Ai-generated tracks and fake streams: how one man milked spotify for $8 million
Michael Smith’s playlist was never meant for human ears. Over three years his server farm spun up 661,440 daily plays of songs that no one requested, no one shared, and—until the indictment—no one realized were hollow. The cash register, however, rang loud: more than eight million dollars in royalties, siphoned from the very platforms that promised to democratize music.
A botnet dressed up as fandom
The setup was almost elegant. Smith fed prompts into a generic generative-music API, flooded the output with random Spanish-sounding band names, and uploaded the tracks to Spotify, Apple Music, Amazon Music and YouTube Music. Then he registered 10,000 fake e-mail addresses, paired each with a headless browser, and let the scripts loop his catalogue 24/7. Every stream triggered a micro-payment; multiplied by sleepless code, the cents became a fortune. Investigators say the network peaked at 6.5% of the daily U.S. royalty pool on one indie distributor, a stat that kept fraud-detection teams awake longer than any raver.
The detect-and-retaliate arms race is brutal. DSPs look for tell-tale signs: identical track duration, clustered IP geolocation, zero skip rate, playlists with zero social shares. Smith’s code randomized length, spoofed IPs across 52 countries, and even inserted synthetic pauses to mimic kitchen breaks. It worked—until it didn’t. A coalition of anti-fraud units inside Sony, Universal and Spotify pooled metadata and found the same AI vocal timbre buried under 3,800 different track titles. One e-mail from a junior data analyst in Copenhagen to the IFPI cracked the scheme open.
From bedroom coder to federal inmate
Agents arrested Smith, 52, at his ranch in North Carolina last October. Prosecutors charged three counts: wire fraud, conspiracy to commit wire fraud, and money laundering—each carrying up to twenty years. The defense argued he merely exploited “a loophole,” but the jury needed four hours to disagree. He now faces a maximum five-year sentence, plus forfeiture of the ranch, a Tesla Model S, and 2.3 million in crypto traced through chain-hopping mixers. Sentencing lands July 29; the DOJ still calls the penalty “light” compared with the 60 years originally sought.
Industry bean counters, meanwhile, are rewriting the beans. Labels quietly yanked 7% of their AI-generated catalogues in March, erasing 1.2 billion historic streams overnight. The mechanical-royalty pot for human artists will jump roughly 0.8 cents per stream this quarter—small change for Drake, real money for bedroom guitarists. DSPs have begun requiring notarized affidavits of human authorship for uploads exceeding 10,000 monthly streams, a bureaucratic trick that feels like DRM déjà vu.
The next song will sound faker
Smith’s grift is neither alpha nor omega. A Danish syndicate ran a smaller clone last year; Korean police just raided a ring using synthetic K-pop voices; and TikTok is piloting a tool that labels AI vocals in real time, although creators already sell plug-ins that strip the watermark. The cat-and-mouse loop spins faster than a 45-rpm single.
Here’s the kicker: the same APIs Smith abused are now licensed to mood-music startups that supply Starbucks and Uber. Your latte might be soundtracked by code that once financed a mansion in Asheville. Somewhere a server rack is humming a melody no one will remember, but the invoice it generates could fund someone’s retirement. Listen closely; if the chorus never drops, it might be the sound of money laundering in C major.