Apate AI Agents Go Undercover, Turning Scam Calls Into Fraud Intelligence

Apate AI agents have entered 2.5 million conversations while posing as potential scam victims, according to the Australian startup. Instead of improving office productivity, these agents answer suspicious calls, messages, emails, and social invitations. Their assignment is to keep fraudsters talking and extract information before a real victim loses money.

The approach reverses the usual relationship between artificial intelligence and online fraud. Criminal groups already use AI to translate scripts, fabricate identities, and operate across borders. Apate applies similar conversational capabilities against them, creating synthetic targets that never transfer money or surrender real credentials.

The company says its agents have consumed 17 years of scammers’ collective time. Yet wasted time is only the visible result. The more important product is fraud intelligence, including bank accounts, cryptocurrency wallets, phone numbers, phishing domains, and impersonated brands.

That moves Apate into territory traditionally occupied by bank monitoring systems, telecom filters, and human investigators. Those defenses often identify suspicious behavior after scammers have reached customers. Apate wants to collect the infrastructure behind a campaign while the fraudster still believes a transaction is possible.

The central question is therefore larger than whether a chatbot can frustrate a caller. Apate must show that deceptive conversations produce verified intelligence quickly enough for customers to stop active campaigns.

Apate AI Agents Turn Scammers Into Intelligence Sources

Apate’s defining move is to treat each intercepted scam as an intelligence operation, not merely a blocked interaction.

Founded in 2024 from research conducted at Macquarie University in Sydney, Apate deploys thousands of fabricated identities across voice and text channels. The identities vary by age, gender, accent, language, and apparent technical ability.

A bot might answer a fraudulent support call while acting confused about online banking. Another can respond to an investment message and ask where funds should be sent. Text agents can enter suspicious forums or investment groups using fictional profiles.

These agents are designed to reveal the operational details behind a scam. Useful outputs can include destination accounts, cryptocurrency addresses, email addresses, websites, telephone numbers, scripts, and targeted brands.

Apate co-founder Brad Joffe told TechCrunch that the company’s agents speak with tens of thousands of scammers each day. The company then packages intelligence from those conversations for banks, telecommunications providers, utilities, and government agencies.

The startup’s undercover agent report describes a system working across calls, messages, email, websites, and social platforms. Customers can also assign a specific mission, such as obtaining a payment destination connected to a suspected campaign.

That mission-based structure matters. A conventional chatbot generally tries to satisfy the person using it. Apate’s agents instead pursue an investigative objective while maintaining a believable fictional persona.

Apate says it uses both frontier models and models fine-tuned with scam conversations. Fine-tuning adapts a general model using task-specific examples. In this case, those examples help agents recognize scam tactics and remain convincing under pressure.

The company also gives customers an insights portal for monitoring campaigns, targeted products, impersonated brands, and extracted indicators. Those indicators can then support account reviews, domain blocking, customer warnings, or further investigation.

The result is a loop between engagement and defense. A suspected scam is redirected, the bot collects information, and the customer decides whether the information justifies intervention.

However, Apate does not independently control those final actions. Its value depends on whether banks, telecom operators, and agencies can validate and use the collected evidence before fraudsters replace their infrastructure.

Why Fraud Defenses Need Earlier Signals

Apate is pressuring fraud teams to move from detecting completed harm toward investigating scams while their operators are still searching for victims.

Banks traditionally monitor transactions for unusual destinations, amounts, or behavior. Telecom providers analyze call patterns, sender identities, and known malicious numbers. Browser and email defenses block domains or messages associated with reported campaigns.

Each layer remains necessary. However, many signals arrive after contact has occurred. A customer may already be speaking with an impersonator before a phone number accumulates enough complaints to trigger blocking.

Fraudsters can also rotate infrastructure. A blocked number can be replaced. A phishing page can move to another domain, while stolen money can pass through multiple accounts or wallets.

Apate’s wager is that direct engagement can expose replacement infrastructure earlier. A scammer who expects payment eventually has to provide a destination. An impersonator must name an institution, service, or investment opportunity. Those details become potential indicators for investigators.

