Smishing risk assessment using RAG and its potential for pedagogical recontextualization for cybersecurity education

SMS phishing (“smishing”) is an escalating threat that exploits mobile messaging to deliver malicious links. We present an explainable retrieval-augmented generation (RAG) prototype that flags smishing in Lithuanian SMS and explains its reasoning. The system extracts text from screenshots and evaluates each message against five criteria: search engine indexing, domain allow listing, use of a URL shortener, matches in a phishing database, and semantic similarity to labeled messages. An LLM dynamically weights these factors, generates a risk score ranging from 0 to 100, and provides a natural-language justification. To develop cybersecurity literacy for recognizing threats in mobile messaging environments, it is essential first to understand the technical mechanisms that enable risk identification and to recontextualize those methods in an educational context. The prototype was tested on 20 SMS messages with three LLMs drawn from three distinct providers - OpenAI GPT o1, Anthropic Claude Sonnet 3.7, and DeepSeek V3 - evaluated under an identical pipeline. Claude Sonnet delivered the most stable scores (mean coefficient of variation ≈ 0.10). Semantic similarity had the highest cross-model average weight (23.5%), ranking first or second across the five criteria for every model tested, suggesting generalizability beyond a single model family. Results indicate that the RAG approach combines reliable detection with transparent feedback, enabling users to see why a message is risky. By coupling technical accuracy with interpretable explanations, the tool has the potential to function not only as a smishing filter but also to be pedagogically recontextualized as a supportive resource for fostering cybersecurity literacy.