> For the complete documentation index, see [llms.txt](https://herd-security.gitbook.io/herd-security-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://herd-security.gitbook.io/herd-security-docs/simulations/sms-phishing-smishing-simulations.md). # SMS Phishing (Smishing) Simulations Build, send, and track SMS phishing (smishing) campaigns to test how your team responds to text-message social engineering. ## Overview of Smishing You're ready to start running SMS phishing simulations! Smishing tests how your team responds to social engineering that arrives by text message instead of email: the urgent "verify your account" alerts and fake delivery notices that bypass the inbox entirely. Herd makes it simple to design realistic text messages, send them to the right people, and track exactly who tapped the link and who went on to enter credentials. Smishing campaigns follow the same two-step pattern as email phishing: first you build a **template** (the text message itself), then you launch a **campaign** that sends that template to your chosen recipients. To get there, expand **Simulations** in the sidebar and pick **SMS** (the channels listed are **Email**, **SMS**, and, where enabled, **WhatsApp** and **Voice**). The SMS area is organized into **Campaigns**, **Templates**, **Landing pages**, and **Reports** tabs, and opens on **Campaigns** by default. A **Reviews** tab also appears when SMS template approval is turned on for your organization, or whenever there are templates waiting for review — and only for people who can approve. {% hint style="info" %} **Who can approve SMS templates** comes from the **Smishing > Template > Approve** permission. Admins always hold it, others hold it through a group that's been granted it in **People › Groups**, and members can't approve. There's no approver picker in the simulation settings drawer. See [Who can approve](/herd-security-docs/simulations/phishing-simulations/navigating-phishing-simulations-page.md#who-can-approve). {% endhint %} {% hint style="info" %} SMS delivery supports numbers in the **US, Canada, and other +1 (North American Numbering Plan) territories**, plus **Ukraine (+380)**. Recipients with numbers from other countries are skipped at send time and show as a permanent failure in the campaign results. For international teams, [WhatsApp phishing simulations](/herd-security-docs/simulations/whatsapp-phishing-simulations.md) accept any international number. {% endhint %} {% hint style="info" %} SMS simulations are a plan-gated feature. If you don't see the SMS channel, or it shows a padlock, contact your Herd representative about enabling it for your organization. {% endhint %} {% hint style="info" %} Smishing reuses the same verified sending domains and landing pages as email phishing, so anything you've already set up there is available here too. Phone numbers, however, come from your identity provider. See [Recipients & phone numbers](#searching-and-adding-recipients) below. {% endhint %} *** ## Creating an SMS Template A template defines the message body, the sender number, and an optional landing page. Open the **Templates** tab under SMS and click **Create Template**. When building a new template, you can fill in the following fields: * **Template Name** *(required)*: A clear, descriptive name to identify the template, for example "Bank Account Security Alert." * **From Phone Number**: Choose **Use all phone numbers (recommended)** to spread sends across your organization's full sender pool and automatically fail over if a number is unavailable. Pick a specific number only when you need messages to come from a known sender. Herd only accepts a number from your organization's own sender pool: if a pinned number is later removed from the pool, the picker shows it as **no longer available (uses all phone numbers)** and sends from the whole pool instead; pick another number or **Use all phone numbers** to clear it. Cloning a Herd library template doesn't copy its pinned number. Sender numbers are provisioned per organization by Herd. If none are configured, the template form shows a warning and the campaign form's **Send Campaign** button stays disabled until your administrator or Herd support sets one up. * **Message** *(required)*: The text the recipient receives. The message **must include the `{{link}}` placeholder** so recipients have a trackable link. Herd swaps it for a unique short URL per recipient at send time. * **Description (Optional)**: A brief note explaining the purpose or scenario for the template. * **Landing Page (Optional)**: The page recipients see after tapping the SMS link. Landing pages are shared with email phishing (see [Landing pages](#landing-pages) below). Any credentials submitted are tracked for analytics but never stored. ### Personalizing the message Below the message box, three buttons insert merge variables at your cursor: * **`{{name}}`**: the recipient's full name. * **`{{firstName}}`**: the recipient's first name. * **`{{link}}`**: the trackable short URL (required). ### Character count and segments As you type, Herd shows a live breakdown beneath the message: * **Characters**: the running count against the limit. * **SMS Segments**: how many 160-character segments the message will span. Single-segment messages are flagged green; longer ones turn yellow and then