AI Voice Agents That Waste Scammers’ Time: The Stalling Works, the Payoff Is Unproven

The problem

In a global survey of 46,000 adults in 42 markets, 57% said they had encountered a scam in the past year and 23% said they had lost money (survey figures reported by the Global Anti-Scam Alliance, a webinar post of October 2025; fieldwork dates and per-market method were not shown)². Many of the people placing the calls are not free agents: the United Nations human rights office (OHCHR) said that at least 120,000 people across Myanmar and another 100,000 in Cambodia may be held in situations where they are forced to run online scams (OHCHR estimate; date not shown on the page read)³.

Starting point. The anchor paper found AI-based scam call and text filtering in early use. The confirmed AI deployments were an Indian operator's network filter (operator-reported) and on-device detection in Google Messages (vendor-reported); large blocking counts in other countries did not say which method produced them. It found no independent comparison of scam losses with and without filtering, so the published counts show volume flagged or blocked, not scams prevented¹.

What this paper adds. Filtering sits on the recipient's side and tries to stop a scam call arriving. The possibility examined here sits on the scammer's side: an automated voice agent answers the scammer's call, keeps the caller talking, and passes what it learns, such as phone numbers and bank account details, to the institutions that can act on it.

What already works

A scripted version predates modern AI. Lenny is a freely available bot that plays pre-recorded voice messages to unwanted callers. The authors of a peer-reviewed study state that it uses no speech recognition or artificial intelligence and plays the same prompts in the same order⁴. In 200 recorded calls, callers spent 10 minutes 13 seconds on average talking to it, over about 58 turns, and recognised it clearly as a bot in 5% of calls (11 of 200). In 18 months of phone-exchange logs, 4,094 calls lasted more than two minutes; across those, the bot stalled callers for more than 385 hours, at 5.6 minutes on average. In the scam category, 89% of callers hung up. The study dates from July 2017, so it is older than three years; the recordings were chosen subjectively by the server's owner, and 78% of logged calls lasted under two minutes, partly because of call-forwarding problems⁴.

In plain terms: keeping a caller on the line does not need AI, and a script managed it for minutes at a time, though only for calls that a person chose to forward to it.

Voice agents built on generative AI. In November 2024 Virgin Media O2, a UK operator, publicly launched "Daisy", a persona of a 78-year-old grandmother built from several generative AI models, with its own phone number placed on scammers' contact lists through a technique called number seeding⁵⁶. Marketing Week reported that "over 1,000 real scammers' time was wasted on calls lasting up to 50 minutes", and ISPreview reported callers kept on the line for 40 minutes at a time (operator-reported, to January 2025)⁵⁶⁷. In one call Daisy was passed between four different fraudsters⁷. None of the pages read reports intelligence passed to banks or police, and none confirms that Daisy still operates after January 2025.

A company built for the purpose. Apate.ai, a company that originated at Macquarie University, runs conversational, multilingual AI bots on a growing set of phone numbers connected to telecom networks, which scammers are meant to find and call⁸⁹. The university's project record lists the Commonwealth Bank of Australia and the Office of National Security as collaborators, with the project running from 25 July 2024 to 15 July 2025¹⁰. In June 2025 the Australian Department of Education repeated the chief executive's figures: 600 hours of scammers' time diverted per month, and an estimate of over $1.7m in scam losses prevented per month, using an average loss of $2,365 from Scamwatch; the page gives no method for how many losses were assumed averted (operator-reported)⁸. It also said one telco used the technology to block almost 10,000 scam calls a day⁸. In July 2025 CFOtech reported that CommBank had introduced bot profiles developed by Apate, with the information gathered informing the bank's scam prevention systems in near real time⁹. By October 2026 Gulf News, relaying figures shared with TechCrunch, reported 2.5 million conversations, "the equivalent of 17 years of scammers' time", and nearly 590,000 suspicious calls diverted by the Australian provider TPG (operator-reported)¹¹. The same article said the agents gather phone numbers, bank account details, crypto wallet addresses and fraudulent websites, supplied to banks, telecom companies and other customers¹¹. A founder interview in August 2026 gave a similar figure of 600,000 scam calls for TPG in the six weeks to the end of 2025 (founder-reported)¹².

In plain terms: these figures describe activity, not results, and every one comes from the company, its founder or a partner. Every outcome figure for the AI voice programmes described here is operator-reported or founder-reported, and no independent evaluation of them was found.

Text conversations. An arXiv preprint (not peer reviewed; date not shown) studied a five-month deployment of a language-model system that replied by email to scammers. Of 2,638 seeded engagements, 1,285 (48.7%) drew a scammer reply and 466 (17.66%) led to a bank account being disclosed, at a median of 3.3 days. The analysis is descriptive, with no control group and no check that the accounts were real¹⁴. This suggests a language model can draw payment details from scammers in writing; it does not test voice calls or show that the accounts led to any action.

What does not exist. No source read evaluates any voice-agent programme independently, names a police force as a recipient of the intelligence, or discusses the legal basis for answering and recording scam calls. No evidence from the United States was found.

