arXiv: Who Falls for SMiSh? Learning Through Survey Data Where to Best Target Awareness Training for Mobile Messaging Attacks

This paper, published on arXiv in August 2026, is not a regulatory change but a research study on SMiShing (SMS phishing) susceptibility. It uses survey data to identify demographic and behavioral factors that make individuals more likely to fall for mobile messaging attacks. The key finding is that awareness training is not one-size-fits-all; targeted interventions based on user profiles are significantly more effective than generic campaigns.

For compliance professionals, the relevance lies in the evolving threat landscape under frameworks like NIS2 and GDPR, where human error remains a top risk. While this is not a binding regulation, it signals that supervisory authorities and auditors will increasingly expect risk-based, data-driven security awareness programs. Organizations in finance, healthcare, and critical infrastructure—where mobile messaging is common for customer and staff communication—are most affected.

Compliance teams should treat this as a leading indicator. Next steps include reviewing current awareness training to see if it segments users by risk factors (e.g., age, tech literacy, past incident history). If not, begin piloting targeted modules for high-risk groups. Also, document this research in your risk assessment to show proactive adaptation to emerging threats, which will strengthen your audit trail and demonstrate due diligence under existing security obligations.