The timing challenge is becoming more urgent as criminals adopt AI. The FBI’s AI crime figures recorded 22,364 complaints containing AI-related information during 2025. Adjusted losses exceeded $893 million.

Those numbers do not mean AI caused every reported loss. They show that synthetic media, automated conversations, and related tools now appear across a substantial collection of reported crimes.

An Associated Press investigation found that criminal groups were using American AI systems to translate messages and manage fabricated personas. The scam compound investigation documented operations serving victims across multiple languages and countries.

Automation changes the economics on both sides. One criminal worker can manage more conversations with generated replies, while synthetic audio can make impersonation more convincing. Defenders therefore need systems that can process high volumes without assigning a human investigator to every interaction.

This is where Apate’s model applies pressure. If automated engagement reliably produces payment details and campaign patterns, passive filtering starts to look incomplete. Fraud teams would still block suspicious traffic, but they could also interrogate it.

Commonwealth Bank of Australia, TPG Telecom, and other organizations are testing that proposition. Australia’s national anti-scam reporting describes Commonwealth Bank’s work with Apate and confirms the broader institutional interest in conversational countermeasures.

The national scams report says the bank partnered with Apate to deploy AI bots against scammers. It also describes a TPG Telecom proof of concept involving redirected scam calls.

These deployments give Apate access to suspected scam traffic that an independent consumer application would struggle to obtain. They also place responsibility on partners to decide which calls are suspicious enough to redirect.

That dependence creates both leverage and risk. Apate can scale through established networks, but weak classification at the network edge can starve its system of useful conversations or route legitimate callers incorrectly.

How Apate Works Before Money Moves

The mechanism combines traffic redirection, believable synthetic personas, conversational persistence, and structured extraction of fraud indicators.

Apate began with a simple observation from founder Dali Kaafar. During a family picnic, he reportedly kept a scam caller occupied for 44 minutes by pretending to misunderstand the scheme.

The exchange prevented that caller from approaching another victim during those minutes. It also suggested that prolonged conversation could reveal more than a phone number alone.

Kaafar and other Macquarie University researchers developed that intuition into a formal research program. Their proactive defense project involved the university, Apate, Commonwealth Bank, and Australia’s Office of National Intelligence.

The project described a multilingual conversational bot that receives calls already identified as suspicious. It then presents a convincing victim persona, extends the interaction, and extracts threat intelligence in near real time.

That first classification step is crucial. Apate does not simply dial random people while pretending to be someone else. In its telecom deployments, suspected scam calls can be redirected into a controlled environment.

Once connected, the agent processes the caller’s speech and chooses responses that preserve the scammer’s confidence. A corresponding scam prevention patent describes responses selected to extend calls, including attention to emotions and conversational exit signals.

A believable persona needs consistency. The agent cannot claim to be a retiree in one sentence and describe being at school in the next. It must remember details, handle interruptions, and avoid completing the harmful transaction.

Voice is only part of the system. Apate says its text agents can respond to emails, follow phishing links, enter suspicious groups, and continue conversations on web platforms.

This broader coverage reflects how modern scams cross channels. A first message may arrive through SMS, followed by a messaging application, fraudulent website, telephone call, and cryptocurrency transfer.

Apate’s agents can be given extraction goals within those conversations. A bank might prioritize beneficiary account numbers. A cryptocurrency investigation might seek wallet addresses, while a brand could focus on domains and impersonation scripts.

The extracted data then requires normalization. Different agents may encounter variations of the same phone number, wallet, name, or domain. Apate’s intelligence layer is supposed to connect those observations and present them as campaign-level evidence.

According to the company, TPG Telecom has diverted nearly 590,000 calls to its agents. Apate also says an unnamed Australian bank used outbound agents to disrupt 22 scam campaigns.

Those figures describe activity, not independently audited effectiveness. A diverted call does not automatically represent a prevented loss. Likewise, a discovered bank account requires verification before a financial institution can restrict it.

