AI scam-baiting bots are introducing a different approach to fighting digital fraud: instead of immediately ending a suspicious conversation, an automated system can pose as a potential victim and keep the suspected scammer talking. The objective is to gather information that banks, telecommunications providers, and investigators might otherwise discover only after someone loses money.
The approach comes as impersonation fraud continues to cause substantial financial damage. In late October 2026, the Federal Trade Commission disclosed that it had worked with domain registrars to remove 19 websites impersonating the agency. The FTC also reported more than $80 million in consumer redress from enforcement actions under its Impersonation Rule since 2024. These cases show why identifying fraudulent websites, payment destinations, and impersonation tactics before they reach more victims is increasingly important.
Why Fraud Investigators Want Scammers to Keep Talking
Traditional fraud prevention often begins with blocking suspicious activity. Telephone operators filter unwanted calls, email providers detect phishing messages, and financial institutions monitor transactions for signs of fraud.
These measures are valuable, but they don’t always reveal who is running a scam or which accounts and websites are being used. Blocking one telephone number may have limited impact when criminals can quickly switch to another.
AI scam-baiting bots try to gather more information by joining controlled conversations with suspected fraudsters. They may respond to suspicious calls or messages, ask questions, and record relevant details for further analysis.
The scale of the problem is considerable. According to FTC figures released in June 2026, consumers reported approximately $3.5 billion in losses to impersonation scams during 2025. The agency received more than 1 million reports involving this category of fraud.
These figures represent reported losses, not a complete accounting of every scam. Many incidents never reach law enforcement or consumer protection agencies.
Inside an AI Scam-Baiting Conversation
Consider a suspicious telephone call in which someone claims to represent a bank’s security department. The caller warns that an account has been compromised and urges an immediate transfer to a supposedly protected account.
Rather than connecting the caller to a real customer, an authorized anti-fraud system could direct the call to an AI-controlled decoy.
The decoy might ask the caller to explain the supposed problem, provide supporting information, or clarify payment instructions. As the conversation continues, the system can record details that may help identify the underlying operation.
Several technologies make these interactions possible. Speech recognition converts spoken words into text, while a language model generates context-appropriate responses. Text-to-speech software can then produce spoken replies.
A conversation management system maintains the exchange across multiple turns. It helps the bot respond coherently when a caller changes the subject or repeats a demand.
Text-based decoys can operate through authorized messaging or email environments without requiring speech processing. However, they face similar difficulties involving conversation context, unreliable information, and potentially malicious instructions.
Macquarie University researchers described an early implementation in their 2023 research report on AI-generated fake victims. Their work examined whether multilingual conversational agents could occupy scam callers and expose information about fraudulent operations.
The research illustrates a practical use of conversational AI, but a convincing automated conversation is not sufficient evidence that the person involved has committed fraud.
What Information Can a Digital Decoy Collect?
The most useful result is often not the conversation itself. Investigators want details they can verify and link to other suspicious activity.
A fraudulent payment request may expose a bank account, cryptocurrency wallet address, or payment instruction. An impersonation attempt might identify a website, telephone number, or organization whose identity is being misused.
Repeated conversations may also reveal patterns. Investigators could identify similar scripts, recurring payment destinations, or coordinated attempts to target customers of a particular institution.
These observations can help build a broader picture of a suspected fraud campaign. However, each piece of information requires careful interpretation.
A displayed telephone number may be spoofed. A payment account could belong to an intermediary rather than the person organizing the fraud. A suspicious website may be abandoned or replaced shortly after investigators discover it.
Consequently, automated intelligence should be treated as a lead for verification, not definitive proof of criminal responsibility.
Turning Conversations Into Fraud Intelligence
Raw transcripts can contain large amounts of irrelevant or misleading information. To make them useful, anti-fraud systems must identify details that can support investigation or prevention.
Information extraction software can identify telephone numbers, payment instructions, web addresses, and references to impersonated organizations. Analysts may then compare those details with other reports and independently available records.
The distinction between collecting information and understanding it matters. A language model can incorrectly interpret a statement or generate details that never appeared in the original conversation.
Verification should therefore rely on preserved evidence, not merely an AI-generated summary.
Related research offers another approach to collecting scam intelligence. A 2025 Google Research paper described a conversational AI system that interviewed potential fraud victims and converted their reports into structured intelligence for payment security teams.
That system interviewed users rather than impersonating victims to engage scammers. Nevertheless, both approaches illustrate how conversational information can supplement conventional transaction monitoring.
Can Wasting a Scammer’s Time Actually Reduce Fraud?
One attraction of automated scam-baiting is the chance to keep criminals occupied. Time spent interacting with a fake victim might otherwise have been spent contacting someone vulnerable to fraud.
