The Engagement-Security Paradox in Customer Communications

The very feature that makes SMS effective for reaching customers also makes it dangerous. Research from IBM shows that SMS click-through rates range from 8.9% to 14.5%, while email averages just 2% — a gap that explains why legitimate campaigns see better response rates and why smishing attacks succeed more often. On mobile devices, users cannot hover over links to preview destinations, removing a critical safety check that desktop email users take for granted.

This engagement-security paradox creates real tension for businesses that rely on text messaging for customer communication. According to industry analysis, smishing accounts for 69.3% of all mobile-targeted phishing incidents and has grown 22% year-over-year, with 75% of organizations reporting attacks in 2023. The same immediacy that drives a 70% response rate to SMS queries — compared to 45.2% for email in controlled studies — means malicious links get clicked before suspicion kicks in. IBM notes that bank impersonation alone makes up 10% of all smishing messages, exploiting the trust customers place in familiar brands.

Compliance experts emphasize that neither channel is inherently secure — standard SMS lacks end-to-end encryption and stores messages in plaintext on carrier systems, while standard email lacks encryption by default. Both can meet regulatory requirements when delivered through proper platforms with audit controls, access restrictions, and signed Business Associate Agreements. The safest pattern, already used by banks and hospitals, treats both channels as notification layers that direct recipients to secure portals for actual data exchange.

• Use SMS and email for alerts and reminders, not sensitive data transmission
• Direct customers to encrypted portals for account changes, payments, or health information
• Implement A2P platforms with encryption and access controls for business texting
• Train staff and customers to recognize channel-specific threats like shortened URLs in texts

CallMyCustomers applies this principle in every reactivation campaign — owner-approved scripts, explicit consent collection, and messages that drive customers back to the business's own booking process rather than asking for sensitive information over text. When the outreach is permission-based and the destination is familiar, the engagement advantage works for the business, not against it.

Why Neither Channel Is Inherently Secure Without Safeguards

Many businesses assume that choosing between text and email hinges on convenience or reach, but security considerations reveal a more complex reality. Neither channel offers inherent protection against modern threats without deliberate safeguards in place. For service businesses handling customer data, understanding these vulnerabilities is essential to maintaining trust and compliance.

Standard SMS lacks end-to-end encryption in typical implementations, with messages often stored in plaintext within carrier systems during transmission. This creates multiple exposure points as texts travel from sender to recipient, increasing the risk of interception. Additionally, SMS is particularly vulnerable to SIM-swapping attacks, where fraudsters hijack a phone number to gain access to authentication codes and sensitive accounts—a risk highlighted by cybersecurity experts who note that phone numbers can be reassigned, intercepted, or hijacked, undermining their use as a secure authentication factor. These technical limitations mean that even with user consent, standard text messaging does not meet the safeguards required for transmitting highly sensitive information under regulations like HIPAA.

Email security, while more variable, also depends heavily on implementation rather than the protocol itself. Without proper controls, standard consumer email lacks encryption by default, leaving messages vulnerable during transit. However, business email can be significantly strengthened through measures such as Transport Layer Security (TLS) encryption in transit, authentication protocols like DMARC/DKIM/SPF, and secure email gateways that filter threats before they reach inboxes. Despite these enhancements, email remains susceptible to sophisticated phishing campaigns that exploit human judgment rather than technical flaws—a concern amplified by SMS’s substantially higher engagement rates, which range from 8.9% to 14.5% click-through compared to email’s average 2%. This increased likelihood of link interaction makes SMS a potent vector for smishing, especially since mobile users cannot preview links before clicking, a limitation that attackers frequently exploit.

For businesses like CallMyCustomers, which manages customer reactivation campaigns involving appointment reminders, service follow-ups, and re-engagement messages, these risks underscore the importance of channel-specific safeguards. While SMS offers superior reach and response rates—evidenced by studies showing substantially higher response to queries (70.0% vs. 45.2% for email)—its use must be paired with controls such as application-to-person (A2P) platforms that provide encryption, access restrictions, and audit logging. Similarly, email communications benefit from TLS enforcement and gateway protections, particularly when handling any form of protected or personal information. Ultimately, neither channel should be relied upon for transmitting sensitive data directly; instead, both are best used as notification tools that direct customers to secure portals where actual information exchange occurs—a practice already standard in banking and healthcare for managing protected health information and financial details. This approach balances effectiveness with responsibility, ensuring engagement does not come at the cost of security.

Practical Security Framework for Reactivation Campaigns

Knowing that neither channel is inherently safe changes the question entirely. The real security decision isn't "text or email?" — it's how you structure each one before a single message goes out.

For reactivation outreach, the safest pattern is a notification-only approach: use SMS and email to tell a past customer that something is waiting for them, then direct them to a secure portal or your existing booking process for anything substantive. This mirrors how banks and hospitals handle protected information, and as HIPAA compliance guidance makes clear, neither standard SMS nor standard consumer email carries the safeguards that regulated data requires.

That matters for win-back and reminder campaigns specifically. A seasonal HVAC follow-up or an old-quote nudge needs no sensitive data in the message itself — a name, a reason to reconnect, and a link. The engagement upside is real: IBM reports SMS click-through rates of 8.9–14.5% versus email's average 2%, so notification-style texts drive responses. The risk is equally real — the same research notes smishing accounts for 69.3% of mobile-targeted phishing — which is exactly why messages should never carry confidential details.

To put this into practice, follow a four-part framework:

• Use an A2P platform with encryption for texts. Secure SMS platforms add encryption, access controls, and monitoring that standard SMS lacks, plus proper A2P 10DLC registration and TCPA-compliant opt-out handling.
• Enforce TLS, DMARC, DKIM, and SPF on email so recipients can verify your messages actually came from you — protecting both your customers and your reputation.
• Classify data by sensitivity. Appointment reminders, renewal nudges, and birthday offers are safe in-message; financial details, health information, and credentials never are.
• Route anything sensitive to a portal. Send the alert by text or email; exchange the data where it's encrypted and audited.

This is the standard CallMyCustomers applies to every campaign it runs — messages go out only after the business owner approves the script, and for dental, med spa, and clinic clients, outreach operates under the required privacy agreements. As one technical analysis puts it, SMS delivers reach, not confidentiality — and a well-built campaign needs both.