RCS phishing simulation
RCS phishing simulation
for messages that look official.
KeenSec sends branded-looking RCS lures to employees’ real numbers, so they learn that polish is not proof.
- Channel
- RCS, delivered to real numbers
- Looks like
- Branded sender, rich cards, action buttons
- Measures
- Button taps, link taps and submissions
- Follow-up
- Just-in-time lesson on the same phone
SMS vs RCS
Same attacker trick,
better costume.
| SMS lure | RCS lure | |
|---|---|---|
| Sender | A short code or number | A sender name and logo |
| Message | Plain text and a link | Rich cards, images and formatted details |
| Call to action | Tap a link | Tap a large, app-style button |
| Why it works | Urgency | Urgency plus the look of an official app |
| Habit to build | Don’t tap unexpected links | Don’t trust the look. |
How it works
Build it, send it,
teach from the tap.
- 01
Design with AI Studio
Choose a lure such as a payment hold, a reward or a delivery update.
- 02
Deliver as RCS
The campaign goes to the phones you select, as a rich business message with cards and buttons.
- 03
Teach at the button
A tap opens a short lesson that explains why the polish didn’t make it real.
- 04
Compare channels
Human Risk Analytics shows RCS results next to SMS, WhatsApp and email for the same people.
Questions buyers ask
Frequently asked questions.
What is RCS phishing?
RCS phishing uses rich business messages, with branding, image cards and buttons, to trick people into tapping a link or sharing details. The rich format makes the message look more official than a plain SMS.
Why simulate RCS separately from SMS?
Because the look is different. People who distrust a plain text with a link may still tap a branded card with a neat button, so the habit needs its own practice.
Should RCS lures use real brand names?
The examples on this page use generic senders such as “Your bank” or “Courier desk”. Your team decides what each message looks like and approves it before it is sent.
Let’s connect the dots
Polished isn’t proof.
Teach people to check.
Bring your awareness program, your reporting workflow, or the question your current metrics cannot answer.
Book a demo