red. Messages over 10 segments can't be saved. * **Encoding**: **GSM-7** for standard text, or **UCS-2** when the message contains Unicode characters (emoji, smart quotes, etc.). Unicode shortens each segment to 70 characters and can hurt deliverability, so Herd warns you when it's detected. Once an existing template is saved, you can use **Preview** to see the message rendered in a phone mockup, **Clone** a built-in (global) template into your own editable copy, **Create Campaign** to jump straight into a campaign using that template, or **Delete** it. A template that's referenced by an active campaign can't be deleted until those campaigns are removed. ### Tagging and filtering templates Every saved template has an inline **Template tags** editor beneath its name; add tags to organize the library by scenario, brand, or difficulty. To tag several templates at once, tick them in the **Templates** table and click **Tag selected**. Once your library has tags, a **Filters** button appears in the table header next to the search box. Open it to narrow the table to one or more tags; the badge on the button shows how many tag filters are active. Your filter selection is remembered when you come back to the page. ### Generating templates with Herd AI You can also ask [Herd AI](/herd-security-docs/herdai/herdai.md) for an SMS template in chat, for example "write me an SMS template about a delayed package." Herd AI drafts the message and shows an **SMS Template Preview** card with the message in a phone bubble and its character and segment counts. Click **Publish** on the card to save it to your SMS template library, then use the **View Template** link that appears to open it. If your organization requires review for SMS templates, the published template waits in the **Reviews** tab until it's approved. *** ## Landing pages Landing pages are one shared pool across email, SMS, and WhatsApp simulations. The **Landing pages** tab under SMS opens that shared library so you can build and manage pages without leaving the SMS channel: click **New landing page** to create one, or open any page to edit, **Clone**, or **Delete** it. The full walkthrough is on the [Landing Pages](/herd-security-docs/simulations/phishing-simulations/landing-pages.md) page. A landing page's detail view lists the **active campaigns using this landing page** across every channel, and a page that's in use by an active SMS, WhatsApp, or email campaign can't be deleted until those campaigns finish or are removed. {% hint style="info" %} Simulation landing pages are served in a locked-down sandbox. Form submissions work as expected, but any scripts in the page HTML are not executed. {% endhint %} *** ## Creating an SMS Campaign A campaign sends a template to a list of recipients. Open the **Campaigns** tab and click **Create Campaign** (or use **Create Campaign** from inside a template). **Step 1: Name the campaign**\ Enter a clear **Campaign Name**, for example "Q1 Security Awareness Test." **Step 2: Choose a template**\ Select the SMS **Template** you want to send. A preview appears immediately, rendering the interpolated message inside a phone mockup so you can see exactly what recipients will receive, along with the **From** number. Only templates that are usable in a campaign are listed; if your organization requires template approval, unapproved templates don't appear until they've been reviewed. **Step 3: Choose a sending domain**\ The **Sending domain** controls the host of the `{{link}}` short URL. Leave it on **Default** to use the platform's host, or pick one of your verified domains. Smishing and email phishing share the same verified-domain pool, so any domain you've already verified for short links is available here. If you haven't verified a domain yet, sends use the platform default. **Step 4: Add a description (optional)**\ Include details to explain the purpose or scenario for the campaign. **Step 5: Search & add recipients**\ Add the users who should receive the simulation under **Target Recipients** (see below). **Step 6: Schedule the campaign (optional)**\ Pick a date and time under **Schedule Campaign (Optional)**, or leave it empty to send as soon as you launch. You can also choose whether the campaign is allowed to send outside business hours. **Step 7: Create the campaign**\ Click **Create Campaign** to save it as a draft. Creating the campaign does not send it; you launch it separately from the campaign's detail page. ### Searching and adding recipients Use the recipient picker to search by name or email and add individual users or groups. A few things to know: {% hint style="warning" %} Smishing requires a phone number on file for each recipient. Phone numbers sync from your **identity provider** (Okta, Azure AD, Google Workspace), **not** from Slack or Teams. Users without a phone number are hidden from the picker. If the list comes back empty or short, configure your identity provider sync to pull in phone numbers, or add one directly to the user record. {% endhint %} If you try to add an individual user who has no phone number, Herd tells you that recipient can't receive SMS and skips them. Users who have replied STOP to a previous simulation are also excluded automatically at send time. Admins and people who can manage users get a daily Slack or Teams digest of new opt-outs, unless you've turned that alert off (see [Opt-out alert](/herd-security-docs/users/users.md#opt-out-alert)), and can re-enroll someone who agrees again from the [Opted out of SMS or WhatsApp](/herd-security-docs/users/users.md#opted-out-of-sms-or-whatsapp) panel on the Directory page. *** ## Previewing the SMS Wherever a template is selected, Herd renders the message in a **phone preview**: an inbound text bubble from an "Unknown sender," with the chosen sender number in the conversation header. This is exactly how the smishing text appears to recipients, arriving cold from an unfamiliar number. Merge variables like `{{name}}` resolve to a sample recipient, and `{{link}}` resolves against the selected sending domain. *** ## Sending the Campaign Open a draft campaign and click **Send Campaign**. The **Launch SMS Campaign** dialog asks you to confirm and shows: * The number of recipients who will receive the message. * An estimated delivery time. * A note that messages are sent gradually with randomized spacing (30 to 40 seconds between each) to ensure reliable delivery and avoid carrier filtering. The **Send Campaign** button stays disabled until the campaign has at least one recipient. Once launched, Herd takes you to the campaign's **Results** tab to start watching delivery and engagement. ### Adding and removing recipients While a campaign is still a **draft**, you can adjust its audience from the **Recipients** tab: * **Add Recipients** opens a modal where you search for additional users and add them in bulk. Recipients already on the campaign, and any users without a phone number, are filtered out automatically. If some additions fail (for example, an invalid number), Herd keeps the modal open and lists which ones to fix so you don't have to reselect everyone. * **Remove** a recipient directly from the list to drop them before sending. * **Define by rule** describes the audience by criteria instead (department, title, risk and more). Herd saves the rule as a group named `Audience: `, adds it to the campaign, and checks it again at launch. If the add is refused (for example, it would pass the daily limit), the group is still saved and you can add it from the search by name. See [Define an audience by rule](/herd-security-docs/simulations/phishing-simulations/create-campaign.md#define-an-audience-by-rule). After a campaign has been sent, the recipient list becomes read-only. *** ## Viewing Results The **Results** tab populates as soon as the first message hits the queue. It combines an analytics dashboard, a delivery-stats summary, and a per-recipient breakdown. The dashboard tracks recipients through these states: * **Queued**: waiting to be sent in the staggered delivery schedule. * **Sent**: handed off to the carrier but not yet clicked. * **Clicked**: the recipient tapped the link in the message. * **Submitted credentials**: the recipient went on to enter credentials on the landing page. Credentials are counted for analytics but never stored. * **Failed (retrying)**: a delivery that failed but is still eligible for another attempt. * **Permanent failure**: a delivery that failed and has exhausted its retry attempts, or was sent to a number in an unsupported country. The delivery-stats summary shows the **Transmission rate**, **Click rate**, **Failure rate**, and how many deliveries are **Retryable**. Click rates settle over the first 24 hours, so early numbers are noted as preliminary. Each link tap also appears in the recipient's activity feed and feeds their risk score like any other simulation failure. ### Retrying failed deliveries If any deliveries fail but are still under the retry limit, a **Retry Failed** button appears with the count of retryable messages. Retrying **re-personalizes each message from scratch**: Herd re-substitutes `{{name}}`, `{{firstName}}`, and `{{link}}` and mints a fresh tracking URL for each recipient rather than re-sending a raw template. Deliveries that have hit the maximum number of attempts are marked as permanent failures and excluded from future retries. ### Re-smishing a campaign Once a campaign has been **sent**, a **Re-smish** button lets you spin up a brand-new campaign targeting the same recipients with the same template, which is handy for measuring improvement over time. Give the new campaign a name in the **Re-smish Campaign** dialog, check its **Sending domain** (it starts on the original campaign's domain; pick another to change it) and click **Create Re-smish**; Herd creates it as a fresh draft. Until that draft is sent you can still change its sending domain on the campaign page. If the original domain is no longer available for SMS, you have to pick another before **Create Re-smish** is enabled, and a saved campaign shows it as "(no longer available for SMS)". ### Organization-wide reporting For the roll-up across all your SMS campaigns (**Total Campaigns**, **Messages Sent**, **Delivery Rate**, and **Click Rate**), open the **Reports** tab. *** You're all set to run smishing simulations. Pair them with [email](/herd-security-docs/simulations/phishing-simulations.md), [WhatsApp](/herd-security-docs/simulations/whatsapp-phishing-simulations.md), and [voice](/herd-security-docs/simulations/voice-simulations.md) campaigns to give your team well-rounded practice spotting social engineering across every channel.