However, that argument involves an important assumption: that engaging a scammer meaningfully reduces the number of real people targeted.
Criminal operations may run numerous conversations simultaneously. They can use automated messaging, employ multiple callers, or abandon an unproductive exchange without significant expense.
Long conversations alone therefore do not establish that fraud has been prevented.
More useful evidence would demonstrate that information gathered through decoy interactions helped disrupt an active campaign, identify fraudulent infrastructure, or prevent unauthorized payments.
Even then, researchers must distinguish a system’s contribution from other anti-fraud measures operating at the same time.
False Positives and the Problem of Misidentification
A system designed to interact with suspected scammers must first determine which communications warrant investigation. That decision can be difficult.
An unusual telephone call is not automatically fraudulent. A legitimate representative may use an unfamiliar number, speak with an unexpected accent, or deliver information in a way that resembles a known scam pattern.
Incorrect classification could cause a legitimate caller to reach a decoy instead of the intended recipient.
The consequences depend on the setting. A missed commercial inquiry might create an inconvenience, while a delayed medical or financial communication could have more serious effects.
Organizations should establish clear criteria for routing suspicious interactions to automated systems. High-risk or uncertain classifications may require additional verification or human review.
Evaluation should also examine whether the bot invents information, exposes sensitive details, or takes actions outside its approved purpose.
TechAmerica.ai has examined related questions in its coverage of AI agent evaluation, including realistic testing, reliability measurements, and the importance of examining how autonomous systems complete tasks.
Legal and Privacy Questions Around Automated Conversations
Using a synthetic voice to communicate with suspected fraudsters raises legal questions that vary by country, communication channel, and circumstances.
Organizations must consider rules governing call recording, consent, privacy, data retention, and the use of automated voice technology.
In the United States, the Federal Communications Commission clarified in February 2024 that AI-generated voices fall under the Telephone Consumer Protection Act’s restrictions on artificial or prerecorded voice calls. Applicable consent requirements and exemptions depend on the circumstances.
This does not mean every incoming call answered by an AI system is unlawful. It does mean organizations should evaluate the legal requirements before deploying outbound automated calls or recording conversations.
Fraud investigations can also capture personal information belonging to people other than suspected criminals. Telephone numbers, conversations, and payment details require appropriate handling.
Access to collected information should be restricted, and retention periods should reflect legitimate investigative requirements. Businesses should avoid distributing unverified accusations based solely on an automated conversation.
How Banks and Telecom Providers Could Measure Results
An anti-fraud operation needs better performance measures than the number of calls answered or minutes spent talking.
Organizations could assess how many suspected fraud indicators were collected, how many were independently confirmed, and whether the findings led to useful protective action.
For example, an investigation might establish that several reported scam attempts directed customers to the same fraudulent website. If that information supports appropriate action by a hosting provider or law enforcement agency, the result is more meaningful than the duration of the original conversations.
Other measures include false-positive rates, investigator workload, cost per verified lead, and the time required to identify suspicious infrastructure.
Independent testing matters because models may perform differently across languages, accents, and fraud scenarios. Scammers can also change their behavior after recognizing automated responses.
Testing should include controlled scenarios involving legitimate callers, ambiguous conversations, and attempts to manipulate the bot.
Why Consumers Should Not Try to Investigate Scammers Themselves
Professional fraud intelligence systems operate under conditions very different from those facing individual consumers.
People receiving suspicious calls should not attempt to imitate these systems by keeping potential scammers on the line. Extended engagement may expose additional personal information or invite repeated contact.
The FTC advises consumers to end unexpected calls claiming that their money is at risk and verify the situation using an official telephone number or application.
Its consumer guidance on suspicious financial calls also warns against sharing account information, verification codes, or remote access to devices.
Consumers can report suspicious communications through official channels, including ReportFraud.ftc.gov. Such reports can help investigators identify patterns without requiring individuals to confront suspected criminals.
The Limits of Automated Scam Investigation
AI scam-baiting bots represent an unusual reversal of the technology increasingly used in online fraud. The same advances that make automated conversations persuasive can also support systems designed to investigate deceptive activity.
The potential benefit lies in earlier access to information about fraudulent campaigns. If investigators can identify suspicious payment destinations, impersonated organizations, and related infrastructure before more victims are contacted, they may have additional opportunities to intervene.
Yet automated engagement remains one part of a larger defense. Banks still need effective transaction monitoring, telecommunications providers need appropriate call protection systems, and law enforcement agencies must verify evidence before taking action.
The next test for AI scam-baiting bots will not be whether they can keep a suspected fraudster talking. It will be whether the information they collect leads to fewer successful scams, faster investigations, and measurable protection for people whose money and personal information are at risk.
