AI Music Scammers Hijack Human Creators’ Profiles

Late last week, Emanuel Maiberg at 404 Media published an article in which they hijacked the account of a small New York punk band named Lathe of Heaven, successfully publishing an unauthorized song on the band’s profile.

The “hack” was remarkably simple. Maiberg simply used an AI music generator to create a short song. He then had a different AI generate cover art for the song. He then took the song and artwork to Distrokid, an independent music distribution company, and, for the low price of $3.75 per month, was able to publish the song to the band’s profile.

In addition to Spotify, the song also appeared on the band’s profile in Apple Music, Tidal and Amazon Music. The song, entitled Riding High, sounded nothing like the band’s actual music. To any knowledgeable listener, it was obvious that the track was a fake.

On one hand, it would be easy to dismiss this as a one-off fluke. However, Maiberg wasn’t showcasing a novel scam, rather, they were illustrating an ongoing trend that has resulted in hundreds, if not thousands of fake songs being published on the channels of real artists.

The reason is simple. No one is checking. Though this has been the case for as long as there have been streaming platforms, AI has made this problem much worse, creating a very real need to verify that a track is actually by the person or people listed in the metadata.

However, creating such a system might be far more difficult than it seems, especially when it comes to independent artists.

Understanding the Problem

Maiberg’s story illustrates the problem succinctly. He was able to generate a track along with some cover art and then upload it to the various streaming platforms with nothing but the name of the band. Maiberg was technically honest about everything else, putting his name in every other field. All he needed to do was select the band, which was pre-recognized by Distrokid.

The outcome was that the song would be featured on Lathe of Heaven’s profile, but he would get the royalties for the streams.

Technically, any artist is vulnerable to this problem. Even Taylor Swift has had AI-generated songs published on her profile.

However, larger artists, like Swift, typically have teams who monitor their profiles and can quickly remove fake songs. As such, scammers are often looking for a “sweet spot” of artists who are popular enough to generate royalties, but not so popular that they will quickly remove the fake songs.

To that end, the focus has largely fallen on two classifications of artists: independent artists and artists who are not long active (due to retirement or death).

The reason is self-explanatory, these are accounts that are unlikely to be actively monitored. As such, the “new” music will likely go unnoticed and generate royalties for a long time to come.

But this raises a simple question: Last week, we discussed the practice of retroactively granting songwriting credits to artists. In that, we discussed how the music industry is unique in its ability to retroactively grant songwriting credits. But why doesn’t that help here?

The Dual Rights Problem

As we discussed previously, there are two separate copyrights that exist within each song. The first is the copyright in the composition, which includes the written music and lyrics. That is often referred to as the publishing rights.

This second refers to the copyright in the sound recording. That is often referred to as the master rights.

On the songwriting side, most artists register their work with a performing rights organization (PRO), which assigns them an Interested Party Information (IPI) number. Every songwriter, publisher and pseudonym has an IPI number. That number can then be used to divvy up songwriting royalties for a particular song. Other metadata is used to track the song, album and other details.

This is the mechanism that’s used to grant retroactive songwriting credits.

For better or for worse, when using a service like Distrokid, an IPI number is not required. In fact, you don’t need to register with a PRO at all.

While, obviously, IPI numbers are not a perfect system, they do add a layer of protection against this kind of abuse. But they can’t provide any protection if they aren’t required.

That said, the reason they aren’t required is valid. Many independent artists simply don’t have access to these services. There are a myriad of reasons that an artist may not have an IPI number or other metadata. Services like Distrokid serve everyone from a teenager making their first song in a bedroom to established acts.

But even if IPI numbers were required tomorrow, there would still be a major problem. Many artists simply don’t have that metadata. Though the database of IPI numbers is impressive, it’s far from complete. The system has to allow for the edge cases where the metadata isn’t available.

That brings us back to Distrokid. While it’s true that they don’t verify, neither does Spotify, Apple Music, Tidal and other companies. In many cases, verification is virtually impossible. These services need to make a difficult choice, do they want to be accessible to the largest number of artists possible, or do they want to ensure that no bad information is published?

Those two goals are almost mutually exclusive.

Bottom Line

Services like Distrokid are designed to make it easy for new artists to get their music on the various streaming platforms. That was a noble goal as many artists struggled to find an audience without a record label or other industry backing.

But with that ease of access comes bad actors. To be clear, this is not a new problem. For example, in 2022, there was an issue where scammers would attempt to hijack a song’s royalties by using “track liking” to upload competing royalty claims.

But AI brings with it a new issue. Now that its easy to generate a song with a click, people are going to try and find a way to exploit that. Sure, some have used AI to create fake artists but those often struggle. Not only is there limited interest in unknown artists, there’s even less interest when the artist isn’t real.

So now the shortcut is to slip those tracks into the profiles of legitimate artists. However, a system that is focused on ease of upload and working around missing metadata is ill-equipped to address this issue.

Spotify has announced that it is working on a system where artists will have to verify new tracks are theirs. While that is a good step, it feels like the bare minimum. I think it’s telling that such a basic step wasn’t required before.

But while steps like this can help, there is a much bigger problem with the music industry as a whole. Though the industry has done amazing work in its record-keeping, errors and issues create edge cases that can be exploited.

Those issues weren’t too prominent when the music industry was dominated solely by large companies and organizations. But as it has been democratized scammers have repeatedly found new ways in. Now, with AI, the problem is getting exponentially worse.

Without a reckoning from the music industry as a whole, this problem is only going to get worse.