A North Carolina musician pleaded guilty after admitting that he got millions of dollars through a sophisticated fraud against streaming services: he generated and raised hundreds of thousands of tracks created by artificial intelligence, then made them sound artificially billions of times with bots to collect royalties. According to the judicial documents, the scheme operated for several years and exploited the payment rules for platforms such as Spotify, Apple Music, Amazon Music and YouTube Music.
The economic figure is no less: we are talking about more than $10 million in royalty payments that the defendant obtained through this system. The Department of Justice and the Office of the Federal Prosecutor of the Southern District of New York published information on the prosecution and the roles of the case; the official communiqué is available on the government's website ( Department of Justice communiqué) and the court documents that were revealed at the start of the case ( judicial documents).

The modus operandi combined two elements: on the one hand, the mass production of songs with IA tools and on the other, the use of automated accounts to inflate reproductions. Sources of the case detail that the defendant bought large lots of tracks generated by a third person and uploaded them to the streaming catalogues. For these tracks to account for reproductions and generate payments, he used bots that simulated listening from many different directions, using cloud services and virtual private networks (VPN) to try to avoid platform anti-fraud systems.
Rationality of fraud: The posts and records of the defendant himself show that the strategy sought "a lot of content with few reproductions per track" to avoid alarms: that is to say, multiply the songs and distribute the listeners so that the set will add up huge amounts without shooting off peak detections on specific topics. At the time he managed hundreds of cloud accounts and coordinated more than a thousand simultaneous bots, with internal calculations on how many tracks each bot could play a day and what average revenues would generate those volumes.
The numbers in the file are illustrative of the scale: the defendant planned to operate dozens of accounts in the cloud, each with multiple bots, and estimated that the whole could generate several hundred thousand streams a day. With a conservative estimate of the reproduction payment, these figures were translated into thousands of dollars per day and hundreds of thousands per month, according to their own calculations. In subsequent posts he also boasted that the project had accumulated billions of streams and millionaire payments since 2019, according to prosecutors.
Why does this hurt the industry? Because platforms distribute money that comes out of subscriptions and advertising; when royalties are paid for fraudulent reproductions, that money stops reaching legitimate artists, producers and headlines. In addition to the direct economic impact, fraud masks real consumption data, makes it difficult to detect trends and erodes trust between creators and digital distribution services.
In the face of this type of abuse, the platforms offer tools and policies to identify abnormal behavior and purify metrics. Spotify, for example, has guides and processes to account for and distribute royalties and to investigate suspicious activity in artist accounts ( royalties in Spotify for Artists). However, the case shows that the combination of generative IA and automated networks complicates detection: it is a race between fraud techniques and control mechanisms.
From the legal point of view, the accused pleaded guilty to a charge of conspiracy to commit electronic fraud and accepted a confiscation of more than $8 million; he also faces a maximum sentence of up to five years in prison. The prosecutor's office stressed that, although the songs and listeners were fictitious, the losses to legitimate rights holders were real, and criminal action seeks both restitution and deterrence ( Public prosecutor's statement).

Beyond individual punishment, this episode opens a broader discussion on how to regulate and audit value chains where artificial intelligence can generate content without clear human authorship. Public institutions and copyright management bodies must be adapted: source verification systems, more reliable metadata and agile audit processes become necessary tools to protect creators and consumers. For those who want to deepen the legal framework and the possibilities of defence of works, the U.S. Copyright Office. United States. provides resources and guides on registration and protection.
This case also highlights the importance of transparency in payments and collaboration between platforms, editors and collective management bodies. The companies that pay royalties must invest in more sophisticated detection systems and protocols that allow an efficient verification of the authenticity of a catalogue. And artists, for their part, should be attentive to their reports, register their works correctly and use collective management organizations to audit suspicious revenues.
In short, what happened is not just a technical fraud: it's an alert call. on how artificial intelligence multiplies abuse vectors in digital metric-based industries. The solution does not go through a single technology, but through a combination of better controls, cooperation between actors and up-to-date legal frameworks that allow for rapid sanctions and the restoration of diverted funds.
Related
More news on the same subject.

18-year-old Ukrainian youth leads a network of infostealers that violated 28,000 accounts and left $250,000 in losses
The Ukrainian authorities, in coordination with US agents. They have focused on an operation of infostealer which, according to the Ukrainian Cyber Police, was allegedly adminis...

RAMPART and Clarity redefine the safety of IA agents with reproducible testing and governance from the start
Microsoft has presented two open source tools, RAMPART and Clarity, aimed at changing the way the safety of IA agents is tested: one that automates and standardizes technical te...

The digital signature is in check: Microsoft dismands a service that turned malware into apparently legitimate software
Microsoft announced the disarticulation of a "malware-signing-as-a-service" operation that exploited its device signature system to convert malicious code into seemingly legitim...

A single GitHub workflow token opened the door to the software supply chain
A single GitHub workflow token failed in the rotation and opened the door. This is the central conclusion of the incident in Grafana Labs following the recent wave of malicious ...

WebWorm 2025: the malware that is hidden in Discord and Microsoft Graphh to evade detection
The latest observations by cyber security researchers point to a change in worrying tactics of an actor linked to China known as WebWorm: in 2025 it has incorporated back doors ...

Identity is no longer enough: continuous verification of the device for real-time security
Identity remains the backbone of many security architectures, but today that column is cracking under new pressures: advanced phishing, real-time proxyan authentication kits and...

The dark matter of identity is changing the rules of corporate security
The Identity Gap: Snapshot 2026 report published by Orchid Security puts numbers to a dangerous trend: the "dark matter" of identity - accounts and credentials that are neither ...