- Apate.ai deploys AI agents that pose as victims to draw out scammers' bank accounts, wallets and phone numbers, then sells that intelligence to banks, telcos and agencies.
- Its results are company claims reported by TechCrunch, unverified. Apate's pitch is to shift fraud defence from reacting to victims toward learning from attackers.
- Leaders should ask whether their fraud team learns about scams from victims or from attackers, and how fast that intelligence becomes a block.
Most fraud defence starts with a victim. A customer loses money, reports it, and the bank learns what the scammer was doing. Apate.ai, an Australian startup, wants to reverse that order. Its AI agents play the victim on purpose, so the defender learns first.
What the agents actually do
TechCrunch reports that Apate runs thousands of AI agents posing as ordinary people. They pick up scam calls and reply to dubious messages and emails. They also click through phishing links and enter social media groups. The personas differ in age, gender, accent and language.
The aim is to keep the scammer talking until something useful slips out. The company wants the kind of detail usually learned only after someone has been robbed. That includes the accounts and wallets used to collect money, the phone numbers and sites behind a scheme, and the brands being faked.
Customers also get a portal with analytics on scams aimed at their staff, users and brands. They can give the agents a specific mission, such as getting a bank account number or a wallet address. Text agents can also hunt through forums, investment groups and social platforms for scam activity. They then step into conversations under an invented identity.
Co-founder Brad Joffe told TechCrunch that Apate mixes frontier models with models it has fine-tuned itself. Training data comes from the agents' own scammer conversations and from earlier research at Macquarie University.
Time is the scammer's cost
The idea began at a family picnic. Founder Dali Kaafar took a scam call, played along for his kids, and kept the caller going for 44 minutes. Afterwards he realised that this was time the scammer had not used on a real victim.
This points to a useful way to see the shift. AI appears to have lowered the cost of running scam conversations. That is this publication's reading, not a finding in the source. The FBI makes a related point about investment scams specifically: fraudsters use AI to run conversations and to deepfake the voices and looks of celebrities, executives and trusted figures. Those scams accounted for more than $632 million of the roughly $893 million in AI-related losses. If attackers can automate the talking, a defender's counter may be to automate the listening.
A person who strings a scammer along for an hour is a hobbyist. A fleet of agents doing it across thousands of conversations is a cost the scammer must absorb. Security teams will recognise the logic of a honeypot: a decoy built to learn from whoever touches it. Apate applies that idea to people rather than servers.
What the company reports, and what it does not prove
Apate says its agents have wasted 17 years of scammers' time across 2.5 million conversations. Joffe says TPG Telecom has sent nearly 590,000 calls to the agents. He says an unnamed Australian bank has used the outbound agents to disrupt 22 scam campaigns. He also credits the company's work with Commonwealth Bank of Australia alongside a 76% fall in that bank's publicly reported scam losses.
These are company statements. The article does not describe how they were measured. It also does not say how much of the 76% drop came from Apate rather than other bank measures. Treat them as claims to test, not proof.
Questions to put to your fraud and security teams
First, where does your scam intelligence come from today? If the answer is mostly victim reports and blocked transactions, you are learning after the harm. Joffe's own description of the industry is that it works "after the fact."
Second, how fast can new attacker details, such as a wallet or phone number, become a block or a customer warning? Intelligence that sits in a portal is only useful if someone acts on it.
Third, if you buy a service like this, what are the rules for agents that pose as real people on your behalf? Ask your legal and risk teams what they must approve, and what evidence the vendor can show for its results.
The lesson is that attackers' scarcest resource may be attention, and AI now lets defenders spend it for them.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: TechCrunch.
