Journalist Spends $3.75 to Prove Anyone Can Hijack a Real Band's Spotify Page
A reporter used an AI song generator, a budget distributor subscription, and a single unchecked checkbox to publish a fake track on a real punk band's official streaming profile — a loophole scammers have apparently been running for months.
Emanuel Maiberg, a reporter at 404 Media, wanted to know how hard it would actually be to put an unauthorized AI-generated song on a real musician’s official streaming page. The answer, it turned out, was: not hard. Not hard at all. He generated a track with the AI music tool Udio, paid $3.75 for a month of the distribution service DistroKid, uploaded the song, and — when the system asked which artist profile to attach it to — selected the real, existing profile of a real, existing Brooklyn punk band called Lathe of Heaven, which he does not perform in, has no relationship with, and did not ask for permission from. He checked a box certifying that he was authorized to do this. Nobody checked whether that was true. Within a day, the track — a song titled “Riding High,” which reportedly sounds nothing whatsoever like anything Lathe of Heaven has ever recorded — was live on the band’s pages on Spotify, Apple Music, Tidal, and Amazon Music.
The entire mechanism, in other words, ran on the honor system, applied to a system that had no reason to expect honor from a stranger with five dollars and a demonstrable point to prove. Distribution platforms link tracks to existing artist profiles based on a self-reported claim of identity, verified by nothing more robust than a checkbox — no login to the artist’s own account, no confirmation email, no cross-reference against whatever ownership records theoretically exist. The industry’s verification infrastructure, such as it is, leans on metadata standards like IPI numbers that distributors aren’t actually required to check. Maiberg didn’t discover a zero-day exploit. He discovered that the door was never locked, and that he was simply the first person to point a camera at himself walking through it.
He was not, crucially, the first person to walk through it. Once the story published, it became clear this had already been a working scam for a while: outlets tracking the phenomenon separately found over 300 fake songs impersonating major and minor acts alike, with an estimated 50,000 AI-generated tracks landing on Spotify every single day, a subset of which are quietly attached to existing human artists’ pages rather than uploaded as new, honestly-labeled AI content. Scammers reportedly favor a specific sweet spot: artists popular enough that a fake track can rack up meaningful streaming royalties, but not so famous that anyone is actively monitoring the page for an unfamiliar song appearing overnight. Deceased and inactive artists are apparently especially attractive targets, for the obvious reason that dead musicians rarely file takedown requests.
This puts Maiberg’s demonstration in a slightly different light than a standard security-research stunt. He wasn’t showing a hypothetical vulnerability to a company that might otherwise have never known. He was showing, with his own byline attached to the fake song and his own editor aware of what he was doing, a vulnerability that other people were already using quietly, for money, against artists who in many cases had no idea it was happening until royalty statements or a stray fan comment tipped them off. The honest version and the scam version require exactly the same five minutes and the same $3.75. The only difference is what happens after the checkbox: one person writes an article; the other one collects a Spotify payout under someone else’s name.
The platforms’ response, gathered from their own public statements, amounts to “we’re working on it” delivered with varying degrees of specificity. Spotify says it’s testing an artist-side review tool that would let musicians approve releases before they go live — a feature that has reportedly been in limited beta since March, which is to say, since before this particular story made testing it feel urgent. The company also introduced a badge distinguishing verified non-AI music, which addresses a related but different problem: it tells listeners a track wasn’t machine-generated, not whether the artist whose name is on it actually put it there. Amazon Music says it uses “advanced detection technologies” and is in “regular dialogue with partners,” a sentence with the structural integrity of a hallway conversation nobody wrote down.
None of this is a story about AI writing convincing music, which is, if anything, the least alarming part — by all accounts, “Riding High” is bad, and sounds nothing like the band it was attached to, and got through anyway, because the system was never checking for quality or authenticity in the first place. It was checking for a checked box. The actual malfunction here predates generative AI by years; AI just made producing the fraudulent content free, instant, and infinitely repeatable, which turned a slow, manual, low-volume scam into one a single reporter could demonstrate, at scale, for the price of a coffee.
Sources: