You pay the same amount every month — whether you play one album until it wears thin or barely open the app. You probably assume that money goes to the artists you play. It goes into a pot first. Deezer, one of the services, describes the system "used by streaming platforms" plainly: listeners pay "a set monthly rate," and "subscribers' fees are distributed to artists based on their market share, no matter whether the subscriber actually listens to those artists or not."
Spotify publishes, for artists, the arithmetic it runs every month in every country: "your streams in that market ÷ total streams in that market = your share of that market's royalty pool." Your fee goes in at the top, and everyone's plays decide how it comes out.
So whose plays are in that denominator? (The arithmetic is dull. It's also where the money goes.) From 2017 to 2024, some of them came from bots run by Michael Smith, of Cornelius, North Carolina, who at times had as many as 10,000 bot accounts going at once, set up with "fraudulently-obtained debit cards"; according to the Justice Department, those accounts streamed his hundreds of thousands of AI-generated songs billions of times. He favored the kind of plan your household may be on. In April 2023, by the department's count, Taylor Swift's entire catalog drew 9.3 million family-plan streams on YouTube Music, while that same month Smith's bot accounts used family plans to stream his music 80.9 million times.
On October 6, Smith was sentenced to 18 months in prison. The next day, the Copyright Office asked the public what it knows about streaming fraud, and it put the harm plainly: "the primary harm is the dilution of the royalty revenue pool."
Put those two facts together. Every fake play that slipped past the filters and got paid came out of the same pool as the artists you play — a sliver from each of them. So who absorbs the loss? The judgment that sends Smith to prison answers in five words: "No restitution shall be imposed."
How a shared pool pays a bot
Why so many songs? Because thin is hard to see. When Smith was charged in 2024, the Justice Department quoted a December 2018 email in which he wrote, "We need to get a TON of songs fast to make this work around the anti-fraud policies these guys are all using now." A billion fake streams spread across tens of thousands of songs, the charges explained, "would be more difficult to detect."
And the money? It depends on when you count. The 2024 charges put his take at more than $10 million, the figure the Copyright Office's notice still repeats. In their sentencing letter, prosecutors said he took in more than $14 million in all from royalty-paying entities. The loss both sides agreed on, $8,091,843.64, subtracts estimates of what real listeners earned him and of "the amounts that Smith had returned to the royalty pools by purchasing many music streaming accounts."
That last clause is the scheme in miniature. The bots paid for their subscriptions (he "typically paid for" family plans, prosecutors wrote, since those "cost less per user than individual plans"), and that money went into the same pools. Then the bots streamed nonstop and took out far more than they had paid in. In a pool split by share of streams, a cheap seat that never stops playing is a money machine.
The judgment orders him to forfeit $8,091,843.64 "to the Government." U.S. District Judge John G. Koeltl's 18 months came in well under the guidelines' 46 to 57 months, and under the 24 months the Probation Office recommended. Smith had pleaded guilty in March to one count of conspiracy to commit wire fraud, which carries a maximum of five years, and is due to report to prison by January 15, 2027.
Is he an outlier? The services' own numbers can't quite say. Apple puts stream manipulation on Apple Music at "well below 1%." Deezer says fraud was 8% of all its streams in 2025, and that "up to 85% of the streams generated by fully AI-generated tracks were in fact fraudulent" that year, though fully AI-generated music draws only 1 to 3 percent of its streams. Spotify's artist page gives no percentage, but warns that undetected fakes "dilute the royalty pool, shifting revenue from legitimate artists to bad actors"; Spotify told Music Week that less than 1% of its streams are artificial. Amazon Music, among the platforms Smith drew royalties from, publishes no figure or policy page on fake streams that I could find; YouTube bars anything that "artificially increases the number of views," but publishes no such figure that I could find either. Each number is a company describing what its own systems caught, so don't rank anyone by them.
So who did he rob?
Smith's lawyers have an answer, and it isn't a silly one. The effect of any single stream on every other artist's share, they argued, "is not akin to a drop in a proverbial bucket—it is a drop in an ocean." Such "extremely diffuse" losses, they wrote, "flow from the pro rata royalty payment system."
Even the former prosecutor who supervised the filing of the charges agrees on the size. Speaking as a private lawyer on a 2025 panel (Smith's lawyers later filed the transcript with the court), Katherine Reilly said "the real victims are the artists, but each artist is losing fractions of a cent because of this streaming fraud. And artists have no visibility into any of this." The presentence report, which isn't public, says the exact loss to any individual artist would be "difficult or impossible to know," as the defense quotes it. "For that reason," the defense wrote, "the government is not seeking restitution on behalf of any artist/songwriter-victim."
The filters also caught more than the headline suggests. The Mechanical Licensing Collective, which handles songwriters' mechanical royalties, halted his payments in 2023, prosecutors wrote, and Spotify told Music Business Worldwide in 2024 that its defenses had held his earnings from Spotify to about $60,000. Caught plays earn nothing, by the services' own accounts: Spotify says such streams "do not earn royalties," and Apple's music chief, Oliver Schusser, calling fraud "a zero-sum game," told The Hollywood Reporter that "we take the money and put it back into the pool so that it goes to honorable artists."
Nor was AI the crime, and nearly everyone involved says so. Smith's lawyers stressed that it is "not inherently unlawful to use AI to create songs," and that he "initially used his own catalog of music and only turned to AI later." Rep. Scott Fitzgerald (R-Wis.), whose request started the inquiry, wrote that "there is nothing inherently wrong with using AI as a creative tool in music development," while calling fraud by bots "a clear theft of the royalty pool." Spotify says "all music is treated equally, regardless of the tools used to make it." The bots were the crime, a scheme, in the Justice Department's words, "to defraud music streaming platforms and musicians of royalty payments."
So far, so fair. But follow the defense's logic one more step. Prosecutors' reply was blunt: "while the loss may have been diffuse, the fraudulent proceeds were not—they all went into the defendant's pocket." Diffuse is the design. A pool split by share of streams spreads the cost of every fake play across every artist at once — which is why no single artist notices, why no one put a number on what any of them lost, why no restitution was sought, and why the scheme paid.
Ad fraud has a victim with an invoice
Advertising has fought audience-faking bots for years, and one prosecution there reads a lot like Smith's. In the Methbot case, the Justice Department says, companies "paid more than $7 million for ads that were never actually viewed by human internet users." Between September 2014 and December 2016, Aleksandr Zhukov ran a purported advertising network, Media Methane, and "rented more than 2,000 computer servers housed in commercial datacenters," programmed "to simulate humans viewing ads on webpages." In 2021 a federal judge sentenced him to 10 years and ordered $3,827,493 in forfeiture. A separate ring, 3ve, run by other defendants, cost businesses more than $29 million for ads no real person saw, "diverting that money away from the real online publishers for whom it was intended," in prosecutors' words. Swap "publishers" for "artists" and you have, near enough, the department's description of Smith.
Where the two worlds part is the money the filters miss. Google's help page for advertisers says you aren't charged for invalid traffic, bots included, that it detects before billing, and that if it finds some after you've been invoiced, "you'll receive a credit where appropriate and possible," though it "limits investigations to the past 60 days." The ad industry's measurement standard, from the Media Rating Council, requires accredited measurers to filter invalid traffic from the numbers "used as primary and ancillary advertising monetization inputs" (in plain English, the numbers money changes hands on; the standard says nothing about refunds). And an industry group, TAG, compiles a monthly list of data-center addresses at "a high risk of being the origin of invalid traffic."
So who eats a fake view the filters miss? The advertiser who bought it; TAG warns that advertisers "may end up paying a material portion of their campaign dollars to criminals." But an advertiser is one customer, holding an invoice, who can ask for an investigation and sometimes gets a credit. A subscriber pays the same flat fee no matter what, so the fake play bills the other artists instead. In both industries, what the platform catches comes out. In advertising, what it misses lands on a buyer who can read the bill. In streaming, it lands on every other artist in the pool — and they can't see it at all.
The seat nobody in your house is using
This part is my speculation, assembled from pieces already on the record. Say the services get good at spotting ten thousand accounts opened with a stack of debit cards. The money will look for another door, and the notice already describes one. It quotes a definition of account hijacking, which "uses compromised accounts to stream songs without the real owner knowing," and goes on: "The streams look like they come from real users because the accounts are real."
So picture the seat on your family plan that nobody in your household has opened in months — playing pleasant, forgettable tracks all night, for no one. Your bill doesn't change. And if the industry ever switches to paying each subscriber's money only to what that subscriber plays (the alternative the notice raises in a single sentence and a footnote), that quiet seat becomes the prize. A 2021 study written for the World Intellectual Property Organization (the views are its authors') warned that under such a model, "fraud could evolve towards the targeting of low-intensity or inactive users or even the hacking of sub-accounts within bundles."
Now multiply it. At a June 2026 peak, Deezer says, tracks its tool detected as AI-generated made up more than half of its new uploads. A few years on, much of what gets uploaded could be music made to be played by something that isn't listening. The industry will want what advertising already has, a shared blacklist, beyond the data that Music Fights Fraud Alliance members already share, by Billboard's account; the notice asks about "A shared database to track instances of known streaming fraud." Advertising's version comes with TAG's caveat that it "expresses no opinion" about whether any particular address on it is tied to non-human traffic. Who will speak up for the first real band that lands on streaming's list by mistake?
Change the pool, or guard it better?
Where does everyone land? On the harm, the industry speaks with one voice. The MLC told the court that fraud "redirects a portion of the existing royalty pool from every single legitimate rightsholder to fraudsters," and the RIAA says it "harms creators and deceives fans."
