The Industrialisation of Scams: What it takes to dismantle the global fraud ecosystem

Executive Summary 

• Organised fraud and scams cost an estimated US$442 billion globally in 2025, run by transnational syndicates operating with the same specialisation and scalability as legitimate enterprises. 

• Telcos, banks and digital platforms each see one fragment of the criminal operation. Adversaries exploit that gap, and generative AI has removed most of the cost of doing so. 

• The defence must work at the same scale: autonomous, cross-sector and operating inside the adversary's own channels. Consuming their operating capacity and exposing their infrastructure is what breaks the business model. 

From fraud rings to a criminal industry 

Fraud was once the work of individuals and small, loosely connected groups. It is now an organised criminal industry, run by transnational networks built to scale. The compounds at its centre run like businesses, with a deliberate division of labour, and the proceeds fund wider criminal activity. 

Every attack comes off the same production line. Study one and you see a product: a script, a lure, a request for payment. Study thousands and you can reconstruct the factory behind them: the payment rails it ships through, the typologies it runs and the methods it refines. You can even watch its quality control at work, as the operation tests what converts, drops what fails and cuts cost with each cycle. 

Capabilities for rent: the criminal supply chain 

Much of that factory is outsourced. Criminal service marketplaces rent out targeting, scripting and payment processing the way legitimate businesses hire contractors. That modularity makes the fraud economy resilient because taking out one supplier rarely stops the line. Fraud teams that respond to individual incidents rather than to the enterprise producing them are building controls that will not hold. 

UNODC described Southeast Asia's scam ecosystem in 2024 as a commercialised network of "criminal service providers" tied to money laundering, human trafficking, cybercrime and illicit online marketplaces. A group in one country can source scripts, infrastructure and payment processing from providers in several others. Fraud is one revenue line in a broader portfolio of organised crime. 

The industry took its current shape during Covid-19. As lockdowns closed casinos across Southeast Asia, their operators moved into lightly regulated border zones and online, and filled their compounds with migrant workers left stranded by border closures, according to the UN human rights office. Generative AI has since widened what those compounds can do, adding deepfakes and voice cloning to the toolkit. The UN now estimates that at least 300,000 people work in scam centres across the region. 

Their targets sit far beyond it. When UN News covered the Global Fraud Summit in March 2026, it opened with the Sawyers, an Australian couple approaching retirement who clicked on what looked like a legitimate advert for a low-risk investment and lost more than $2.5 million. Behind a loss like that sits an entire criminal business. The same compounds launder money, traffic the people who work in them and sell their capabilities to other criminal groups as services. 

The same structure appears outside Asia. In April 2026, Austrian and Albanian authorities, supported by Eurojust and Europol, shut down a network running call centres in Tirana that had taken more than €50 million from victims across Europe. Eurojust described the centres as organised like legitimate businesses. Operators worked in teams of six to eight, grouped by language, with team leaders above them and a manager running each centre, and they earned a monthly salary of around €800 plus commission on every successful scam. The network even went back to people it had already defrauded, offering to recover their losses in exchange for a fresh deposit. When one centre closes, the network behind it can relocate, adapt and resurface in another jurisdiction.

The signals each operation leaves behind, such as scripts, phone numbers, domains and payment details, show where a campaign is moving. Linked together, they turn separate incidents into a single view of the operation. Fraud and intelligence teams get a live picture of how the adversary runs, in place of a queue of reactive alerts. 

No institution sees the whole operation 

Fraud campaigns move across three connected channels: telecommunications, banking and digital platforms. Each sector sees only the part it touches, and the adversary builds campaigns to cross between them. A single operation can move from voice to SMS to messaging apps to social platforms, so a defence built around one channel will always arrive late. 

Telcos are usually the first point of contact. They can spot spoofed calls, abnormal call patterns, SIM abuse, SMS flooding and number reuse. They cannot see the financial pathway or the intent behind the traffic. 

Banks sit at the transaction end. They see mule accounts, suspicious transfers and laundering patterns, but not the conversation that caused the transfer. 

Digital platforms see the content: impersonation posts, fake offers and the social engineering messages that start the journey but rarely see the payment movement downstream or the telecom infrastructure that keeps the campaign running. 