Apate says Commonwealth Bank experienced a 76 percent reduction in publicly reported scam losses. That claim needs careful attribution because many controls can influence loss figures. Customer education, transaction monitoring, reimbursement rules, and wider market changes can all affect the outcome.

The strongest immediate evidence is narrower. Institutions are redirecting real suspected traffic, conversational agents are sustaining interactions, and those exchanges generate identifiers that existing fraud teams can investigate.

The Real Contest Is Proactive Intelligence Versus Reactive Blocking

Apate’s primary opponent is not another chatbot company. It is the assumption that fraud defense must wait for a detectable transaction or victim report.

Reactive systems have an important advantage: they operate on observable events. A bank can inspect an attempted payment. A telecom provider can measure call frequency. An email service can compare a link against known malicious domains.

Proactive engagement works with less certainty. A suspicious caller may be a scammer, an aggressive marketer, or a legitimate person caught by an imperfect filter. Extracted information can be false, recycled, or intentionally planted.

Apate accepts that uncertainty in exchange for earlier access. Its agents aim to reach the point where a scammer exposes payment infrastructure, operating methods, or coordinated identities.

The approach resembles a honeypot, which is a decoy system built to attract attackers and reveal their behavior. Traditional cybersecurity honeypots expose fake servers or credentials. Apate extends the concept into natural-language relationships.

This conversational layer matters because social engineering depends on trust and escalation. Technical metadata can show where a call originated, but dialogue can reveal the invented problem, requested action, impersonated organization, and intended payment route.

Competitors and adjacent products attack different parts of the sequence. Telecom filters identify suspicious traffic before a call connects. Banks evaluate payments before settlement. Blockchain analytics firms trace funds after an address becomes known.

Human investigators also conduct scam-baiting and undercover work. They can recognize context, improvise strategically, and apply judgment when a conversation becomes sensitive. Their limitation is cost and availability.

Apate is not replacing all four layers. It is proposing an automated collection layer between detection and financial intervention. That layer tries to turn suspicious contact into evidence.

The distinction explains why wasting scammers’ time is not enough. A fraudster might operate many concurrent conversations or use automation. Keeping one session active becomes less valuable when the attacker’s marginal cost approaches zero.

High-quality intelligence can retain value even in that scenario. A payment account, wallet, or reusable domain connects the conversation to infrastructure that defenders can investigate across many cases.

Yet the contest remains uneven. Criminals can test callers for signs of synthetic speech, ask adversarial questions, or feed bots fabricated identifiers. They can also move conversations to platforms where automated collection faces technical or policy restrictions.

AI agents on both sides will probably improve. Fraudsters will use models to generate more adaptive scripts. Defenders will use models to probe those scripts and connect repeated indicators.

That creates an adversarial feedback loop. Each conversation can improve the defender’s models, but it can also teach scammers how the bots behave. Operational secrecy, model updates, and varied personas become central defensive requirements.

Apate’s route is therefore more demanding than building a conversational demonstration. The company must maintain believable agents against opponents who actively learn, test, and adapt.

What Apate’s Numbers Still Do Not Prove

Conversation volume demonstrates scale, but the decisive metric is how often Apate’s intelligence prevents harm without disrupting legitimate communication.

The company says its agents have conducted 2.5 million conversations and consumed 17 years of scammers’ time. Those figures are memorable, but neither directly measures prevented losses.

A long conversation might produce no usable information. A short interaction might reveal a bank account immediately. Measuring minutes alone can reward engagement that sounds impressive without improving customer outcomes.

Extracted indicators also have different levels of reliability. A phone number can be spoofed, a website can disappear, and a bank account may belong to a manipulated money mule. A scammer could deliberately provide another person’s details.

Customers therefore need confidence scores, provenance records, and human review. Provenance explains where a piece of intelligence came from and how it changed. Without it, investigators cannot distinguish a strong indicator from an agent’s mistaken interpretation.

False positives carry real consequences. Freezing an innocent person’s account or blocking a legitimate business number can cause financial damage. It can also erode trust in the broader anti-fraud system.

