A new company is building AI agents with an unusual job description: get fooled by scammers, on purpose, so the rest of us don't have to be.
The startup, called Apate.ai, deploys AI agents that pose as potential victims and engage directly with scammers — answering phishing emails, picking up robocalls, and chatting with fraudulent sellers. The goal isn't to stop a scam in the moment. It's to collect detailed intelligence on how scams actually unfold, from the opening pitch to the final ask for payment, so that data can be used to train fraud-detection systems.
This flips the usual AI security playbook. Most fraud-prevention tools work defensively, scanning messages or transactions for known red flags after the fact. Apate's approach is closer to a honeypot — a decoy system designed to attract attackers so researchers can study their behavior. Security teams have used honeypots on computer networks for decades. Applying the same idea to a conversational AI agent that can sustain a believable back-and-forth with a human scammer is newer territory.
The company says the intelligence gathered — call scripts, pressure tactics, payment methods, the way scammers adapt when a target hesitates — can be fed into models that detect fraud patterns faster and with more nuance than tools trained only on static examples of known scams.
The approach lands at a moment when fraud itself is becoming AI-powered on both sides. Scammers increasingly use AI to generate convincing phishing emails, clone voices for phone scams, and run conversations at a scale no human crew of fraudsters could manage alone. Using AI agents to study those same tactics, rather than simply block them, reflects a broader trend of companies trying to fight automated fraud with automated countermeasures rather than static rule sets. Other players in the fraud-detection space have been racing to add generative AI for pattern recognition; sending agents undercover is a more active twist on that same arms race.
For small businesses, scams aren't an abstract cybersecurity concern — they're a recurring operational cost. Business email compromise, fake invoice schemes, and phone-based social engineering targeting employees or customers disproportionately hit smaller companies, which often lack dedicated security staff. If intelligence gathered this way eventually filters into the fraud-detection tools small businesses already use — payment processors, email security plugins, CRM fraud filters — it could mean faster recognition of new scam variants before they spread widely.
The practical catch is timing and access. This kind of intelligence is valuable mainly if it reaches mainstream tools quickly, and if it's priced within reach of smaller companies rather than reserved for enterprise security contracts. Historically, advanced fraud-detection capabilities have rolled out to large banks and payment platforms well before trickling down to small-business-facing tools, sometimes with a lag of a year or more. There's also an unresolved question about what happens to the data these agents collect when a scam involves real victims' information — a business considering a vendor relationship with a company like this should ask how that data is handled.
Watch for whether banks, payment processors, or email security vendors announce partnerships to integrate this kind of scam intelligence into their existing products. Also worth tracking: whether other startups replicate the "decoy agent" model, which would signal it's becoming a standard tool in the fraud-prevention stack rather than a one-off experiment.
The bottom line: AI agents are now being deployed on both sides of the scam equation — running scams and getting scammed to study them. Small business owners don't need to adopt this technology directly, but should watch whether it shows up as a feature in the banking, payment, or email security tools they already pay for.