PCI DSS: Phishing vs. Spam in LATAM

Phishing and spam do not compete for the same budget, and they are not governed by the same evidence. Across NIST, IETF, PCI DSS, CISA, NCSC, Brazil, APWG, Microsoft, and Fortra, the pattern is clear: spam and abuse are handled with authentication, reputation, and email filtering, while phishing and fraud also require automated detection, continuous training, reporting, and intervention on credentials and access.

Placed side by side, the sources show something that rarely appears in a single framework: taxonomy changes the required control, the useful metric, and the budget decision. They also show that reducing spam volume does not, by itself, prove a comparable drop in phishing risk.

Why does "phishing vs spam" change the control program?

NIST defines spam as junk email or abuse of electronic messaging systems, while NIST, CISA, and CTIR Gov describe phishing as fraud and social engineering aimed at obtaining data, credentials, or clicks on malicious resources. IETF RFC 6430 also separates abuse from fraud in email reporting taxonomy. Whalemate’s reading is that this separation is not academic: it determines whether the problem is governed as email hygiene or as a compromise risk.

What does the IETF taxonomy show that is often lost in practice?

IETF RFC 6430 separates abuse, such as unsolicited email or other email abuse, from fraud, such as fraud or phishing activity. That distinction allows one team to report one issue and a fraud or identity team to handle another. Whalemate’s reading is that when both categories are merged into a single "bad mail blocked" KPI, traceability is lost on which control reduced volume and which control reduced real risk.

Why does a sharp drop in spam not equal a drop in phishing risk?

APWG recorded 45,355 spam campaigns in the fourth quarter of 2025, down from 81,710 in the third quarter of 2025, a 45% decline. The same APWG observed 853,244 phishing attacks in the fourth quarter of 2025, 4% lower than the 892,494 seen in the third quarter. Whalemate’s reading is that using lower spam volume as a proxy for phishing exposure can create a false sense of improvement.

What main control belongs to spam, and which one belongs to phishing?

According to IETF, DMARC allows policy publication for authenticating the From-domain, supported by DKIM or SPF, and when alignment is missing the receiver can treat the message differently, for example by marking and filtering it as spam. In contrast, PCI DSS v4.0 requirement 5.4.1 requires automated processes and mechanisms to detect and protect personnel against phishing attacks. Whalemate’s reading is that email and phishing share surface area, but they do not share a sufficient control.

What does PCI DSS require when the problem is phishing, not simple spam?

PCI DSS v4.0 requirement 5.4.1 requires automated mechanisms against phishing, and PCI DSS v4.0 requirement 12.6.3.1 requires training to include phishing, related attacks, and social engineering. PCI DSS 12.6 also says awareness education is an ongoing activity. Whalemate’s reading is that filtering email does not replace defensive automation or evidence of continuous training.

Does the training obligation prove that a simulation platform is mandatory?

No. According to PCI SSC, PCI DSS 4.0 requirement 12.6.1 allows, as a simple example, a program made up of a brochure posted in an office or a periodic email sent to all employees. But PCI DSS v4.0 requirement 5.4.1 still requires automated mechanisms to detect and protect staff against phishing. Whalemate’s reading is that minimum compliance and operational effectiveness are not the same, and that 12.6.1 should not be used to dilute 5.4.1.

What tension exists between continuous training and limited impact evidence?

PCI DSS requires continuous training, and NIST SP 800-53 AT-2 requires security awareness training for system users, including managers, senior executives, and contractors. But a NIST-published study concluded that people were about 2% less likely to fall for phishing after receiving some type of training, and NIST also warns that comparing click rates across campaigns and organizations can be problematic. Whalemate’s reading is that training remains required, but its success should not be measured with a single number or treated as a stand-alone control.

What goes wrong when click rate is used as the main indicator?

Fortra reported a click rate of 5.42%, a credential submission rate of 1.99%, and a report rate of 10.5% in a report covering more than 14 million recipients and more than 7,500 simulations. NIST warns that measuring resilience by comparing click rate across campaigns and organizations can be problematic, and recommends click-rate and report-rate baselines along with complementary subjective metrics. Whalemate’s reading is that click rate alone describes a reaction, not the full defense capability.

Why should reporting carry more weight than it often does?

The NCSC says that a culture that allows phishing emails to be reported, even when the user clicked, provides vital information about the attack types being used. Fortra, meanwhile, reported a 10.5% report rate, which the same report says means roughly 9 out of 10 attempts were not reported. Whalemate’s reading is that the main bottleneck is not always recognizing the lure, but escalating it quickly enough to contain credentials, sessions, and access.

How does contextual difficulty affect measurement?

NIST describes the NIST Phish Scale as a way to rate the difficulty of detecting a phishing email based on the email’s characteristics and the recipient’s context. That corrects a blind comparison between easier and more complex campaigns. Whalemate’s reading is that a mature program does not compare percentages alone; it also normalizes for difficulty and context to avoid incentives to design trivial simulations.

Why should phishing be connected to identity and credentials?

CTIR Gov recommends immediately notifying the incident handling, security, or IT support team when phishing or credential compromise is suspected. Microsoft reported that identity-based attacks increased 32% in the first half of 2025 and that more than 97% were mass password attacks. Whalemate’s reading is that the incident does not end in the inbox; it continues in credentials, sessions, and privileges.

What weight does phishing have in risk materialization?

Microsoft Incident Response reported that 28% of the breaches analyzed began with phishing or social engineering. Verizon reported that the human element was involved in about 60% of the breaches analyzed, and its report said credential abuse accounted for 22% and vulnerability exploitation for 20% of the main initial vectors. Whalemate’s reading is that phishing should not be measured only as inbox noise, but as a gateway to account compromise and breaches.

What governance decision does this source mix enable?

According to APWG, phishing remained at high volumes during 2025, with 3.8 million attacks observed, while APWG showed a much sharper drop in spam campaigns between the third and fourth quarters. According to PCI DSS, phishing also triggers specific obligations for automation and continuous training. Whalemate’s reading is that it makes sense to separate budget, owners, and evidence between an email track and a human-risk and identity track.

Operational consequence

For a CISO, IT team, or compliance function in LATAM, the practical decision is to govern "phishing vs spam" as two different problems with different evidence. For spam and abuse, prioritize DMARC, DKIM, SPF, reputation, and email filtering, because according to IETF those controls act on authentication and message handling. For phishing and fraud, build a second track with the automated mechanisms required by PCI DSS v4.0 5.4.1, the continuous training required by PCI DSS 12.6 and 12.6.3.1, the reporting culture recommended by NCSC, immediate notification of possible credential compromise recommended by CTIR Gov, measurement with report rate, response times, and contextual difficulty using NIST Phish Scale, and post-click identity controls such as phishing-resistant MFA, which Microsoft says can prevent up to 99% of those identity attacks. Do not use reduced spam as proof of lower compromise risk, and do not use isolated click rate as proof of maturity.

What to read next?

• Awareness on the platform
• NIST and CISA on social engineering
• ISO, NIST, SANS, Verizon on phishing training