Smishing on mobile: are your controls keeping up?

TL;DR: Smishing succeeds because SMS bypasses the email security stack and lands in highly personal mobile contexts, according to Hoxhunt, so prevention depends on realistic simulations, fast reporting habits, and training that changes employee behaviour rather than relying on perimeter filters. The operational problem is trust at the point of message receipt, not just message hygiene.

Editorial analysis by NHI Mgmt Group, based on content published by Hoxhunt: “How to Prevent Smishing with Smishing Awareness Training & Simulations”.

By the numbers:

• 6% to 19% of simulated phishing attempts fail on desktop versus mobile, nearly 3x, according to Hoxhunt.
• Users are 13 percentage points less likely to report a phish on mobile than desktop, according to Hoxhunt.

Key questions

Q: What fails when employees receive phishing on their phones instead of email?

A: Email controls lose visibility when the lure arrives by SMS, so the first failure is not user judgement alone but the monitoring model.

Q: Why do mobile phishing texts create more account risk than desktop phishing emails?

A: Mobile users tend to act faster, inspect links less carefully, and are more likely to face messages in personal contexts where trust is higher.

Q: What are the signs that smishing awareness is not working?

A: Look for low report volume, slow reporting, repeat clicks on urgent messages, and weak performance on mobile-specific simulations.

Practitioner guidance

• Define mobile reporting as a security control Provide a one-tap path for employees to report suspicious texts from company or personal devices, and make those reports visible to the security team in the same workflow as email phishing reports.
• Run realistic smishing simulations Use SMS scenarios that mirror delivery alerts, bank notices, payroll prompts, and IT requests so employees learn to pause when urgency, links, and sensitive-data requests appear together.
• Train for credential and MFA code protection Explicitly tell employees never to share passwords, banking details, credit card data, or one-time codes by text, and reinforce verification through a trusted channel before any response.

Bottom line: Smishing exploits the gap between mobile trust and enterprise visibility, which is why traditional email-centric controls do not stop it.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →