Smishing Statistics 2026: Latest Trends and Numbers in SMS Phishing
Explore 2026 smishing statistics backed by Verizon DBIR simulation medians (p. 50), APWG volume tracking and regional data, with what each number means for your program.
Ozan Ucar, Founder and CEO of Keepnet
Last Updated: 2026-08-28
'%3e%3cpath%20d='M4%204L15.733%2020H20L8.267%204H4Z'%20stroke='%230671C0'%20stroke-width='2'%20stroke-linecap='round'%20stroke-linejoin='round'/%3e%3cpath%20d='M4%2020L10.768%2013.232M13.228%2010.772L20%204'%20stroke='%230671C0'%20stroke-width='2'%20stroke-linecap='round'%20stroke-linejoin='round'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_8149_16006'%3e%3crect%20width='24'%20height='24'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
'%3e%3cpath%20d='M5.37214%2023.8745H0.396429V8.10162H5.37214V23.8745ZM2.88161%205.95006C1.29054%205.95006%200%204.65279%200%203.08658C1.13882e-08%202.33427%200.303597%201.61278%200.844003%201.08082C1.38441%200.548853%202.11736%200.25%202.88161%200.25C3.64586%200.25%204.3788%200.548853%204.91921%201.08082C5.45962%201.61278%205.76321%202.33427%205.76321%203.08658C5.76321%204.65279%204.47214%205.95006%202.88161%205.95006ZM23.9946%2023.8745H19.0296V16.1963C19.0296%2014.3665%2018.9921%2012.0198%2016.4427%2012.0198C13.8557%2012.0198%2013.4593%2014.0079%2013.4593%2016.0645V23.8745H8.48893V8.10162H13.2611V10.2532H13.3307C13.995%209.01393%2015.6177%207.70611%2018.0386%207.70611C23.0743%207.70611%2024%2010.9704%2024%2015.2102V23.8745H23.9946Z'%20fill='%230671C0'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3867_24588'%3e%3crect%20width='24'%20height='27'%20fill='%234A4D53'%20transform='translate(0%200.25)'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
'%3e%3cpath%20d='M13.957%2014.75L14.668%2010.0848H10.2225V7.05745C10.2225%205.78115%2010.8435%204.53707%2012.8345%204.53707H14.8555V0.565174C14.8555%200.565174%2013.0215%200.25%2011.268%200.25C7.60703%200.25%205.21403%202.48441%205.21403%206.52931V10.0848H1.14453V14.75H5.21403V26.0278H10.2225V14.75H13.957Z'%20fill='%230671C0'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3867_24590'%3e%3crect%20width='16'%20height='25.7778'%20fill='%234A4D53'%20transform='translate(0%200.25)'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Smishing (SMS phishing) delivers malicious links and urgency via text. APWG Q4 2025 cites smishing volume growth of 30-40% quarter-over-quarter (Crane Authentication contributor). DBIR 2026 phone-centric simulations median ~2% click versus ~1.4% for email.
Keepnet's Extended Human Risk Management Platform (xHRM) pairs multi-channel simulations with Secure Behavior Management (SBM) outcomes: reporting speed and repeat-failure cohorts, not completion exports alone.
Source: Gartner, "6 Ways to Transform Your Cybersecurity Awareness Program" (G00840741, March 2026), based on the 2025 Secure Behavior Strategies Survey (n=65).
Executive summary: smishing statistics 2026
- Smishing volume growth: 30-40% QoQ (APWG Q4 2025)
- Phone/SMS sim median click: ~2% (DBIR 2026, p. 50)
- Email sim median click: ~1.4% (DBIR 2026, p. 50)
- EU initial access via phishing (incl. vishing/malspam): ~60% (ENISA ETL 2025)
Smishing statistics at a glance
| Metric | Value | Source |
|---|---|---|
| Smishing volume growth | 30-40% QoQ | APWG Q4 2025 |
| Phone sim median click | ~2% | Verizon DBIR 2026 |
| Email sim median click | ~1.4% | Verizon DBIR 2026 |
| Global phishing sites (2025) | ~3.8 million | APWG Q4 2025 |
| Leaders prioritize phishing reporting | 73% | Gartner G00840741, n=65 |
Smishing statistics at a glance (2026)
Why this matters
Vendor click-rate claims for SMS vary widely and rarely publish a method, so they are hard to compare year over year. The figures above come from APWG volume tracking and Verizon DBIR simulation medians, which do publish theirs.
What security leaders should do
Ask for the primary source behind any SMS click rate you are quoted. Run smishing simulations alongside your email program and compare your phone channel result to the DBIR median.
Smishing vs vishing statistics
Smishing is asynchronous (text + link); vishing is synchronous (live call or callback). DBIR 2026 splits phishing (16% initial access) from pretexting (6%). See vishing statistics 2026 for voice-specific reference numbers.
Smishing growth and phishing volume context
APWG recorded ~3.8 million phishing attacks in calendar 2025 (+1% YoY). Smishing grew faster than headline volume , channel mix shifted. Full volume context: phishing statistics 2026. APWG index: apwg.org/trendreports.
Why this matters
73% of security leaders prioritize phishing reporting metrics (Gartner, n=65) while many SAT programs still test email only.
What security leaders should do
Add SMS templates to quarterly sims; measure reporting rate separately from click rate.
Sources
Related reading
SMS risk should sit in the same program as email, not a separate tool. KnowBe4 alternatives (2026) covers multi-channel options.
Most SMS attempts never reach a security team because there is no reporting path on the phone. Our whitepaper The Mobile Phishing Visibility Gap sets out where that visibility is lost and what closes it.
Numbers like these only exist because people report what reaches them. If a suspicious text lands on your phone, reporting it takes one tap and it also helps the next person who receives the same message.
SHARE ON