Each sector works with different controls, data, legal permissions and priorities. Incentives do not naturally align, and a useful signal in one sector often arrives in a format the others cannot ingest or act on in real time.

Telcos and platforms see the first contact and banks see the money. The conversation in between is visible only from inside the interaction. 

The operations themselves are global. INTERPOL reported that, as of March 2025, people from 66 countries had been trafficked into online scam centres, and 74% of those victims were taken to centres in Southeast Asia. INTERPOL has also observed centres emerging in the Middle East, West Africa and Central America. 

Blocking remains a necessary layer, but it only treats the symptom. Every blocked call or message is a missed intelligence opportunity, and no institution blocking its own slice of the operation gets close to the full picture. The response must match the structure of the adversary: cross-sector, coordinated and upstream. 

So what happens when it becomes AI vs AI? 

For most of its history, the fraud economy ran on human labour. Compounds needed operators who could hold a convincing conversation in English, scripts written and tested by people, and the time and skill to produce believable impersonation content. None of this was out of reach, but it took resources, and those requirements limited how fast an operation could grow. 

Generative AI has largely removed that limit. An operation targeting Australian retirees no longer needs an English-speaking workforce, scripts are generated and adapted in real time, and convincing content is produced at volume for little cost.  

Two patterns are emerging. AI tools now augment human operators, handling translation, scripting and personalisation in real time. The next step is AI agents that run the whole interaction, from first contact to fund extraction. Fully autonomous operations have not yet been observed at scale, but the technical capability exists and the economics point that way. 

This makes AI against AI a question of information more than model capability. Both sides know something about their opponent. A criminal operation knows its own script and has a working model of the targets it pursues. A defensive system knows its own response strategies and has a working model of attacker types. 

Only the defender can maintain two further layers: a running map of where the attacker sits in their script, and the best response from that position. Apate.ai CEO Dali Kaafar's research describes this as the Stackelberg commitment ("AI vs AI: When the Machines Fight", April 2026). The attacker cannot build an equivalent picture of the defender, because the data to construct it does not exist on their side. 

Adversary scripts are predictable. They follow recognisable structures, reuse infrastructure across campaigns and repeat the same psychological progressions across targets. A defensive system that has logged 57.5 million interactions with scammers recognises those structures from real interactions, not from inference. 

For fraud and telco teams, the goal shifts. Blocking reduces noise from a campaign already running. Intelligence from inside live interactions shows what is producing the noise, who is behind it, what infrastructure they use and where they are likely to move next. That gives you the timing advantage to act before the target is reached. 

Inside Apate's autonomous counter-intelligence model 

Apate is an autonomous counter-intelligence platform. It applies the fraud economy's own principle to the defence: industrialise the response. Criminal operations use automation to reach targets at scale. Apate deploys autonomous AI agents into those operations' own channels, stealing their time where they would otherwise steal money. 

Each conversation surfaces intelligence: scripts, phone numbers, payment cues, domains, account identifiers, channel movements, typologies and infrastructure patterns. That live adversary intelligence flows into the workflows of the fraud, telco and intelligence teams who act on it. 

At scale, that looks like this: 

This is proactive prevention and disruption. Instead of filtering events after they occur, the platform extracts intelligence from inside a campaign while it is still running. The better you understand the operation, the more precisely you can disrupt it. 

‍

‍A campaign disrupted live 

A leading Australian bank uses Apate's ScamStrike to disrupt impersonation campaigns aimed at its customers. In one example, a criminal operation impersonated a well-known bank brand across SMS and email, sending fake transaction alerts that pushed recipients to a callback number the operation controlled. Apate's AI voice agents were deployed against that number on demand. 

The agents placed 450 calls, connected on 148 and consumed 12 hours and 14 minutes of scammer time. The operation abandoned the line within 27 minutes. 

Across the engagement with this bank, 22 campaigns have been disrupted. Each campaign disruption window avoids an estimated $183,000 in customer losses, and around 15 fraud completions are blocked each month. 

