AI Scam-Baiting: How Bots Disrupt Cybercriminals
AI scam-baiting bots keep fraudsters busy while gathering intelligence. Learn how the technology works, where it helps, and why it won’t stop every scam.
When AI Pretends to Be a Victim: The New Fight Against Scammers
A scammer's time is a limited resource. If they spend an hour trying to talk a bot into a fake investment, that's an hour they're not spending on a real person. That's the basic idea behind a growing set of anti-fraud tools: use AI to keep cybercriminals talking, watch how they operate, and make their work less efficient.
People sometimes call this scam-baiting, but it's more than a prank. AI bots can handle calls and texts, and they can role-play realistic "victims" that pressure scammers into sharing links, accounts, scripts, and other details. A closely related approach - an AI-powered honeypot - sets up an automated attacker with a convincing fake system to probe instead of a real target.
These tools don't make scam calls disappear, and it's hard to measure impact from one conversation. Still, they can collect useful intelligence and add friction at a scale that human operators can't match. Here's how these systems work, where they may help, and what they can't replace.
How AI Scam-Baiting Works
Traditional scam-baiting usually involves a person deliberately engaging a fraudster. The person might waste the scammer's time, gather details, or test how the scam works. It can be useful - but it's labor-intensive. One person can only handle so many calls, and a conversation can become risky if it pulls in personal information, financial accounts, or an active criminal operation.
AI changes the math. Instead of relying on a human to keep every conversation going, a platform can route suspected scammers to automated personas designed to stretch the exchange. The bot isn't trying to "win" an argument or prove the caller is a criminal. It's trying to stay believable enough that the scammer keeps investing time - and, when possible, shares something usable.
A believable target, not a clever chatbot
The Australian company Apate, described in a WIRED report, has built a system that directs phone scammers to AI-generated "victims." Apate says its platform is used by banks and supported by telecom companies. Its bots can also interact with scam-related chat groups and respond to text messages.
A key design choice is that the bots aren't meant to sound like a flawless assistant. A real target might be cautious, distracted, inconsistent, or slow to decide. A bot that answers everything cleanly and follows one predictable script can look staged. Apate says its personas vary across language skills, behavior, and personal details. One persona might answer a call; another might hang up and say they'll call back later.
That variation matters. The goal isn't just fluent conversation - it's to sustain a convincing interaction long enough for defenders to learn something. In WIRED's test of a demo system, the bot responded naturally and stayed in character while testers posed as a potential victim and a financial adviser. The testers couldn't get it to invest in a fictional cryptocurrency opportunity. The exchange was frustrating on purpose: it left just enough uncertainty that the scammer would still consider the "victim" worth targeting.
The information collected can matter as much as the delay
A longer call isn't automatically a win. The value depends partly on what defenders actually learn. Apate's founder says the company has collected more than 250,000 pieces of information, including scam URLs, money mule accounts, and bank details. Those figures come from the company itself, not an independent measure of how many crimes were prevented.
Even so, the collection model points to a broader defensive use. If information from many conversations gets organized and shared responsibly, it can help banks, telecom providers, platforms, and law enforcement identify recurring infrastructure or patterns. One suspicious link might be a clue; repeated links, accounts, scripts, or contact methods can be what ties a campaign together.
It's worth stating the trade-off plainly: scam-baiting can generate leads and distract criminals, but it doesn't, by itself, freeze an account, take down a website, or prosecute anyone. Those steps depend on other organizations and processes. AI can increase the volume of observations, but it can't guarantee a fast, practical response to them.
What Defenders Gain from Keeping Scammers Busy
The core logic is simple. Many scams rely on volume. Criminals can place large numbers of calls or send messages at scale, then focus on the people who respond. If a chunk of those interactions get diverted to bots, the scammer has to spend some of their capacity on conversations that are unlikely to produce money.
Apate's founder argues that a minute spent talking to a bot can mean less time spent contacting real potential victims. That's a useful way to describe the intended effect, but it isn't a clean, universal calculation. A scammer might use automated dialing, run multiple chats at once, or move on quickly if a target looks unproductive. Real-world impact depends on how the system is deployed, how often scammers engage with it, and whether the information leads to action.
Disruption is a layer, not a complete defense
There are at least three possible benefits, and it helps to measure them separately:
- Diversion: A scammer spends time interacting with a bot instead of a person.
- Intelligence: The system records indicators like URLs, account details, or repeated scam scripts.
- Pattern analysis: Defenders compare information across calls, messages, and organizations to spot related activity.
A system that performs well in one area might not perform well in the others. A bot could keep a scammer talking but produce little that's actually actionable. Another system might flag a malicious link quickly but struggle to hold the scammer's attention. Treating "time wasted" as the only success metric can reward entertaining interactions instead of outcomes that reduce harm.
A stronger measurement approach tracks whether the system produces indicators that teams can use, how quickly those indicators reach the right people, and whether any accounts or infrastructure actually get disrupted. It should also account for false positives. If a legitimate caller gets labeled a scammer, that can lead to a poor customer experience - or to blocking a communication that matters. In real operations, classification errors aren't rare enough to ignore; they're something teams have to manage.
Why scale changes the equation
Humans can be effective at scam-baiting, but they can't realistically handle thousands of conversations at once. AI can run persistent, repetitive interactions at lower marginal cost. It can also generate a range of personas, which may make it harder for scammers to spot that they're dealing with the same script every time.
Still, more bots don't automatically mean more protection. Scaling an unreliable system scales its mistakes too. The platform needs rules for routing calls, protecting conversation data, handling sensitive information, and deciding what gets shared with banks or authorities. It also needs monitoring: fraudsters adapt, and a bot that works against one script may fail against the next.
