> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.autophish.io/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Run an SMS Phishing (Smishing) Simulation

Attackers increasingly use text messages – fake parcel notifications, bank alerts or "your manager needs this signed". With an SMS campaign, AutoPhish sends realistic simulated text messages to your staff and shows you how many people interacted, how many reported the message and how your organisation improves over time.

## Before you start

- **SMS must be included in your plan.** If the SMS option is greyed out in the campaign wizard, your plan does not include SMS – you will see an upgrade link there.
- **Recipients need a phone number.** Add mobile numbers to your target list in E.164 format, e.g. `+436641234567` (see "Create and Manage Target Lists (incl. CSV Import)"). Supported are numbers from the EU, UK, US, Argentina, Brazil, Chile, Colombia and Uruguay. People without a valid number are skipped.
- **Credits:** Each SMS segment costs 2 credits (an e-mail costs 1). See "How Credits Work – Costs, Balance and Buying More" for details.

## Step 1 – Choose SMS as delivery channel

1. Click **+ New Campaign** in the header.
2. Enter a **Campaign Name**.
3. Under **Delivery channel**, select **SMS** (Smishing (text message) simulation).
4. Set the **Tone**, the **Test Interval** and select a **target list** that contains phone numbers, then click **Next**.

![Choose SMS as delivery channel](https://storage.crisp.chat/users/helpdesk/website/-/4/3/7/4/437439cedb096800/sms-delivery-channel_6cow3e.png)

Note: The delivery channel cannot be changed after the campaign has been created.

## Step 2 – Select a scenario

Choose one or more SMS scenarios, for example a parcel service, a bank, an IT ticket or an approval request from a manager. Scenarios can imitate an external sender or an internal one. Click **Next**.

## Step 3 – Generate the SMS

Click **Generate New SMS**. AutoPhish creates two things you can review and edit:

- **Sender ID** – the name shown as sender, up to 11 letters or digits.
- **Message** – the text. It must contain the placeholder `[link]` where the simulated link should appear.

Below the message you see how many characters and SMS segments the text uses and how many credits each recipient will cost.

![SMS preview with segment and credit information](https://storage.crisp.chat/users/helpdesk/website/-/4/3/7/4/437439cedb096800/sms-message-preview_1ejafdk.png)

### Keep an eye on segments

- One segment holds 160 standard characters (153 per part for longer messages).
- Special characters such as emojis or typographic quotes switch the SMS to Unicode, where a segment holds only 70 characters. That can double the cost. Use **Optimize punctuation** to replace them.
- The segment count turns yellow at 2 segments and red from 3. Short messages are cheaper and more realistic.

## Step 4 – Login page and training

- **Login Page:** Choose what people see when they tap the link – the same landing pages as for e-mail simulations.
- **Training (optional):** Decide whether people who interact get a short learning unit. See "Microtraining and Training after a Simulation".

## Step 5 – Review & launch

Check the summary and the credit estimate, then click **Save Campaign** (keep as draft) or **Save and Start Campaign**.

## What gets tracked

| Metric | Tracked for SMS |
| ---- | ---- |
| Sent / delivered | Yes |
| Link clicks | Yes |
| Login attempts (data entered) | Yes |
| Opens | No – SMS has no read receipts |

In **Phishing → Reports** you can filter by channel (All channels, Email, SMS, Quishing). The execution details show how many SMS segments were billed.

## Good to know

- Credits are only charged for successfully delivered messages. Failed or expired deliveries are refunded.
- A message that expires without being delivered is resent once automatically.
- Tone 1–2 uses the formal form of address (e.g. "Sie" in German), tone 3–5 the informal one.
- Let your staff know how to report suspicious text messages internally – reporting is the behaviour you want to strengthen.