On the cure, they split. Warner Music Group's Jon Glass, on the same 2025 panel as Reilly, said that if revenue isn't pooled, "that's discouraging a pool of revenue that could be taken by fraudsters." SoundCloud, which pays artists who monetize through it from each fan's own money, says "bots have significantly less influence" that way. Against them, Hao Yu, an economist at the University of Glasgow, argues in a model published this year that pro-rata is "fraud-robust," with "aggregate fake streams" that "remain bounded." Symphonic Distribution's Patra Sinner, responding to Glass on that panel, applauded those efforts but warned that "fraud will adapt itself no matter what you do."
On AI itself, the musicians' union UMAW wants streaming platforms to "reject GenAI music outright," the opposite of Spotify's equal-treatment stance.
And on the sharpest remedy the notice floats, "no-fault injunctive relief" (in the bills it cites, court orders to block websites), the think tanks and advocates split too. The free-market R Street Institute warned that site-blocking proposals "will most likely result in overenforcement"; the civil-liberties group EFF says the DEFEND IP Act would "incentivize censorship, overblocking"; the tech-policy think tank ITIF says "courts should be able to block foreign pirate websites." All three were writing about piracy sites, so treat them as a preview of that fight.
What does this mean for you?
As of October 30, 2026:
Comment by 11:59 p.m. Eastern on Monday, November 23. Replies are due by 11:59 p.m. Eastern on December 21. Everything goes into the public docket, COLC-2026-0166 (the Office calls it Docket No. 2026-6). Regulations.gov shows the December 21 reply date; first comments are still due November 23.
Keep it short, or attach a file. The Copyright Office explains how to file a comment: type up to 5,000 characters, or upload one file (searchable PDF, Word, WordPerfect, RTF or plain text, up to 6 MB) with your name at the top. Writing for yourself? Enter your own first and last name and leave "I am submitting on behalf of a third party" unchecked. Everything you submit "will be publicly available." If you can't file online, the notice lists a contact for special instructions.
Say something specific. The notice lists ten subjects. If you think the pool itself is part of the problem, the second asks it straight out: "What industry policies or practices may be inadvertently contributing to streaming fraud?" Others cover fines and clawbacks, that shared database, "Labeling of content that is ineligible for statutory royalties" and "no-fault injunctive relief."
Know how your fee is split. SoundCloud's Fan-powered Royalties follow each fan's money to the artists that fan plays, but they "only apply to plays on SoundCloud." Deezer keeps a shared pool but, for most of its partners, pays songs by artists who clear a threshold (in its 2025 description, 1,000 streams from 500 different subscribers a month) "twice the amount per stream," a boost that comes out of everyone else's share. Neither model ends fraud. Both change who gets paid.
If you make music, with or without AI, never pay for plays. Spotify says services that sell streams "violate our terms & conditions," and Apple says anyone who claims to get you more plays for a fee "is not authorized to do so by Apple." If Spotify finds artificial streams on your tracks, your distributor "may issue warnings, charge a penalty fee, suspend the user's account, or remove the music." You can also flag suspicious playlists to Spotify.
Guard your own account. Hijacked accounts stream "without the real owner knowing." A glance at your listening history now and then, for plays you don't recognize, is cheap insurance.
If the bills matter to you, tell your members of Congress. The site-blocking bills the notice cites (H.R. 10364, and the DEFEND IP Act, H.R. 10575, which has a Senate companion, S. 5529) and the Living Wage for Musicians Act (H.R. 5664), which UMAW backs, all sit in committee, and they die if they haven't passed when the 119th Congress ends on January 3, 2027.
The lesson, as I see it
A shared pool is a generous idea: everyone pays in, and the music people play most gets paid most. Its blind spot is the one Smith found. Spread a theft thin enough and no single victim can see it, the loss gets hard to price — and the thief keeps the margin.
The services say the plays they catch earn nothing, which leaves that money for everyone else. The open question is the plays they miss, and the ones they find only after paying for them. Apple's Schusser told The Hollywood Reporter that raising its penalties "takes the money from people who are cheating and puts it back into the system for those who aren't." As of October 30, I could find no service that publishes how much it puts back. In advertising, a buyer billed for bots can ask Google to investigate and may get a credit "where appropriate and possible." An artist whose share shrank can't ask anyone; the artist never sees the bill.
My vote? Treat the artist like the advertiser. When a service finds fake plays it has already paid for, it should rerun that month without them, credit every real artist the difference (Spotify says it runs the streamshare math every month anyway) and publish what it moved. No court measured what each artist lost to Smith. The services hold the only numbers that might.
Inquiries can end quietly. Billboard notes that an earlier one Fitzgerald helped prompt, into performing-rights organizations, "concluded without any Copyright Office action." This one takes first comments until November 23. Make it hard to ignore.
Ten thousand listeners, and not one of them heard a note.