So the real advantage isn't "AI versus scammers" as a single showdown. It's adding an automated layer to existing anti-fraud work. The question for any organization is whether a bot improves the whole pipeline - from detection to intelligence-sharing to intervention - without introducing unacceptable risk.
AI Honeypots and the Wider Defensive Toolkit
Phone and message scam-baiting is one example of a broader idea: create a convincing target that attracts an attacker, then observe what happens in a controlled environment. In cybersecurity, these are usually called honeypots. A honeypot might imitate a server, a service, or a virtual machine, giving researchers a place to watch probing and attack techniques without exposing a production system.
Honeypots have been around for years. What's newer is using large language models (LLMs) to make behavior less predictable and more lifelike. A static decoy can be easy for an experienced attacker - or an automated tool - to recognize. If the interaction feels artificial, the attacker may leave before defenders learn much.
Why more realistic behavior may keep attackers engaged
Research by Mark Vero and colleagues at ETH Zurich looked at LLM-powered honeypots. They found that AI agents attacking these systems stayed for significantly longer than they did against more predictable honeypots. The researchers also reported that the agents identified the LLM-based decoys as honeypots at a lower rate.
That suggests a honeypot doesn't need to be a perfect copy. It just needs to be credible enough to support observation and delay. In a controlled setting, a longer interaction gives researchers more time to see what files, services, or techniques attackers focus on. It can also help teams understand how automated attackers make decisions.
There's a catch, though. A more conversational decoy isn't automatically a safer decoy. If it's not properly isolated, it could create a path to real systems or accidentally leak information. Honeypots need clear boundaries, solid logging, and an operational plan for what happens when someone interacts with them. The point is to observe and contain - not to let a simulated environment drift into the production network.
Sharing intelligence is the hard part
Scam-baiting systems and honeypots can generate a lot of data, but data alone doesn't stop cybercrime. The real challenge is turning observations into decisions that organizations can act on. A bank may be able to investigate an account. A telecom provider may flag a number. A platform may remove a malicious link. Law enforcement may need evidence that meets legal requirements.
Those organizations don't always share information quickly or in compatible formats. Privacy rules, jurisdiction, and different evidentiary standards all matter. AI can help categorize and connect signals, but it can't settle the legal and institutional questions by itself.
For defenders, a practical model looks like a feedback loop:
- Detect suspicious calls, messages, or system activity.
- Route appropriate interactions to a controlled decoy or analysis process.
- Extract and validate useful indicators.
- Share relevant findings with the organizations able to act.
- Measure whether the response reduced exposure or disrupted the activity.
If the loop ends after collection, the operation may produce interesting reports without changing the risk for customers. The unglamorous work - verification, coordination, and follow-through - is where most of the value actually gets created.
Limits, Risks, and Practical Takeaways
AI-assisted disruption should be treated as one part of a wider security strategy. It isn't a substitute for fraud monitoring, secure account recovery, customer education, incident response, or involving law enforcement. Criminal operations change their scripts, switch channels, and use automation too. A bot that frustrates one caller might not slow down a much larger scam happening in the background.
There's also a measurement problem. It's relatively easy to count conversations, call duration, or collected indicators. It's much harder to prove that a specific interaction prevented a specific person from losing money. A credible program should separate activity metrics from outcomes. "We handled a million calls" tells you about volume; it doesn't prove reduced harm.
Risks organizations should account for
Before deploying AI decoys or automated scam interactions, organizations should work through key questions:
- Privacy: What personal data might show up in calls or messages, and how long will it be kept?
- Authority: Who is allowed to operate the system, and what local laws or telecom rules apply?
- Containment: Can the bot or honeypot accidentally interact with real accounts, networks, or customers?
- Data quality: How do collected indicators get checked before sharing or acting on them?
- Abuse and escalation: What happens if a scammer threatens someone, discloses sensitive information, or tries to exploit the system?
- Success criteria: Will the program measure useful disruption and response - not just how smoothly the bot talks?
None of this is a reason to avoid the technology. It's what you need to use it responsibly. As a system becomes more realistic and more autonomous, you also have to get clearer about what it can do - and where it's allowed to operate.
What consumers should do now
For individuals, the arrival of scam-baiting bots doesn't change the safest basic response to an unexpected call or message: assume the person contacting you might be lying. Don't share one-time passcodes, passwords, or banking details. And don't use a link or phone number from an unsolicited message to "verify" anything.
If someone claims to represent your bank, a government agency, or a company, end the conversation and contact the organization using a number or website you already trust. If you shared payment details or sent money, contact your bank promptly through its official channel. In the US, the Federal Trade Commission's scam guidance explains how to report common fraud. In the UK, use the official reporting route, such as Action Fraud, and follow your bank's instructions.
Don't try to investigate or bait a suspected scammer yourself. That can expose personal information, derail a legitimate investigation, or put you at risk. Reporting the contact and saving relevant messages is usually more useful than keeping the conversation going.
Conclusion
AI gives defenders a way to automate parts of the repetitive work involved in scam-baiting and honeypot research. A bot can keep a fraudster talking, collect indicators, or make a decoy system harder to spot. Those are real capabilities - but they don't automatically prevent fraud.
The payoff depends on what happens after the conversation: whether the data is reliable, whether it reaches the right organization, and whether anyone can act on it. For security teams, evaluate these systems as part of an end-to-end response process, with clear safeguards and outcome-based measures. For everyone else, stick with the basics: verify unexpected requests independently, protect your credentials, and report suspected fraud through official channels.