Our new and improved Smishing experience is now available for DACH customers. If you're seeing a different interface, check Create a Smishing Simulation.
An SMS phishing (smishing) simulation sends realistic text messages to your users' work phones to test how they react to a suspicious SMS. If a user taps the link in a message, they land on a short learning page, and the click is recorded in Analytics. This article walks you through setting up a smishing simulation in the SoSafe Manager.
Before you start
You can only send SMS to users whose phone number is stored in their user data. Users without a number are skipped. There are a few ways to get numbers into the SoSafe Manager:
- If you manage users with manual uploads, upload an updated Excel file that includes the phone numbers.
- Edit individual users directly in the SoSafe Manager. This takes more effort per user, but it works well for a small test run.
- If you provision users through your HRIS, phone numbers can be synced from there.
Only add work phone numbers. Smishing simulations are meant for work mobile numbers only. SoSafe takes no responsibility for private phone numbers uploaded by the customer. You are responsible for making sure that every phone number you provide is used in compliance with applicable laws and requirements.
Create a smishing simulation
The setup is a five-step wizard: Channel, Audience, Timeframe, Templates, and Reporting method, followed by a summary. Use Continue and Back to move between steps. Leave exits the wizard.
- In the SoSafe Manager, go to Simulations > Simulation Manager.
- Open the Smishing tab and select Create new simulation.
1. Channel
The wizard opens on the Channel step. Because you started from the Smishing tab, SMS Simulation is already preselected, so you can select Continue right away. The other option, Email Simulation, would create a regular phishing simulation.
2. Audience
Choose who receives the simulation:
- All users (recommended) sends to every user who has a work phone number. Users without one are skipped. The Eligible badge shows how many of your users that currently covers. Select Add phone numbers to go to User management and add missing numbers.
- Target specific groups lets you select teams, departments, or high-risk groups. It works the same way as the user selection in email phishing simulations.
3. Timeframe
Set the First message sent and Last message sent dates. Both are prefilled. The start date is two weeks from today, which gives you time to tell your users about the campaign. The default length is one year.
Messages go out gradually from the first date, not all at once. No message is sent after the last date.
Below the dates, the wizard shows the length of your campaign and how many templates it recommends for that length, for example 12 months and 12 templates recommended.
4. Templates
Select Add 12 more templates (the number depends on your timeframe). The Template library opens. Each template card shows the sender, the category, and the message text. You can search for a template or filter by category, such as Package delivery, Bank, or Tax refund. Select the checkbox on each template you want to include.
To look at a template more closely, select the eye icon and See more on its card. The Smishing template preview shows:
- the languages the template is available in, which you can switch between,
- the attack type, such as Authority or Pressure / anxiety, and
- a Send yourself a test field. Enter your own phone number and select Send test message to receive the SMS on your phone and see exactly how it looks.
Each user receives the template in the language stored in their user data. If a template isn't available in that language, SoSafe uses your company's default language, and English as a last resort.
When you've chosen all your templates, select Apply. The library closes and your templates are listed on the page. Use the eye icon to preview a template again, the X to remove it, or Add from library to add more.
How often do users get a message?
Every template you select is sent once to each user over the course of the campaign. The number of templates therefore sets the cadence. We recommend one template per month, which means 12 templates for a one-year campaign. If you add more templates than recommended, your users receive more than one SMS per month. With fewer templates, they receive fewer.
5. Reporting method
Decide how much detail you want in Analytics:
- Individual shows how each user interacted with the simulated SMS.
- User group based (recommended) limits the data to the user group level. You still see where awareness gaps are, but you can't identify individual users.
This setting has data privacy implications, and you can't change it once the simulation has started. You can choose a different reporting method for future simulations.
6. Summary
The Smishing summary shows all your settings. Give the simulation a name (it defaults to "Simulation" plus today's date) and check the completed steps. To change one, select the pencil icon next to it. When everything looks right, select Done.
After you create the simulation
There's no confirmation screen. You're taken back to the Smishing tab, where the new simulation is listed under Scheduled with the status Starts soon.
To change the simulation before it starts, open the menu with the three vertical dots on its card and select Edit. The same menu lets you view more details or deactivate the simulation.
What your users see
Each SMS contains a link. A user who taps it lands on a short learning page that explains the message was a simulation, with a link to the matching e-learning lesson. The click is recorded in Analytics under click rate.