AI decoy bots to bait and log scammers

What to build

A browser extension or SMS/email add-on for consumers and solo SMB owners that auto-replies to suspected scam texts, emails, and robocalls using an AI persona that plays along as a gullible victim, stalls the scammer, and extracts their phone numbers, payment/wallet details, and scripts into a shareable blocklist database.

Apate shows there's a viable pattern for AI-vs-scammer honeypots at the enterprise/intel level; a lighter consumer or SMB version that auto-baits spam texts and phishing emails and crowdsources the extracted scammer data could be built and sold as a simple subscription add-on.

Demand

Everyday phone and email users are flooded with scam texts, robocalls, and phishing attempts and already manually screenshot or report them to community blocklists; a tool that automates the baiting and extraction step turns a tedious chore into a passive, even entertaining, background process.

• Signal report: Apate AI agentsNews

  Reporting describes Apate as a system that sends AI agents 'undercover' into scam interactions to get scammed deliberately, with the stated purpose of gathering fraud intelligence, validating that AI-driven scam engagement is being built at the infrastructure/intel level.

Stack

• OpenAI Realtime API or GPT-4o for persona dialogue
• Twilio SMS/Voice API
• Gmail/Outlook API for email-side baiting
• Supabase for scammer/wallet blocklist database
• Telegram Bot API for alerts
• Stripe for subscription billing

Solo + AI difficulty

The AI persona and basic SMS/email auto-reply loop is a quick build with modern LLM APIs (roughly 2-4 weeks to MVP), but reliably detecting scam vs legitimate messages, sustaining believable multi-turn conversations without the scammer disengaging, and the carrier/API compliance work (10DLC registration, email provider abuse policies) are the hard, time-consuming parts.

Entry threshold

A text-based MVP can be prototyped in days using off-the-shelf LLM APIs plus SMS or email provider webhooks; the harder part is integrating cleanly with carriers or inboxes without tripping anti-abuse rules, but no licences or major capital are required to launch a personal-protection version.

Window

6-12 months

Where to find first users

• r/scams and r/personalfinance communities
• Product Hunt launch
• indie hacker and solo-builder Twitter/X communities
• partnerships with existing scam-reporting communities like r/scambaiting

Competitors

• Jolly Roger Telephone Co.
• Apate

Counter-signals & risks

• Engaging scammers via AI personas could expose the operating company or users to legal risk if interactions involve financial transactions, wire fraud facilitation, or cross-border regulatory issues around impersonation.

• Scammers may adapt by developing bot-detection techniques to identify and filter out AI decoys, reducing long-term effectiveness of the approach.

• Aggregating scammer data (phone numbers, wallet addresses) into shared blocklists raises data privacy, defamation, and liability concerns if misidentification occurs.