Topic starter
24/10/2026 8:52 pm
TL;DR: Smishing reaches users through SMS and personal mobile contexts, Hoxhunt says, so traditional email-centric controls miss the point. Mobile reporting and simulation need channel-specific metrics if teams want to spot account risk before clicks or credential capture spread.
Editorial analysis by NHI Mgmt Group, based on content published by Hoxhunt: “How to Prevent Smishing with Smishing Awareness Training & Simulations”.
By the numbers:
- 6% to 19% of simulated phishing attempts fail on desktop versus mobile, nearly 3x, according to Hoxhunt.
- Users are 13 percentage points less likely to report a phish on mobile than desktop, according to Hoxhunt.
Key questions
Q: Why do mobile phishing texts create more account risk than desktop phishing emails?
A: Mobile users tend to act faster, inspect links less carefully, and are more likely to face messages in personal contexts where trust is higher.
Q: What are the signs that smishing awareness is not working?
A: Look for low report volume, slow reporting, repeat clicks on urgent messages, and weak performance on mobile-specific simulations.
Q: What fails when employees receive phishing on their phones instead of email?
A: Email controls lose visibility when the lure arrives by SMS, so the first failure is not user judgement alone but the monitoring model.
Practitioner guidance
- Define mobile reporting as a security control Provide a one-tap path for employees to report suspicious texts from company or personal devices, and make those reports visible to the security team in the same workflow as email phishing reports.
- Run realistic smishing simulations Use SMS scenarios that mirror delivery alerts, bank notices, payroll prompts, and IT requests so employees learn to pause when urgency, links, and sensitive-data requests appear together.
- Train for credential and MFA code protection Explicitly tell employees never to share passwords, banking details, credit card data, or one-time codes by text, and reinforce verification through a trusted channel before any response.
Bottom line: Smishing exploits the gap between mobile trust and enterprise visibility, which is why traditional email-centric controls do not stop it.
Glossary terms: Smishing, BYOD, Time-to-Report, MFA Code Harvesting
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:11 am
Smishing is an identity compromise problem disguised as a messaging problem. The control failure is not only user curiosity, but the fact that SMS can sit outside the organisation’s monitored and governed access channels. Once a text can elicit credentials or MFA codes, the identity boundary has already been weakened. Practitioners should treat mobile message trust as part of identity governance, not an awareness side topic.
A question worth separating out:
Q: Should organisations prioritise simulation and reporting over blocking every SMS lure?
A: Yes, when the organisation cannot fully control the handset or the message channel. Blocking every lure is unrealistic in BYOD and remote-work environments, but fast reporting, user verification habits, and credential hygiene can still reduce the chance that a single text becomes account compromise.
👉 Read our full editorial: Smishing prevention depends on mobile-first human reporting
This post was modified 6 days ago by NHI Mgmt Group