Data handling presents another unresolved issue. Scam conversations may contain personal information belonging to suspected criminals, victims, money mules, or unrelated third parties. Different jurisdictions impose different rules for recording, processing, retaining, and sharing that information.

Apate says its platform emphasizes privacy, compliance, and controlled intelligence sharing. Publicly available reporting does not provide enough detail to evaluate its retention periods, model-training boundaries, or customer audit procedures.

Model dependence introduces another question. Apate reportedly combines frontier models with its own fine-tuned systems. External model policies, latency, outages, and changes in safety behavior could affect agent performance.

The agents must also resist prompt injection, which occurs when hostile text attempts to override a model’s assigned instructions. A scammer who suspects a bot could order it to disclose internal prompts, abandon its persona, or generate prohibited content.

Successful resistance requires more than a strong system prompt. Apate needs constrained tools, separated data stores, monitoring, and safeguards that prevent a conversation from triggering unauthorized actions.

There is also a risk of mistaking correlation for causation. If a partner reports lower scam losses after adopting Apate, the reduction might reflect several simultaneous controls. A credible evaluation should isolate Apate’s contribution.

Useful disclosure would include the percentage of redirected contacts confirmed as scams, the proportion yielding actionable indicators, and the time between extraction and intervention. Customers should also track false-positive reversals and verified losses prevented.

Independent audits would make the company’s claims easier to compare across institutions. Standardized definitions could separate conversations initiated, conversations sustained, indicators collected, indicators verified, and campaigns disrupted.

Apate’s research foundation gives the company more substance than a typical agent demonstration. However, moving from pilot evidence to a repeatable commercial control requires transparent outcome measurement.

Three Signals Will Show Whether Apate Fraud Intelligence Scales

The next phase will test whether Apate can convert an inventive Australian deployment into trusted infrastructure across markets, channels, and regulatory systems.

The first signal is verified customer performance. Apate has named Commonwealth Bank and TPG Telecom, while referring more generally to utilities, agencies, and another Australian bank.

Future case studies need outcome metrics tied to a defined baseline. The strongest evidence would connect validated indicators to blocked accounts, removed domains, disrupted campaigns, or reduced losses.

The second signal is international deployment. Apate raised $8.15 million in seed funding during August 2026, according to the company and TechCrunch. Its total funding reportedly sits just below $10 million.

The 20-person startup plans to use the capital for product development and international expansion. It intends to open a London office and increase its presence in the United States.

Expansion will test whether the system can handle new accents, languages, scam scripts, privacy rules, and institutional workflows. A model trained on Australian calls cannot simply assume identical behavior elsewhere.

Success in Britain or the United States would strengthen Apate’s claim that its architecture generalizes. Slow pilots or narrow channel access would suggest that partnerships, regulation, and local data remain major constraints.

The third signal is adversarial resilience. Scammers will eventually recognize recurring synthetic voices, conversational habits, or redirection patterns. Some will attempt to poison the intelligence by supplying misleading accounts and domains.

Apate must show that its agents evolve without becoming unsafe or unpredictable. It also needs detection systems that notice when a scammer is testing the bot rather than pursuing a victim.

These signals matter more than the total number of conversations. Verified interventions reveal utility, international partnerships reveal transferability, and adversarial performance reveals durability.

The wider importance extends beyond scam calls. Apate demonstrates an unusual direction for agentic AI, meaning software that pursues a goal across several conversational steps. Here, the goal is controlled intelligence collection against a hostile participant.

That model will attract attention from banks, telecom operators, cybersecurity teams, and government agencies. It will also raise questions about identity, consent, evidence quality, and accountable automation.

For knowledge workers following this market, the useful habit is to separate company claims from validated outcomes. A searchable AI knowledge base can help teams preserve sources, assumptions, and later corrections.

Watch the verified outcomes, not only the entertaining recordings. If Apate can consistently turn hostile conversations into timely interventions, fraud defense gains a new collection layer. If verification remains opaque, the bots may waste scammers’ time without proving that they protect more victims.