A legitimate text message and one coming from a cybercriminal are very similar and difficult to distinguish. Therefore, the success rate of a smishing attack is high. As a result, such an attack among employees may not be noticed immediately and its reporting may be delayed or fail altogether. Every employee today has access to one or more phones, making everyone a potential target. Cybercriminals know this well and obviously take advantage of it. It is therefore a common phishing method. What is unique about this method is that it puts the attacker in direct contact with humans. This direct contact provides opportunities that the attackers can make good use of. This allows them to easily apply different social engineering techniques, which they can adjust immediately to get the best results. Thus, they build a bond of trust or, remove suspicion and respond to the victim’s emotion.

During our smishing test, we also use the social engineering techniques mentioned above. That way, we can mimic an authentic attack as much as possible during the test. After all, cybersecurity awareness increases the most when employees encounter tangible examples. A smishing test brings the consequences of smishing very close and makes it very clear how difficult it is to distinguish an authentic text message from a smishing attack. The smishing test will bcontribute to understanding and awareness and get organizations thinking. Key findings from this exercise will lead to action items needed to reduce the impact in the event of a potential incident. The result of a smishing test provides a good basis for taking targeted measures in line with laws and regulations and that match your organization’s pain points. Current AVG laws and regulations require organizations to take appropriate measures to eliminate cyber risks as much as possible.