What began as a 44-minute prank call with a scammer became Apate.ai, a growing AI company using autonomous bots to deceive fraudsters, extract intelligence, and help disrupt a trillion-dollar global scam industry
This story features in Issue 25 – out now. Tap here to secure your copy.
The day that Dali Kaafar decided to start a company that unleashes an autonomous army of AI bots to take on the trillion-dollar global scam industry began like any other.
It was a warm Saturday afternoon in spring. The weather was perfect, and the Macquarie University professor of cybersecurity and executive director at Macquarie’s MQ Cyber Security Hub was enjoying a picnic with his wife and two children at a Sydney park.
At some point, his mobile rang. Kaafar could tell from the number that it was a scam call, and while he usually ignored them, on this particular day, Kaafar decided to have some fun with the fraudsters. He picked up the call. “The kids were a few years younger then, and for their entertainment, I pretended not to understand what the scammers were after, or I would give them the wrong details,” he says.
The scammers persisted, insisting that there was something wrong with Kaafar’s internet and they needed remote access to his computer. Kaafar feigned incomprehension when they spoke about his tepid upload and download speeds. He distracted and delayed them: what was this NBN they spoke of?
“At one point, I think I was even trying to order a pizza,” he says.
“As I hung up that call I remember very clearly saying, ‘this was all great fun, but imagine what technology can do with these scammers at scale’,” he says.
While his children were in hysterics, his wife was less impressed.
“My wife said, ‘those are 44 minutes of your own life that you will never get back. You ruined the whole picnic experience.’ I said, ‘That’s even more reason for technology to jump in to do it better’.”
Building the perfect bot victims
The following Monday, Kaafar called together a cohort of PhD students and a postdoctoral researcher with expertise in AI security and natural-language processing.
He told them he wanted to build a fleet of autonomous AI agents to disrupt the hugely lucrative global scam business, which, according to the Global Anti-Scam Alliance (GASA), cost victims US$1.03 trillion in 2024.
They would build voice bots to ape the tech insecurities of the average caller: umm-ing and ahh-ing their way through conversations with scammers and apologising for not being very good with technology or computers. These autonomous voice bots would be supplemented by text bots who could interact with scammers over messaging apps.
“The idea started out as a way to waste these scammers’ resources and their time,” says Kaafar.
“But then we all immediately realised that by keeping the scammers on the line we can also extract and deliver this real-time intelligence, actionable intelligence, to stay on top of what scammers are doing.”
Kaafar submitted a proposal to the Office of National Intelligence to turn the idea into a research project – “I think that was the easiest grant I’ve ever got” – but it soon became apparent that he had a company on his hands.
“Taking the research to where it matters and having those research ideas translated into actual products, really built and integrated within real systems, matters to me a lot,” he says.
In 2024, Kaafar founded Apate.ai, named after the Greek goddess of deception and fraud.
“I actually have a T-shirt that says, ‘I’m in the deception business’.”
From the outset, Apate.ai was, Kaafar says, a much better use of his skills than the casual hacking jaunts he would indulge in during his former university days in France. For fun, Kaafar would hack into his friends’ computers and open their disc drives, abruptly closing sessions and moving windows around their computer – much to their horror and confusion.
“At the time (of my university studies), remote computer control seemed almost like science fiction to many people, so the reactions from my friends could be dramatic,” he says. “Like many in cyber, I started out as a hacker. And then I realised very quickly that those kinds of capabilities were probably best used to help people.”
How the bots scam the scammers
Perhaps unsurprisingly given the magnitude of the global scamming industry – and the cost to banks and other institutions – success came quickly.
Commonwealth Bank was the company’s first customer. Through partnerships with telcos, scam calls can be redirected to Apate’s fleet of agents, who engage the fraudsters instead of letting them reach potential victims.
Apate.ai also deploys thousands of digital decoy identities across phone, email, messaging apps and social platforms, designed to be discovered directly by scammers searching for victims. “In your life, you are just going about your day, and these bots are creating a kind of shield,” says Kaafar.
“We are flipping the script on the economics of fraud by beating these bad actors at their own game.”
Crucial to the success of the fleet of Apate.ai bots is their believability: whether texting or talking, Apate.ai agents must resemble an actual person – rather than a minutely programmed chatbot – to keep scammers on the line.
To this end, the agents have phone numbers and WhatsApp accounts; they have personalities, PayIDs and pet peeves. Some have distinctive accents; others employ broad Australian slang (“no worries”, they may say or “let me just get a cuppa”). The company initially created around 200 named personas, which quickly ballooned beyond their ability to name them individually.
“We used to give them cute names, like Ricky and Pete, and we each had our favourite. But as we evolved to more than 200,000 bots, now they just have ID numbers,” says Kaafar.
“The objective is to ensure fraudsters encounter the variability they would expect from genuine victims, to emulate humans.”
