Apate is a start-up that grew out of research at Macquarie University in Sydney. It runs thousands of AI agents that pretend to be ordinary people being targeted by fraud. They answer scam calls, reply to suspicious messages, follow phishing links and join social groups, and they try to keep the scammer talking until he gives up an account number, a crypto wallet, a phone number or a website. Banks, phone companies, utilities and government agencies buy what comes out.
Every scam ends with an account number
A scam can start as a fake delivery text, a call from the "bank fraud team" or a celebrity investment tip. It always ends the same way, with the victim sending money somewhere. The account that receives it is the one thing the scammer cannot fake and cannot skip.
Until now a bank usually learned that account after someone had paid into it and reported the loss. A decoy changes the order. Say a scammer is about to call a retired teacher, pose as her bank and tell her to move her savings to a safe account. A week earlier the same script ran on a decoy, which asked which account to use and wrote the number down. When the teacher's real bank sees a first payment to that account, it already knows what the account is.
Whether that helps depends on what the bank does with the number. In Australia, banks have agreed to warnings and payment delays when a customer pays a new recipient, and they share scam intelligence with each other and with phone companies. A flagged account gives those delays something to act on.
Wasted minutes are cheap to the scammer
The 17 years of wasted time sounds large, but it is spread over millions of short conversations. A scammer who loses four minutes has lost very little. A scammer whose account is frozen has lost the work of setting it up, and has to start again before the next victim can pay.
Scammers will have to screen their targets
Scammers use AI too. The FBI received more than 22,000 complaints about AI-related crime in 2025, which we covered in September. But the two sides are not equal at the moment that matters. A decoy only has to listen, and a scammer has to ask for money, so he has to reveal something about himself.
Once any target might be a decoy, scammers cannot give out accounts freely. They will start asking for things a bot finds hard: a video call, a local detail, a small first payment from a known bank account. Each of those steps costs the scammer time and loses some real victims along the way. That cost is a better measure of what a decoy does than the length of any one call.
What it means for a business
The same logic works for any company whose name scammers borrow. A utility, a delivery firm or a bank often learns it is being impersonated when customers start complaining. A decoy that joins the fake conversation can show the company the message, the fake website and the account within days, before the complaints start. Apate says it can also forward a company's inbound scam calls to its bots.
For now its best-known customers are Australian, and it is opening an office in London and building a larger presence in the United States. If it works there, the first sign that your business is being impersonated will more often be a transcript than an angry customer.