The State of the Smish Report 2023
Get the key SMS phishing statistics in one short brief, ready to support the case for smishing training.
Archive edition. Data from 2023. Kept for reference. See the latest
What the data shows
- Less than 35%of those surveyed are familiar with smishing, according to Safety Detectives.Page 3, in the full report
- $86 millionwas lost by American consumers to smishing scams in 2020, according to Safety Detectives.Page 3, in the full report
- 328%rise in mobile phishing messages in Q3 2020 compared with Q2 2020, as quoted under the Robokiller report.Page 4, in the full report
- 84%of organisations were subject to mobile-based phishing attacks, as quoted under the Robokiller report.Page 4, in the full report
- 32%of organisations offer vishing or smishing training to their employees, as quoted under the Robokiller report.Page 4, in the full report
- 66%of respondents to the Verizon Mobile Security Index felt pressure to sacrifice mobile security to get the job done.Page 5, in the full report
Start reading
- 1 / 6
- 2 / 6
Read the other 4 pages
They open right here. You can also download the PDF.
Tap a page to read it full size.
What the report covers
- The State of the Smish
- Latest statistics on smishing (Safety Detectives)
- The Robokiller phone scam report
- Verizon Mobile Security Index
Who it is for
Awareness managers who need sourced SMS phishing statistics to support adding smishing simulations to their programme.
How the data was collected
- Sample
- No primary sample. The report compiles published third-party statistics.
- Period
- Statistics dated 2019 to 2022
- Source
- Safety Detectives; the Robokiller phone scam report; Verizon Mobile Security Index
- Note
- No per-statistic citations, publication years or links are given.
Cite this report
Keepnet (2023). The State of the Smish Report 2023. https://keepnetlabs.com/reports/2023-the-state-of-the-smish-report
Figures on this page may be quoted with this citation.
Smishing Simulator
Give employees realistic SMS phishing practice, with training straight after a click.
About this report
Smishing is phishing by SMS. The attacker poses as a bank or another trusted organisation to trick the recipient into sharing sensitive information.
The report compiles published figures from Safety Detectives, the Robokiller phone scam report and the Verizon Mobile Security Index. It does not contain new Keepnet survey data.
Only 32% of organisations offer vishing or smishing training to their employees, according to the figures quoted in the report.
Phones are used for both work and personal tasks, so employees can be reached through SMS, social media and messaging apps. Simplified mobile interfaces also hide signs of phishing.
Keep reading
The Mobile Phishing Visibility Gap
~40%higher click rate on phone-based simulations than on email (Verizon DBIR 2026).Read the key findings
Cut Human-Driven Incidents: A CISO Playbook for Measurable Behaviour Change
76% vs 60%Most large firms train employees, yet human factors still sit behind most breaches.Read the key findings
2025 New Hires Phishing Susceptibility Report
44%more susceptible to phishing: new hires in their first 90 days compared with tenured employeesRead the key findings
2024 Voice Phishing (Vishing) Response Report
6.5%of 3,279 employees called shared sensitive information during simulated vishing calls.Read the key findings
2021 Email Security Vulnerability Report
90.56%of checked malicious test emails reached the target inbox past the security tools in place.Read the key findings
MSSP Business Model
$1.3 millionis the payroll an in-house team can reach once it staffs its own 24x7 SOC, according to Cipher.Read the key findings
2020 Phishing Trends Report
50.42%of simulated phishing emails were opened by the target in 2019.Read the key findings
Threat Sharing
206 dayswas the average time to detect a breach, according to IBM's 2019 Cost of a Data Breach Report.Read the key findings
See how Keepnet would act on these findings for you
- Run multi-channel simulationsFrom email through to deepfake.
- See reporting outcomes and the behaviour scoreReporting, repeat behaviour and remediation, in one board report.
- Explore AI agents and automationSee how simulations, training and follow-up can run with less manual work.
Book a 30-minute demo
Thirty minutes, no cost and no obligation.
Thank you, your request is in
A confirmation is on its way to your inbox.
Thirty minutes with the Keepnet team, on Microsoft Teams. Your details are already filled in.
Prefer to pick a time later? The team will follow up within one working day.
Your demo is booked
A calendar invite is on its way to your inbox, with a Microsoft Teams link.
The booking calendar will not open in this page.
Open the calendar in a new tab