Join our Newsletter — 33% off our NHI Course

What are the signs that smishing awareness is not working?

Look for low report volume, slow reporting, repeat clicks on urgent messages, and weak performance on mobile-specific simulations. If desktop metrics improve while mobile behaviour stays flat, the programme is measuring the wrong channel and leaving the real attack surface untouched.

What smishing awareness fails to change in practice

When a smishing programme is working, people do not just recognise suspicious texts, they change what they do next. That means reporting sooner, hesitating on urgent requests, and carrying the same judgement into the mobile channel that they already use on desktop. If those behaviours do not move, the awareness effort is not reaching the real risk path.

Two common failure patterns are worth separating. One is channel blindness, where training improves desktop behaviour but leaves mobile habits untouched. The other is false confidence, where people can answer quiz questions yet still click or reply under time pressure. Smishing succeeds because it compresses attention and pushes action onto a small screen, so a programme that only measures knowledge scores will miss the operational weakness.

That is why the best evidence is behavioural, not just educational. A useful smishing programme should change the time to report, the rate of self-reported suspicious messages, and the number of repeat interactions with urgent texts. It should also show that staff treat mobile prompts, QR codes, and sender spoofing as live threats, not just as theory. For a broader baseline on vishing and smishing scenarios, see the Vishing and Smishing Guide.

Signals that the programme is measuring the wrong thing

Low report volume is often the first warning sign, but it only matters when combined with context. If the organisation keeps sending simulations and awareness content, yet very few users report suspicious texts, the message may be too generic, the reporting path may be unclear, or the staff may not believe mobile messages are part of the exercise. A healthy programme creates visible friction against the attacker, not just awareness content in the background.

Slow reporting is another strong indicator. If users eventually recognise the scam but wait too long to notify security, the organisation loses the chance to warn others, block follow-on messages, or intercept credential theft while the attack is still in flight. Repeat clicks on urgent or time-sensitive texts suggest the real issue is not memory of the training, but decision-making under pressure.

Weak performance on mobile-specific simulations is especially important because it shows whether the programme covers the actual attack surface. If desktop phishing awareness improves while mobile behaviour stays flat, the training may be anchored in email habits, not in SMS, messaging apps, or device-level attention patterns. That gap means the programme is likely rewarding the easiest channel to test rather than the channel the attacker prefers. A practical benchmark for this kind of mobile-specific risk is Twilio 0ktapus breach 2022, which shows how SMS phishing can be used to harvest real credentials at scale.

Why mobile smishing outcomes often stay flat

Mobile attacks work because they collapse context. Users see a short message, often with urgency, authority, or a delivery-related pretext, and they respond before they can verify the sender on a larger screen. If awareness content does not reflect that short-form, high-pressure environment, the user may still know the “right answer” but fail to execute it in the moment.

Another common problem is that organisations overestimate the value of recall and underestimate the value of recognition. If the training asks people to remember rules, but the attack arrives as a plausible, ordinary-looking text, the test becomes one of pattern recognition and reflexes. Smishing awareness works only when it changes the default response: pause, verify, and report before acting.

Mobile-specific simulation results are also useful because they expose where controls and culture diverge. If staff are cautious in email but permissive in SMS, the organisation has created a split trust model that attackers can exploit. In practice, the warning sign is not simply that someone clicked, but that the same person keeps failing on the same category of mobile lure after training cycles have supposedly completed.

Practitioner Guidance

What to prioritise: Track behaviour on the mobile channel separately from email. If your metrics do not distinguish SMS, messaging apps, QR-triggered flows, and desktop phishing, you cannot tell whether the awareness programme is changing the attack path that matters.

What to verify: Check whether users know how to report suspicious texts quickly, whether reporting is easy on a phone, and whether your simulation results show improvement in both hesitation and escalation, not just quiz scores or desktop click rates.

Decision rule: If mobile performance is flat while desktop results improve, treat the programme as incomplete rather than successful. Refresh the scenarios, the reporting path, and the user guidance around urgent mobile requests before assuming the workforce has become resilient.

Practitioner takeaway: Smishing awareness is working only when it changes the behaviour that matters under mobile time pressure, not when it merely improves recognition in a classroom or on a desktop simulation.