The possibility

One way this could work: a telecom operator feeds an automated agent from three streams. Seeded numbers draw scam calls in by design; calls that the operator's own filter judges suspicious are diverted to the agent; and text messages are answered in the same way. The agent adopts a plausible victim persona in the caller's language, keeps the conversation going, and collects identifiers. A back office would then check them and send structured alerts to the bank that holds the account, to the operator's own blocking systems and, where lawful and agreed, to law enforcement.

If that chain holds, most of the value would lie in the intelligence leg rather than in the time wasted. A bank that learns that an account is receiving scam payments could act before a victim sends money. Time wasted matters only if a scammer's labour is the scarce resource, which the OHCHR estimate of coerced workers calls into question³.

Where AI is needed. Three parts depend on AI: choosing which calls to divert (the filtering capability in the anchor paper), the conversation itself, which needs speech recognition, a language model and speech synthesis, and the extraction of identifiers from transcripts. The sources describe the conversation only in general terms, such as "several generative AI models" for Daisy and "conversational, realistic and multilingual" bots for Apate⁵⁸. Everything else is ordinary systems and policy: number seeding, call routing in the operator's network, databases, secure links to banks, legal agreements, and the human decisions to freeze an account or open a case. Because a script stalled callers without AI⁴, the case for AI rests on believability over longer calls, in more languages and in text. No source read tested that against a scripted baseline.

What would have to be true

1. Scammers must keep reaching the bots. Seeding has worked at some scale⁵⁹, but diverting a suspicious call depends on an accurate classifier, and a legitimate caller diverted by mistake would be talking to a bot; the anchor paper found false-positive rates for filtering to be provider-reported rather than independently measured¹.
2. The bots must stay convincing, including against scammers' own AI. The scripted bot was recognised in 5% of calls in 2017⁴. Apate reported that about 20% to 30% of scam text conversations already employ AI (company research, not independently checked), which could mean bots talking to bots¹². No source read gives data on how often scammers detect a modern bot.
3. Stalling must cost the scammer something that matters. If workers are held against their will³, wasted hours may cost the operators little, and the benefit would then come from the intelligence rather than the delay.
4. Intelligence must reach the right bodies quickly and by a lawful route. Banks are named as recipients⁹¹¹; no police force is. Australia's Scams Prevention Framework is described by Treasury as creating "new obligations and rules for certain businesses in sectors targeted by scammers", but the page read does not set out the obligations for telecom providers¹⁵.
5. The legal and privacy position must be settled. No source read addresses recording, retention or onward sharing of calls with scammers or with misdirected legitimate callers.
6. An independent party must measure the result. The test would be fewer losses or more frozen accounts than simpler measures achieve, with a stated baseline.

What could stop it

What the evidence shows

Outcome claims are unverified. The figures for Daisy and Apate come from the operator, its founder or a partner, and the method behind "hours of scammers' time" and "losses prevented" is not given in the sources read⁵⁸¹¹¹².

Stalling can be short. The scripted bot averaged 5.6 minutes on calls over two minutes, and 78% of its logged calls lasted under two minutes⁴. An article of June 2023 reported that Apate's early bots averaged five minutes, with an aim of 40 (researcher-reported; older than three years)¹³. No page read reports an average call length for Daisy, only the longest calls⁵⁶⁷.

Many callers may be coerced. OHCHR estimated at least 120,000 people in Myanmar and 100,000 in Cambodia may be held in scam operations³.

Engagement is partial. In the email study, 1,285 of 2,638 seeded engagements drew a reply, and the preprint notes that about half of the non-responses were inactive email accounts¹⁴.

Gaps. No source read discusses privacy or legal risk, evidence of scammers detecting bots, or police as a recipient of intelligence. Daisy was publicly described as a network of AI models answering scammers; whether it operates beyond its launch coverage is not confirmed⁶⁷.

Reasoning

The challenge question is what would make this less useful or more harmful than it first appears. A call that a bot answers is "diverted", but diversion prevents a loss only if the same scammer would otherwise have reached a real victim in that time and succeeded. The headline estimates assume that this holds.

The risk may fall unevenly. If the diversion step misclassifies, legitimate callers, including people calling about money or health, could find their voices recorded by a bot, and the operator would carry the legal exposure while a bank gets the benefit. That split of cost and benefit raises a question of who would pay, and a bank-funded model might push the operator toward volume over accuracy.

Scammers' incentives work the other way. If bots became common, a scammer could screen for them, for example by asking a caller to do something a script cannot, or move to channels that operators cannot seed. Gains from the bots would then erode.

Simpler options might do much of the job. A scripted bot stalled callers without AI⁴; account-level controls at banks, and public reporting channels such as the forwarding number to 7726 described by ISPreview⁶, also gather identifiers. If most of the value is the list of accounts and numbers, the AI conversation could turn out to be a small part of the solution, useful mainly where scripts fail: other languages, longer calls and text.

Signs to watch

• An independent evaluation of a voice-agent programme, with a baseline or control, published outside the operator.
• Disclosure by Apate or an operator of how "hours of scammers' time" and "losses prevented" are calculated.
• A police force or financial intelligence unit named as a recipient of bot-collected intelligence.
• Telecom obligations set out under Australia's Scams Prevention Framework¹⁵.
• A statement by a telecom regulator on operators answering scam calls with automated agents.
• Peer-reviewed publication of the language-model scambaiting study¹⁴.
• Confirmation of whether Virgin Media O2's Daisy remains in operation⁷.