A North Carolina musician was sentenced to 18 months in prison for collecting more than $10 million in royalties from Spotify, Apple Music, Amazon Music, and YouTube Music in a massive streaming royalty fraud scheme.
54-year-old Michael Smith pleaded guilty in March after being indicted in September 2024 for fraudulently inflating his songs’ listening stats between 2017 and 2024.
According to court documents, with help from the Chief Executive Officer of an AI music company and an unnamed music promoter, Smith uploaded hundreds of thousands of AI-generated songs bought from an accomplice to streaming platforms and used automated AI bots to stream the tracks billions of times.
To avoid detection by anti-fraud systems, he had the bots connect to the streaming platforms using virtual private networks (VPNs).
At the scheme’s peak, Smith used more than 1,000 bot accounts to boost streams artificially. On October 20, 2017, he emailed himself a financial breakdown highlighting how he operated 52 cloud service accounts, each with 20 bot accounts.
Based on his estimates at the time, each bot could stream around 636 songs per day, for a total of roughly 661,440 streams per day. At an average royalty rate of half a cent per stream, the scheme’s daily earnings reached $3,307.20, monthly earnings reached $99,216, and annual earnings exceeded $1.2 million.
One year later, on October 4, 2018, Smith emailed accomplices to say that “we need to get a TON of songs fast to make this work around the anti fraud policies these guys are all using now.” and added that they needed “a TON of content with small amounts of Streams” to not raise issues “with the powers that be.”
“By flooding music streaming platforms with automated bots in the place of consumers, and fake songs in the place of creativity, Smith robbed millions in royalty payments from genuine artists and their fans,” said U.S. Attorney Jamie McDonald.
“For example, in April 2023, the entire catalogue of Taylor Swift received 9.3 million streams on YouTube Music from family plan streams, while in the same month, Smith’s Bot Accounts used family plans to fraudulently stream his AI-generated music 80.9 million times,” the Department of Justice added.
In a February 2024 email, Smith also confirmed these claims, boasting to accomplices that the songs had generated “over 4 billion streams and $12 million in royalties since 2019.”
In addition to the 18 months in federal prison, Smith was also ordered to pay $8,091,843.64 in forfeiture and was sentenced to an additional two years of supervised release.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Wikimedia: Rogue OpenAI agents behind unauthorized Wikipedia edits
OpenAI will show visual ads in ChatGPT while you generate images
Anthropic asks Claude users to share voice data for AI model training
DIVD says Zammad zero-days enabled AI-driven network breach
Automated AI agent used to breach cybersecurity nonprofit DIVD
Anthropic asks Claude users to share voice data for AI model training
Citrix patches NetScaler SAML zero-day exploited in attacks
New Dell System Update flaw lets hackers gain root privileges
73% of orgs feel prepared for attacks. 82% had a browser incident last year anyway.
Learn how to evaluate RMM security with eight practical tests. Find gaps before scaling endpoint management across customer environments.
Free Identity Governance for up to 150 Users: Try Our Community Edition
Your access review passed cleanly, but it never saw the agents swimming under the surface. See how Token Security fishes out every one of them.
Overdue a password health-check? Audit your Active Directory for free
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
