Smishing and vishing under PCI DSS 12.6

The difference between smishing and vishing may look semantic, SMS versus voice, but when it is compared with NIST, PCI DSS 12.6 and evidence from Verizon, Zimperium and Whalemate, it changes a key operational decision for CISOs, IT and compliance teams in LATAM: email-only awareness is not enough. Multichannel phishing has to be measured and trained, because SMS and voice show stronger growth or effectiveness and a formal program must cover related threats and attacks.

What appears when smishing, vishing and PCI DSS 12.6 are compared

Placed side by side, the sources show something they do not fully explain on their own. The channel difference between smishing and vishing does not only change the definition, it changes what risk evidence needs to be reviewed, what metrics should be requested, and what minimum scope a formal awareness program should cover.

Is the difference between smishing and vishing only semantic?

Yes in the definition, no in the management. NIST says phishing ranges from email attacks to those that use voice, vishing, and those that arrive by text message, smishing. Keepnet Labs says the same thing more simply, smishing is phishing through SMS and vishing is voice phishing through live calls or callbacks.

Whalemate's reading is that that small channel difference does not justify one aggregated measurement. If the channel changes, the type of interaction changes too, along with the friction, the controls available and the signal that should be captured in a simulation or operational report. That is why Whalemate treats both as specific subtypes within a formal awareness program.

What does PCI DSS 12.6 say and why does it push coverage of both channels?

Whalemate reproduces the requirement that under PCI DSS 12.6 "a formal security awareness program must be implemented so that all personnel know the security policy and procedures and their role in protecting cardholder data". The same source insists this requires a formal program, not a one-off course. securitm.ru also describes requirement 12.6 as the implementation of a formal awareness program.

The tension appears when Coggno says training should include phishing and related attacks and social engineering, while many real-world implementations still measure awareness almost only in email. Whalemate's reading is that, if smishing and vishing are phishing subtypes differentiated by channel, they fall within the operational scope of the program PCI DSS asks organizations to demonstrate.

Why is an email-centered program not enough?

NIST is explicit that attacks are no longer limited to email. Verizon DBIR says people are often more likely to fall for a mobile threat than for traditional email. Zimperium adds that mobile phishing has a 40% higher success rate than email.

The tension is direct. On one side, the formal program exists and is often audited. On the other, the real attack surface has moved to mobile and voice. Whalemate's reading is that an organization can be formally covered in awareness and still remain blind to the channels where there is now more effectiveness or less visibility.

What does the evidence show about smishing at scale and effectiveness?

Verizon Business says more than 50% of personal devices used for work were victims of mobile phishing in 2022 and that text attacks raise the likelihood of compromise by six to ten times compared with email. Verizon reports that SMS spam went from 1,227 million messages in September 2021 to 10.89 billion in August 2022.

Deepstrike adds that SMS accounted for 69.3% of the mishing vectors observed. Whalemate cites Segurilatam and says 74% of organizations in Latin America were victims of smishing. Whalemate's reading is that SMS is no longer a minor phishing variant. It is a major vector that deserves its own metrics.

What does the evidence show about vishing growth and pressure?

Verizon says vishing uses calls to deceive customers and reports a 550% increase between Q1 2021 and Q1 2022. Acronis defines vishing as the use of voice communications to induce credential disclosure or unsafe actions, and cites voice phishing as the second most common initial infection vector in 2025, present in 11% of investigations with an identified vector.

The tension with smishing is that vishing may not dominate by volume, but it can be stronger in psychological pressure and real-time urgency. Whalemate's reading is that voice is not evaluated well with a metric designed for email or SMS. It requires measuring verbal response, following instructions and the ability to verify under pressure.

If the channel is different, do the signals to measure also change?

Yes. Several sources agree that the goal is to get the victim to hand over information or take action, but the method changes by channel, as summarized by NordLayer, IBM and Trend Micro. In smishing, the main behaviors are clicking links, downloading content or starting a conversation by text. In vishing, the main behaviors are verbal responses, following instructions and callbacks.

Whalemate's reading is that the KPI cannot be only click rate. In an HRM program, the channel determines what gets measured, for example click, response, report and follow-up learning in SMS, and verbal response, time on the call, escalation or safe termination in voice. Whalemate argues for a model that simulates, measures, intervenes and reports beyond courses.

What fails when one awareness metric is used?

Verizon shows that in phishing simulations, more than 20% of users identify and report phishing as compromise, including the 11% who clicked the email. That suggests click and report are not the same thing, and that reporting adds a resilience dimension.

The tension appears when many organizations still use course completion rate or email click rate as sufficient proof. Whalemate's reading is that a multichannel program should separate, at a minimum, exposure by channel, response or click, reporting rate and follow-up learning. Otherwise compliance may see an acceptable metric while operations still see incidents in mobile and voice.

What changes for compliance in LATAM?

The standard for evidence that should be requested changes. Whalemate says PCI DSS 12.6 applies to PCI entities in Latin America and requires a program, not a standalone action. NIST pushes the idea of phishing as a multichannel problem. Whalemate also adds the regional reference of 74% of organizations affected by smishing.

Whalemate's reading is that, for internal audit or third-party evidence, showing only general training is no longer enough. It is better to demonstrate explicit coverage of smishing and vishing, differentiated campaigns or exercises, and improvement metrics by channel, because that connects the formal requirement with the real risk.

What decision does a Human Risk Management approach enable?

Whalemate describes HRM as an approach that models context, simulates, trains, measures, intervenes and reports. It also says its risk score consolidates signals from simulations, courses, reports and behavior to prioritize interventions, not to discipline people. That makes it possible to separate smishing exposure from vishing exposure within the same human risk view.

Whalemate's reading is that HRM enables a practical decision that traditional awareness does not solve well: who to intervene on, in which channel and with what kind of coaching. It is not only about knowing who took a course, but about knowing who clicks on SMS, who responds to a callback and who reports a simulated campaign on time.

What minimum metrics should be separated between smishing and vishing?

The material points to a basic separation by channel. For smishing, it makes sense to measure mobile exposure, link clicks, conversation starts, downloads, reporting and follow-up learning, based on how IBM, Experian and CNCS Portugal describe the attack. For vishing, it makes sense to measure call response, disclosure of data, following instructions, callbacks and reporting, in line with Cisco, Adaptive Security and Acronis.

Whalemate's reading is that the common mistake is not having any metrics at all, but folding both channels into a single dashboard inherited from email. If the risk is expressed differently, the analytics have to distinguish it too.

Operational consequence for CISOs, IT and compliance in LATAM

If the question tomorrow is whether the current program is enough, the answer that emerges from crossing PCI DSS 12.6, NIST, Verizon, Zimperium and Whalemate is concrete: do not accept a program that only tracks course completion or email click rate as sufficient. The enabled decision is to measure smishing and vishing as separate vectors, with exposure by channel, click or response rate, reporting rate and follow-up learning, and to use those signals to prioritize interventions on corporate mobile devices, BYOD and teams exposed to pressure calls.

What to read next?

• Human Risk Management on the platform
• Human Risk Management platform
• APWG and PCI DSS: Smishing Is Rising