This is intervention, where most controls stop at observation. Banks and telcos often surface criminal activity after money has moved. Apate engages the campaign while it is still live, which opens the window for earlier disruption. ‍

Payment intelligence before the money moves 

Each scam depends on the same endgame: conversion into money, and then movement of that money through infrastructure that obfuscates the origin and destination of the scam proceeds. This is where the scam economy starts to extract real economic harm, as proceeds move through mule accounts, crypto wallets, fintech apps and layered laundering pathways. In many cases, those layers are deliberately designed to separate the initial contact from the final beneficiary. 

For fraud teams, this is why payment intelligence matters. Identifying the accounts, wallets, and channels used in the moment, enables early intervention before a victim transfers funds or before proceeds are dispersed further through the laundering chain.  

A cross-sector response

A criminal operation crosses all three sectors, and disrupting it needs the same reach. Telcos hold network metadata: call origin, routing path, traffic patterns and peer operator relationships. Banks hold payment data: mule accounts, beneficiary networks and transaction behaviour. Neither holds what happens inside the interaction with the adversary. 

Apate sits across that gap. Live adversary intelligence enriches what telcos and banks already see, with better attribution, earlier indicators and a clearer view of the campaign behind individual events. 

For a carrier, combining that intelligence with its own network data means fraud traffic can be traced back through interconnect partners to the peer operators who carried it in. Last-mile blocking becomes accountability across the carrier ecosystem. 

With each participating institution, the platform becomes more effective for each. This is what Apate means by building the operating system of fraud across the institutions that defend against it: one live view of the adversary, shared by everyone working to disrupt it. 

The next phase of scam and fraud defence.  

Behind every fraud statistic is a person who had no realistic chance of winning. Not because they were careless, but because the magnitude of the operation targeting them was built, funded, and optimised specifically to extract money from them. On one side: organised crime groups running coordinated campaigns across multiple channels and detailed knowledge of the psychological levers most likely to work on their target demographic. On the other: one person, without warning signals and no way of knowing the interaction was designed specifically for them. 

Awareness campaigns cannot close that gap on their own, and neither can defensive controls that wait for the transaction. The defence must operate at the same industrialised scale as the attack: autonomous, cross-sector and present inside the adversary's own channels. Every minute an adversary spends engaged with an Apate agent is a minute not spent on a real person. At scale, consuming that capacity and exposing the infrastructure behind it cuts into the profits of the enterprise and starts its cascading failure. 

That is what dismantling the business model of scammers globally looks like in practice. 

If you lead fraud, financial crime or network integrity, book a threat intelligence briefing to see what Apate's agents are surfacing in campaigns aimed at your customers. 

‍

References 

• Apate.ai platform data, 2026. (Approved aggregate metrics: October 2026 metrics: scammer interactions, scammer time consumed, avoided losses, artefacts extracted and typologies mapped.) 

• United Nations Office on Drugs and Crime (UNODC). 2026. A global wake-up call to organized fraud. https://www.unodc.org/unodc/frontpage/2026/March/a-global-wake-up-call-to-organized-fraud.html 

• Global Initiative Against Transnational Organized Crime. 2025. Compound crime: Cyber scam operations in Southeast Asia. https://globalinitiative.net/wp-content/uploads/2025/05/GI-TOC-Compound-crime-Cyber-scam-operations-in-Southeast-Asia-May-2025.pdf 

• International Criminal Police Organization (INTERPOL). 2025. INTERPOL releases new information on globalization of scam centres. https://www.interpol.int/en/News-and-Events/News/2025/INTERPOL-releases-new-information-on-globalization-of-scam-centres 

• United Nations Office on Drugs and Crime (UNODC). 2024. Crushing scam farms, Southeast Asia’s “criminal service providers”. https://www.unodc.org/unodc/frontpage/2024/July/crushing-scam-farms--southeast-asias-criminal-service-providers.html 

• International Criminal Police Organization (INTERPOL). 2026. INTERPOL report warns of increasingly sophisticated global financial fraud threat. https://www.interpol.int/en/News-and-Events/News/2026/INTERPOL-report-warns-of-increasingly-sophisticated-global-financial-fraud-threat 

• Kaafar, Dali. 2026. AI vs AI: When Machines Fight. White paper.