Streaming Royalty Fraud: $10M Bot Scheme Sentences Musician to 18 Months

What Happened

A 54‑year‑old North Carolina musician, Michael Smith, was sentenced to 18 months after a court found he had used AI‑generated music and a bot network to inflate streaming counts on Spotify, Apple Music, Amazon Music and YouTube Music. The scheme ran from 2017 to 2024 and involved more than 1,000 bot accounts, 52 cloud‑service accounts and VPNs to mask traffic.

Impact

Smith’s operation is estimated to have generated roughly 661,440 streams per day, with each bot playing about 636 songs daily. The inflated streams earned the musician over $10 million in royalties. The fraud also undermined the integrity of royalty reporting for the platforms involved.

What Defenders Should Do

Defenders in the music‑distribution space should:

• Implement anomaly‑detection on streaming metrics to flag sudden, large increases in play counts.
• Enforce rate limits per IP and per user account, especially for new or unverified accounts.
• Detect and block traffic originating from known VPN or proxy services.
• Cross‑check streaming data with platform logs to verify legitimate user sessions.
• Audit royalty payouts against verified stream counts and investigate discrepancies.

Key Takeaways

AI‑generated content combined with bot networks can bypass traditional fraud‑prevention controls if traffic is routed through VPNs and distributed across many cloud accounts.