Each bot operates with a defined mission, which may include keeping a scammer talking for as long as possible, extracting crucial intelligence about the scammers’ operations, or manoeuvring the fraudster onto another platform where the interaction can continue.
The mission may result in gathering details of scammer impersonation tactics, phishing URLs, mule bank accounts and crypto wallets – crucial information to help authorities shut down these networks.
The bots are “aware” they are talking to fraudsters, Kaafar adds, and build a range of “contexts of conversations” to react with plausibility. “The bots generate potentially hundreds of thousands of possible human-to-human conversations and how they may evolve,” says Kaafar.
“They keep updating their probabilities and what the best strategy to play is, depending on their mission.”
It’s not unusual for Apate.ai voice bots to keep scammers on the line for more than two hours, with the record at two hours and 12 minutes at the time of our interview.
“Literally a scammer that is busy talking to a bot is a scammer that is not placing thousands of calls a minute to other potential victims,” says Kaafar.
The bots have been designed to compete against each other: a stronger performance produces bot reward signals – a virtual carrot – while weaker performance attracts penalties – the proverbial stick.
The reinforcement-learning system contains a further trick, Kaafar adds: bots are not certain whether they received a reward or penalty. The uncertainty keeps the AI agents experimenting with scripts rather than locking onto one successful behaviour.
The call may end when the bot determines it has the information it needs. But in a pure time-wasting mission, Apate.ai’s fleet is unlikely to ever end the call first.
Occasionally, scammers end the call because they cotton on that they are talking to a bot. “It does happen,” says Kaafar. “I think our estimate is roughly two per cent.”
The realisation that a bot has been wasting the scammers’ time usually results in a slew of profanities, he adds.
“I think we’re the only company around that has a KPI linked to f-words,” he says. “I think we are currently at around the 10-million mark.”
Kaafar is keen to emphasise that while delaying and obfuscating scammers is deeply satisfying, it offers benefits beyond the usual telco approach of merely blocking calls. “The scammers don’t even notice that they’ve been blocked; they’re just auto-dialling thousands of calls until they get a victim,” he says.
“What we’re trying to do is distract them and disrupt them by presenting them with the perfect victim. Then we make it really painful for them where exactly it matters for them, which is how much money they’ll be making.”
Commercial traction
With the imprimatur of Australia’s biggest bank, other high-profile customers followed. The team expanded to 17 staff, with long-time colleague Peter Eckermann joining Kaafar as co-founder when Apate was spun out of Macquarie, and Brad Joffe joining as chief commercial officer in early 2025.
Kaafar says Apate.ai raised its first $2.5 million pre-seed round in mid-2025, led by OIF Ventures and Investible, and had originally intended to raise further capital towards the end of 2026. Instead, the company received unsolicited term sheets from US investors earlier in the year, which led to a recent raise worth US$8.15 million, led by Lobby Capital.
The money will support further growth, particularly in the US and UK, where Kaafar says demand is already outstripping the company’s capacity to respond. Apate.ai’s pipeline has been “tripling quarter to quarter”.
“We’re getting massive inbound,” he says. “There are markets where we just don’t have the capacity today.”
Apate operates on a recurring subscription and licensing model, with banks, telcos, law-enforcement agencies and other customers paying to use the platform across different stages of the fraud lifecycle.
Kaafar argues Apate’s competitive advantage rests principally on two things: its proprietary technology and a growing dataset of real-world scam interactions that become more valuable over time. The company has amassed millions of autonomous conversations with scammers and more than 250,000 intelligence artefacts, a corpus Kaafar says cannot simply be recreated by a new competitor.
“A competitor can copy a product, but this dataset cannot be bought, only accumulated one real conversation at a time,” he says.
“Every new deployment compounds with the existing data, making it larger and our agents sharper. That is a flywheel no new entrant can shortcut, however well funded.”
Demand is particularly strong in the UK, where banks are now required to reimburse most victims of authorised push payment scams. The cost is generally split equally between the institution that sent the payment and the one that received it, giving banks a direct financial incentive to shut down mule accounts before stolen funds reach them.
Australia is also tightening the screws. From March 2027, the federal government’s Scams Prevention Framework will place fresh obligations on banks, telcos and digital platforms to prevent scams, with tougher consumer compensation rules in the pipeline.
With fraud now a mega global industry – and with governments putting an increasing onus on banks to protect consumers – Kaafar says the opportunity, and the urgency, within Apate.ai is only growing.
“We want to put the foot on the gas,” he says.
Visit https://www.apate.ai/ to listen to Apate bots interact with scammers.
Want to see more Forbes articles on your feed? Tap here to make Forbes Australia a preferred source on Google.
Look back on the week that was with hand-picked articles from Australia and around the world. Sign up to the Forbes Australia newsletter here or become a member here.
