--- title: "The Scambaiter Who Makes AI Bots Bankrupt Each Other" published: 2026-10-30T00:05:02.346Z updated: 2026-10-30T00:05:02.519Z author: "Trust Onion Editorial Team" canonical: https://trustonion.io/blog/scambaiter-kitboga-ai-bots-bankrupt-each-other --- # The Scambaiter Who Makes AI Bots Bankrupt Each Other **Cite as:** The Scambaiter Who Makes AI Bots Bankrupt Each Other, Trust Onion, 2026-10-30. https://trustonion.io/blog/scambaiter-kitboga-ai-bots-bankrupt-each-other A scambaiter named Kitboga found a way to make AI phone scam bots talk to each other until the scammers run out of money, one costly token at a time. Every response an AI scam bot generates costs the scammer real money in compute tokens. Kitboga, a well-known scambaiter, figured out that if you patch two of those bots together on a live call, they will happily deceive each other in an endless loop, and the meter keeps running on the scammer's bill. The tactic, covered by Boing Boing on October 29, 2026, is as elegant as it is absurd. AI-powered call centers have replaced the old model of hiring rooms full of people to cold-call potential victims. The AI agents are cheap to run at scale, but not free. Each conversational turn costs tokens, and Kitboga's merge trick turns that cost structure against the operation itself. These are no longer one-person operations running a script from a kitchen table. They are automated systems built on the same large-language-model technology that powers legitimate business tools, optimized to sound credible and keep a target on the line long enough to hand over money or account access. ## The Voice Is the Trap AI scam calls work because the voice sounds right. It can answer follow-up questions, adapt to objections, and stay calm under pressure. Caller ID can be spoofed to show a bank name or a number you recognize. A familiar tone is not proof of anything, and neither is a number on your screen. That gap is what a private three-word challenge closes. Trust Onion gives anyone a simple way to verify a caller who claims to be their bank, a government agency, or someone they know personally. The caller either knows the current words or they do not, and no AI agent patched in from a scam call center will know them. ## What Kitboga's Trick Reveals The merge technique works because the bots have no way to detect they are talking to each other rather than a human. That same blind spot is worth keeping in mind from the other direction. When an AI scam bot calls you, it has no idea what private information you and your bank or your family have agreed on in advance. If a caller claims urgency, whether it is a frozen account, a suspicious charge, or a relative in trouble, slow down. Hang up and call back on a number from your card, your bank's official app, or an independently sourced contact. A successful callback does not prove the original caller was legitimate either; if someone claiming to be a person you know called you, they still need to know your private Trust Onion three words before you act on anything they asked. Kitboga's bots drained each other's budgets because neither one could produce a secret the other was holding. The scam call that hits your phone operates on exactly the same weakness. The best counter-tactic available to an ordinary person is quieter than merging two bots together, but it ends the call just as fast. ## A controlled voice-cloning safety demonstration [Try our tool to see just how easy voice cloning is](/clone-my-voice). This controlled safety demonstration exists only to show how easy voice cloning is and to make the risk tangible. It is not a real incident or proof of anyone's identity. Your submitted sample is handled transiently to generate the fixed demonstration audio. Trust Onion does not identify you or the person from the sample, and does not keep the submitted recording or generated audio. The temporary voice clone is deleted from our voice provider as soon as the demo finishes; if that deletion fails, it is retried automatically until the provider confirms it. ## Key takeaways - AI-powered scam call centers charge real money per token, and scambaiter Kitboga exploits that by making two bots drain each other's budgets. - A convincing voice and a spoofed caller ID are not proof of identity, no matter how legitimate the call sounds. - A private challenge that only the real caller can answer, like Trust Onion's three rotating codewords, stops AI scam calls that a human voice alone cannot. ## Frequently asked questions ### How does Kitboga make AI scam bots bankrupt each other? By merging two live AI scam calls together, the bots talk to each other in a loop. Every response costs the scammer tokens, so the bots keep running up the bill until the operation runs out of budget. ### Can AI phone scammers fake any voice or caller ID? Yes. AI can clone voices to sound like a bank representative or someone you know, and caller ID can be spoofed to show a familiar number or name. Neither is reliable proof of who is actually calling. ### How can I verify a phone call is really from my bank or someone I trust? Hang up and call back using a number from your card, statement, or the institution's official app. For people you know personally, a shared private challenge like Trust Onion's three rotating codewords adds a check no AI caller can fake. ### What is Trust Onion and how does it stop AI scam calls? Trust Onion is a free app that gives you three private codewords that rotate every 60 seconds. Anyone claiming to be someone you know or a trusted contact must supply the current words, which no scam bot can know. ## More from Trust Onion Verify anyone who claims to be someone you know or a trusted institution with Trust Onion. Three rotating codewords, free to use, and no AI agent will ever know them. **Safety note:** If you cannot reach the person or organization when you call back, do not assume the original caller was really them. For someone in your trusted group, ask them to give all three current words first and check privately in your app; never reveal your words to an unverified caller. For a bank or other organization outside your group, verify through the official app or a number from a card or statement. Use your best judgment, and alert the authorities if you believe someone is in danger.