Fake musicians ‘making billions from AI songs’

Fake musicians are raking in billions from creating artificial intelligence songs and uploading them to streaming websites, experts have warned.

The cyber criminals use AI to generate songs, and then deploy fake listeners known as bots to stream the music and generate profit from the royalties.

In one example, which reached court earlier this month, a man from North Carolina was alleged to have raked in $10 million by posting fake songs on platforms including Spotify and YouTube Music that were played billions of times.

Michael Smith, 52, has been charged with offences including wire fraud and money laundering conspiracy. He is reported to have pleaded not guilty to the charges, each of which carry up to 20 years in prison.

Experts warned that his alleged scheme was not particularly sophisticated by the standards of fraud on music streaming platforms, and represented just the tip of the iceberg.

Morgan Hayduck and Andrew Batey, chief executives of fraud detection platform Beatdapp, said similar schemes were pulling in at least a billion dollars a year in royalties.

Bot farm

“A billion dollars per year in loss is the floor. What’s most noteworthy about the Smith case is that it was not a sophisticated scheme – it was a garden variety bot farm,” they said in a statement.

“Beatdapp regularly detect much, much more sophisticated attacks. For example we’ve seen schemes leveraging stolen accounts of real users at scales that exceed the size of the Smith bot farm.

“We think there are more organised, more sophisticated cybercriminals perpetrating streaming fraud at levels that make the Smith case look like a rounding error.”

They added: “The industry is finally starting to wake up to the magnitude, size, and severity of this growing problem.”

Mr Smith was said to have earned millions of dollars from his criminal enterprise over the course of seven years, despite using unlikely song titles that included “Zygotic Washstands”, “Zymotechnical” and “Zygophyllum”, according to a sample released by prosecutors.

The songs were said to have been performed by artists who went by names including Calm Baseball, Calm Scorching, Calm Connected, Calm Knuckles and Calorie Screams.

Spotify said in a statement that Smith was only able to cash in a tiny amount of his $10 million haul on its platform thanks to its anti-fraud measures.

“Spotify invests heavily in automated and manual reviews to prevent, detect, and mitigate the impact of artificial streaming on our platform,” it said.

“In this case, it appears that our preventative measures worked and limited the royalties Smith was able to generate from Spotify to approximately $60,000 of the $10,000,000 noted in the indictment.

“As Spotify typically accounts for around 50 per cent of streamshare, this shows how effective we are at limiting the impact of artificial streaming on our platform.”

France’s Centre National de Musique concluded in 2023 that up to 3 per cent of music streams – approximately three billion – originated from “bot farms”.