The Mobile Phishing Visibility Gap
Find out where SMS and call phishing escapes your reporting, and how employee reports become usable signals.
What the data shows
- 80%of organisations experienced mobile phishing attempts, according to the Verizon Mobile Security Index 2025.See page 2
- ~2%median click rate on phone-centric simulations, against about 1.4% for email (Verizon DBIR 2026).See page 3
- 30% to 40%quarter-over-quarter growth in smishing volume through 2025, recorded by APWG.See page 3
- ~60%of initial access in the EU was attributed to phishing by ENISA Threat Landscape 2025.See page 3
- 54%click-through rate for AI-automated phishing in controlled testing, against 12% for standard attempts (Microsoft, 2025).Page 5, in the full whitepaper
- $40Bprojected US GenAI-enabled fraud losses by 2027, up from $12.3B in 2023 (Deloitte forecast).See page 2
Start reading
- 1 / 11
- 2 / 11
- 3 / 11
- 4 / 11
Read the other 7 pages
They open right here. You can also download the PDF.
Tap a page to read it full size.
What the whitepaper covers
- Executive summary
- The shift beyond email
- The visibility gap
- Why mobile attacks succeed
- The reporting time gap
- From report to response
- Privacy and access
- Conclusion
Who it is for
Security operations and awareness leads who need SMS and call reports to reach the same workflow as reported email.
How the data was collected
- Sample
- No primary sample. The paper draws on published 2025 to 2026 industry data.
- Period
- 2025 to 2026, with forecasts to 2027 and beyond
- Source
- Verizon DBIR 2026; Verizon MSI 2025; APWG Q4 2025; ENISA Threat Landscape 2025; Microsoft Digital Defense Report 2025; FBI IC3 2025; forecasts from Deloitte, Gartner and Juniper Research
- Note
- The reporting-time comparison is an illustrative Keepnet model, not a benchmark. Forecasts depend on their publishers' assumptions.
Cite this whitepaper
Keepnet (2026). The Mobile Phishing Visibility Gap. https://keepnetlabs.com/whitepapers/mobile-phishing-visibility-gap
Figures on this page may be quoted with this citation.
Incident Responder
Turn employee reports, including SMS and calls, into analysed signals your team can act on.
About this whitepaper
Reporting workflows are mature for email but rarely exist for SMS and calls. Security teams often learn of an SMS or call attack only after the incident has progressed.
Mobile means a smaller screen, shorter inspection time and trust in a live voice. A call from an unknown number passes through no filter the security team controls.
Only what the employee chooses to report: the SMS content or caller number, the sender or caller ID and the analysis result. It does not capture call audio, contacts, location or unreported messages.
Yes. Employees and individuals can install it and report at no cost. Seeing and acting on reports centrally needs the Keepnet platform with Incident Responder.
Keep reading
Cut Human-Driven Incidents: A CISO Playbook for Measurable Behaviour Change
76% vs 60%Most large firms train employees, yet human factors still sit behind most breaches.Read the key findings
2025 New Hires Phishing Susceptibility Report
44%more susceptible to phishing: new hires in their first 90 days compared with tenured employeesRead the key findings
2024 Voice Phishing (Vishing) Response Report
6.5%of 3,279 employees called shared sensitive information during simulated vishing calls.Read the key findings
2021 Email Security Vulnerability Report
90.56%of checked malicious test emails reached the target inbox past the security tools in place.Read the key findings
The State of the Smish Report 2023
74%of organisations experienced a smishing attack in 2021, according to Safety Detectives.Read the key findings
MSSP Business Model
$1.3 millionis the payroll an in-house team can reach once it staffs its own 24x7 SOC, according to Cipher.Read the key findings
2020 Phishing Trends Report
50.42%of simulated phishing emails were opened by the target in 2019.Read the key findings
Threat Sharing
206 dayswas the average time to detect a breach, according to IBM's 2019 Cost of a Data Breach Report.Read the key findings
See how Keepnet would act on these findings for you
- Run multi-channel simulationsFrom email through to deepfake.
- See reporting outcomes and the behaviour scoreReporting, repeat behaviour and remediation, in one board report.
- Explore AI agents and automationSee how simulations, training and follow-up can run with less manual work.
Book a 30-minute demo
Thirty minutes, no cost and no obligation.
Thank you, your request is in
A confirmation is on its way to your inbox.
Thirty minutes with the Keepnet team, on Microsoft Teams. Your details are already filled in.
Prefer to pick a time later? The team will follow up within one working day.
Your demo is booked
A calendar invite is on its way to your inbox, with a Microsoft Teams link.
The booking calendar will not open in this page.
Open the calendar in a new tab