Jerome All work

Prototype · Upfort · 2026

A smishing simulation that runs through a companion app

Realistic SMS phishing drills normally depend on spoofing carriers. This prototype delivers the simulated text through a companion mobile app instead, coaches the employee the moment they click, and gives the consultant an anonymized view by department.

Head of Product Built with AI coding agents · Internal build-off Interactive walkthrough
9:41 92%
9:41
Friday, May 8
Calendarnow
Dispatch standup in 15 min
Bay 4 conference room
Messages · (737) 414-2280now
FedEx Customs Hold
Shipment #AWB-7244-9981 held at Houston port. Confirm consignee: fedx-portcheck.co/hold
Slack2m ago
@dispatch-room
Marcus: did the 4pm pickup get reassigned?
Tap the FedEx notification to continue →
9:4192%
‹
?
Unknown sender
(737) 414-2280
Today 9:41 AM
FedEx Customs Hold
Shipment #AWB-7244-9981 is on hold at Port of Houston pending consignee confirmation.

Re-confirm now to release within 2hr SLA window:
fedx-portcheck.co/hold
Note: Failure to confirm in 2hr will incur a $185/day demurrage fee per container.
Tap the link to continue the simulation →
9:4292%
FedEx Customs Portal
⚠ Not Secure · fedx-portcheck.co/hold

Confirm consignee identity

Shipment AWB-7244-9981 · Port of Houston
⚠ This shipment will be auto-returned in 1hr 58min if not confirmed.
Powered by FedEx · By submitting you agree to our Terms of Service and Privacy Policy
9:4292%
Upfort
Shield
⏵

Phishing test caught.

Nothing was submitted. Your password didn't leave this device. Take 30 seconds. Here's what to spot next time.

4
Tells found
Last updated 9:42 AM
What gave it away
Four red flags in this smish
1
Sender was a regular phone number FedEx sends shipment alerts from a 5-digit shortcode (28777), not a 10-digit cell.
2
The URL was a lookalike fedx-portcheck.co is missing an "e" and sits on an unusual .co domain. The real portal lives on fedex.com.
3
Manufactured urgency + fee threat "$185/day in 2 hours" is the engineered panic that makes people skip verification.
4
It asked for credentials Legitimate port-side flows never ask for your company password to release a shipment.
Recommended next 3-min "Spotting smishing" training module
9:4392%
Upfort
Shield
A

Hello, Alexis

Acme Logistics · Wave 3 results · anonymized

42%
Click rate
▼ 18 pts vs Wave 1 · 247 employees
Credential submit
11%
▼ 14 pts vs W1
Reported as phish
28%
▲ 22 pts vs W1
By department
Click rate this wave
Dispatch
64%
Cust. service
51%
AP / billing
38%
Ops leadership
18%
Coaching status
Wave 3 follow-up
228
Completed debrief
/ 247
19
Auto-enrolled in module
$35/seat
May 22
Wave 4 retest scheduled
+14d
What Alexis presents to leadership: Click rate dropped 18 pts since Wave 1, but Dispatch is still the high-risk segment. Recommend the targeted module ($35/seat) before Wave 4.

Step 1 of 5. Lock screen: the smish arrives

The problem

Realistic SMS-style phishing drills normally depend on spoofing carriers, which is why most simulations stay in email.

The idea

Deliver the simulated smish through a companion mobile app so it lands on the lock screen like a real text. Then coach immediately: no blame, four concrete tells, one short module.

What the consultant gets

An anonymized dashboard by department: click rate, credential submissions, report rate, coaching completion, and the next retest, ready to present to leadership.