A Sydney Startup Sends 350,000 Bots to Waste Scammers’ Time

The voice that answers the phone is patient, a little confused, and happy to read out a card number that does not exist. It asks the caller to repeat himself. It mishears the name of the bank. It stays on the line for forty minutes, and at the end of the call it has a bank account, a wallet address and a website address to hand to somebody who can use them.

The voice belongs to software. Apate, a Sydney company founded in 2024, runs about 350,000 artificial-intelligence agents that pose as plausible victims: answering scam calls, replying to fraudulent text messages and emails, and joining the group chats where investment frauds are cultivated. The agents are designed to be just convincing enough to keep a scammer working and just useless enough to never send money.

The company says its agents have completed about 2.5 million conversations with fraudsters. Measured in the currency that matters to a criminal operation, that is roughly 17 years of labour the scammers will never get back, spent on people who were never going to pay.

The mechanics are straightforward once you accept the premise. A scam operation is a business with fixed costs: staff, scripts, phone lines, the rent on a floor of a building in a special economic zone somewhere. Its revenue comes from conversations that convert. Every hour an agent spends on the line is an hour a human operator is not spending on someone with a real savings account, and the intelligence gathered during that hour has a second use.

That second use is the product. Apate passes what its agents extract, account numbers, cryptocurrency wallets, phishing domains, the payment rails behind them, to banks and telecommunications companies that pay for the data. A bank can freeze an account before the next victim transfers into it. A carrier can cut a route that is delivering the calls.

The early numbers are small but specific. TPG Telecom has routed roughly 590,000 calls into the system. Banks working with the company interrupted 22 scams, and reported that losses tied to the frauds they were watching fell materially. Those figures are modest against the size of the problem. Australia’s regulators have estimated scam losses in the billions of dollars a year, and the Global Anti-Scam Alliance puts the worldwide figure near $1 trillion. Twenty-two disruptions is not a solution. It is a demonstration that the pipeline works.

The company grew out of security research at Macquarie University in Sydney and has raised close to $10 million, including a seed round in August reported at about $8.15 million. Its name comes from the Greek personification of deceit, which is either good branding or an unusual thing to name a fraud company, depending on how much time you have spent on hold with a call centre in another time zone.

What Apate is selling is a change in where the defence sits. Banks and carriers have spent a decade building systems that detect fraud after a payment moves, then try to claw it back through recalls and insurance. Recovery rates are poor and slow. Engaging the scammer earlier, while the conversation is still running, produces intelligence in real time about infrastructure that is otherwise invisible until a victim reports it.

The approach fits the direction regulators have taken. Australia’s anti-scam rules now require telecommunications companies to identify, trace, block and report scam traffic rather than simply carry it, and banks have signed a voluntary accord that commits them to share intelligence across the sector. Both obligations create a demand for exactly the kind of live feed Apate produces. The Commonwealth Bank of Australia has described using the company’s intelligence in near real time, one of the few public confirmations from a major lender.

There are questions the company will have to answer as it grows. Recording a conversation with a criminal is one thing; the agents imitate ordinary people, sometimes elderly ones, and the people on the other end are themselves often trafficked workers in compounds in Southeast Asia rather than the organisers of the scheme. The intelligence flows upstream either way, but the human cost is not symmetrical, and companies that build entrapment-adjacent tools tend to discover that regulators and journalists arrive with the same questions at about the same time.

There is also an arms-race problem. Scammers already screen for bots: a caller who answers too quickly, sounds too scripted, or never becomes emotional gets dropped. The agents have to keep getting better at being bored, forgetful and slightly vain, which is a strange engineering brief and, for now, a modest moat. The moment fraud crews learn to detect synthetic victims reliably, 350,000 agents become 350,000 wasted phone lines.

For all that, the economics of the thing are hard to argue with. Defence has always been cheaper when it is moved earlier, and fraud is one of the few crimes where the offender will voluntarily spend an hour talking to anyone who picks up. Apate’s insight is that the picking up can be automated, and that every minute of a scammer’s day spent on a fiction is a minute not spent on a person who would have believed the story.

The company’s agents will not stop the industry. They may make a portion of it uneconomic, one wasted shift at a time, and they will produce a record of how the operations are built that no victim survey could supply. Seventeen years of scammer time is, in the end, a rounding error against the total. It is also seventeen years that somebody did not spend on the phone with a real retiree who was about to lose her savings.

Related Posts

  • October 26, 2026
  • 11 views
Nvidia’s Rubin Spec Sheet Shrank Without an Announcement

Nvidia’s product pages are the closest thing the industry has to a timetable. When a figure changes there, buyers plan around it, and competitors answer it. Sometime after June, several…

  • October 26, 2026
  • 10 views
A Poisoned Python Package Turned a Developer Laptop Into a Credential Haul

The installer looked routine. A developer on a Windows machine ran a Python command to add an unrelated dependency, and the collector started. There was no import of the compromised…