishing and smishing as manageable risk by channel and by team, not as an individual failure. **What is adaptive phishing?** Adaptive phishing is a form of phishing that adjusts the attack according to the channel, the context, and the victim's response. In this article, the idea fits with the need to measure and manage voice, SMS, and messaging as distinct vectors within a formal awareness and Human Risk Management program. Whalemate Is this risk in your program? If this article describes something you already faced — or that the board is asking you to explain — book a demo. [Book a demo](https://www.whalemate.com/en/demo/) ## Would you like to go deeper on this topic? Open this article directly in Claude or ChatGPT — ask questions, get a summary, or explore related ideas. - [Open with Claude](https://claude.ai/new?q=I%27m%20reading%20a%20Whalemate%20article%20titled%20%E2%80%9CPCI%20DSS%2012.6%3A%20Vishing%20and%20Smishing%20Scope%E2%80%9D.%20Explain%20the%20key%20ideas%20and%20what%20an%20IT%20team%20or%20CISO%20should%20do%20next.%20Reply%20in%20English%2C%20clearly%20and%20with%20actionable%20steps.) - [Open with ChatGPT](https://chatgpt.com/?q=I%27m%20reading%20a%20Whalemate%20article%20titled%20%E2%80%9CPCI%20DSS%2012.6%3A%20Vishing%20and%20Smishing%20Scope%E2%80%9D.%20Explain%20the%20key%20ideas%20and%20what%20an%20IT%20team%20or%20CISO%20should%20do%20next.%20Reply%20in%20English%2C%20clearly%20and%20with%20actionable%20steps.) In this article 1. [What changes when these sources are read side by side](#s1) 2. [What do vishing and smishing mean when they are treated as operational risk?](#s2) 3. [Why a definition alone is not enough](#s3) 4. [Where does PCI DSS 12.6 fit into this discussion?](#s4) 5. [What does PCI DSS 12.6.1 require, and what decision does it enable?](#s5) 6. [What does PCI DSS 12.6.2 require, and why does it challenge a static approach?](#s6) 7. [What do PCI DSS 12.6.3, 12.6.3.1, and 12.6.3.2 add about voice, SMS, and messaging?](#s7) 8. [What tension appears between PCI DSS and the usual way of measuring?](#s8) 9. [What tension appears between an email-based model and multichannel campaigns?](#s9) 10. [What do the studies show about the need for sustained improvement?](#s10) 11. [Why is it not enough to look only at clicks?](#s11) 12. [What does this mean for a Human Risk Management program?](#s12) 13. [What operational consequence does this leave for CISOs, IT, and compliance in LATAM?](#s13) 14. [What to read next](#s14) 15. [Smishing for businesses, what changes under PCI DSS 12.6](#s15) Whalemate Is this risk in your program? [Book a demo](https://www.whalemate.com/en/demo/) ## Related articles [!\[Fortinet awareness metrics go beyond completion\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/fortinet-awareness-metrics-go-beyond.webp)](https://www.whalemate.com/en/resources/blog/fortinet-awareness-metrics-go-beyond/) HRM Oct 7, 2026 By Federico Hombre ### Fortinet awareness metrics go beyond completion NIST, Fortinet, and the 2025 survey show a gap: behavior and event-based remediation can be measured, but many companies still track activity. Read more [!\[LATAM human risk management company metrics\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/latam-human-risk-management-company.webp)](https://www.whalemate.com/en/resources/blog/latam-human-risk-management-company/) HRM Oct 5, 2026 By Federico Hombre ### LATAM human risk management company metrics For CISOs, IT, and compliance teams in LATAM, HRM means tracking continuous behavior, turning it into risk, and keeping evidence for ISO 27001 and PCI DSS. Read more [!\[ISO 27001 and human risk management platforms\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/iso-27001-human-risk-management.webp)](https://www.whalemate.com/en/resources/blog/iso-27001-human-risk-management/) HRM Oct 2, 2026 By Federico Hombre ### ISO 27001 and human risk management platforms ISO 27001 requires continuous, effective programs. HRM turns them into behavior metrics, risk prioritization, and evidence for leadership. Read more [See all articles](https://www.whalemate.com/en/resources/blog/)