Smishing Statistics 2026: Latest Trends and Numbers in SMS Phishing
Explore 2026 smishing statistics backed by Verizon DBIR simulation medians (p. 50), APWG volume tracking and regional data, with what each number means for your program.
On this page 6 sections
Smishing (SMS phishing) delivers malicious links and urgency via text. APWG Q4 2025 cites smishing volume growth of 30-40% quarter-over-quarter (Crane Authentication contributor). DBIR 2026 phone-centric simulations median ~2% click versus ~1.4% for email.
Keepnet's secure behaviour management platform pairs multi-channel simulations with Secure Behavior Management (SBM) outcomes: reporting speed and repeat-failure cohorts, not completion exports alone.[4]
Executive summary: smishing statistics 2026
- Smishing volume growth: 30-40% QoQ (APWG Q4 2025)
- Phone/SMS sim median click: ~2% (DBIR 2026, p. 50)
- Email sim median click: ~1.4% (DBIR 2026, p. 50)
- EU initial access via phishing (incl. vishing/malspam): ~60% (ENISA ETL 2025)
Smishing statistics at a glance
| Metric | Value | Source |
|---|---|---|
| Smishing volume growth | 30-40% QoQ | APWG Q4 2025 |
| Phone sim median click | ~2% | Verizon DBIR 2026 |
| Email sim median click | ~1.4% | Verizon DBIR 2026 |
| Global phishing sites (2025) | ~3.8 million | APWG Q4 2025 |
| Leaders prioritize phishing reporting | 73% | Gartner G00840741, n=65 |
Why this matters
Vendor click-rate claims for SMS vary widely and rarely publish a method, so they are hard to compare year over year. The figures above come from APWG volume tracking and Verizon DBIR simulation medians, which do publish theirs.
What security leaders should do
Ask for the primary source behind any SMS click rate you are quoted. Run smishing simulations alongside your email program and compare your phone channel result to the DBIR median.
Smishing vs vishing statistics
Smishing is asynchronous (text + link); vishing is synchronous (live call or callback). DBIR 2026 splits phishing (16% initial access) from pretexting (6%). See vishing statistics 2026 for voice-specific reference numbers.
Smishing growth in 2025
APWG recorded ~3.8 million phishing attacks in calendar 2025 (+1% YoY). Smishing grew faster than headline volume , channel mix shifted. Full volume context: phishing statistics 2026. APWG index: apwg.org/trendreports.
Why this matters
73% of security leaders prioritize phishing reporting metrics (Gartner, n=65) while many SAT programs still test email only.
What security leaders should do
Add SMS templates to quarterly sims; measure reporting rate separately from click rate.
Related reading
SMS risk should sit in the same program as email, not a separate tool. KnowBe4 alternatives (2026) covers multi-channel options.
Most SMS attempts never reach a security team because there is no reporting path on the phone. Our whitepaper The Mobile Phishing Visibility Gap sets out where that visibility is lost and what closes it.
Numbers like these only exist because people report what reaches them. If a suspicious text lands on your phone, reporting it takes one tap and it also helps the next person who receives the same message.
Sources
- APWG Q4 2025 PDF (PDF, opens in a new tab)
- Verizon 2026 DBIR summary
- ENISA Threat Landscape 2025
- Gartner, "6 Ways to Transform Your Cybersecurity Awareness Program" (G00840741, March 2026), based on the 2025 Secure Behavior Strategies Survey (n=65). ↩
Frequently asked questions
Smishing is phishing via SMS/text message , malicious links or urgency delivered to mobile devices.
APWG Q4 2025 cites smishing volume growth of 30-40% quarter-over-quarter.
DBIR 2026: phone-centric sim median ~2% vs email ~1.4% (p. 50).
Smishing = SMS/text. Vishing = voice/callback. DBIR splits async phishing (16% IA) from pretexting (6%).
From simulations Keepnet runs across its customer base. That data was contributed to the 2026 Verizon Data Breach Investigations Report, where Keepnet appears among the contributing organizations on page 118.
Schedule your 30-minute demo now
You'll learn how to:
- Initiate SMS phishing simulations swiftly to elevate your team's defense against Smishing risks.
- Engage your staff with practical SMS phishing scenarios to sharpen their alertness and readiness.
- Generate tailored reports detailing your employees' missteps, identifying precise opportunities for enhancing cybersecurity measures.
30 minutes with a Keepnet specialist, on your own use cases.
Author
Ozan Ucar
Founder and CEO, Keepnet
Ozan founded Keepnet in 2017 and has worked in cyber security since 2006. He leads Keepnet's product direction and works with security teams on measuring and changing the behaviours behind incidents.