The Copyright Office Opened a Streaming Fraud Inquiry. Question 2 Asks What the Industry Gets Wrong.

$8,091,843.64. That is what Music Business Worldwide reports Judge John G. Koeltl ordered Michael Smith to forfeit on October 6, along with an 18-month prison sentence, for using bot accounts to stream hundreds of thousands of AI-generated songs [3]. The next morning, the Copyright Office published a notice of inquiry that still describes the haul as “some $10 million” [1, 3].

The gap is small next to what the notice is actually for. It asks Congress’s questions about streaming fraud, and a few of them reach any company that pays out by the play, hosts uploads or makes generated audio.

What the Copyright Office published

The notice, FR Doc. 2026-20537 at 91 FR 64188, was signed October 5 by General Counsel Emily L. Chapuis and published October 7 [1]. Initial comments are due November 23 and replies December 21, through regulations.gov under Docket No. 2026-6 [1]. It is a notice of inquiry. Nothing in it is a proposed rule.

It exists because Rep. Scott Fitzgerald of Wisconsin, a House Judiciary member, wrote to Register Shira Perlmutter on May 21 [1, 2]. His letter asked the Office to “examine the prevalence of streaming fraud across digital platforms and how it may be affecting the music industry as a whole,” and, more specifically, the effect of AI-generated streaming fraud on sound recording, performance and mechanical royalties [2].

The notice lays out the mechanics. Most streaming services fund a royalty pool from a share of revenue and split it pro rata, so every inflated play takes money from every legitimate one [1]. For the statutory mechanical license, a “Play” is a stream “lasting 30 seconds or more,” and plays caused by user manipulation are excluded [1]. The Office lists the methods it calls common: bot farms, click farms, playlist stuffing, account hijacking, and uploading sped-up or slowed-down copies of other people’s tracks as your own [1].

It then describes what the industry already does, which the Office calls “illustrative, not exhaustive” [1]:

• Streaming services score suspected artificial streams on listening time, geography and saves-to-streams ratios, and fine uploaders. The notice cites a trade report that Apple Music’s fine now starts at 10 percent and caps at 50 percent, and another saying Spotify charges distributors $10 per track with detected fraud [1].
• Distributors run identity checks and trust-and-safety teams, and penalize clients by contract [1].
• Industry groups formed the Music Fights Fraud Alliance in 2023, and IFPI launched a Streaming Integrity Initiative with KYC and intelligence-sharing commitments [1].

Smith pleaded guilty in March to one count of conspiracy to commit wire fraud [1]. IPWatchdog reports the RIAA said after the sentence that “Streaming fraud harms creators and deceives fans” [4].

The ten questions, and the three that matter for builders

The questions run from how fraud is executed to criminal enforcement and organized crime [1]. Three stand out.

Question 2: “What industry policies or practices may be inadvertently contributing to streaming fraud?” [1]. That is an invitation to name payout designs, upload rules and distribution terms that make fraud pay.

Question 7 asks how ownership or usage data could help, listing suspicious activity reports, “a shared database to track instances of known streaming fraud,” metadata standardization and “Labeling of content that is ineligible for statutory royalties” [1]. The notice describes the problem a database would answer: fraudsters “bouncing from distributor to distributor” after detection, which led one distributor to propose “a worldwide database of individuals found to be abusing the streaming system” [1]. It cites FinCEN’s June 12 fact sheet on Section 314(b) sharing among financial institutions as a model [1].

Question 8 asks whether legislation providing “no-fault injunctive relief” could be used, citing a 2025 discussion draft, the American Copyright Protection Act of 2026 (H.R. 10364) and the DEFEND IP Act (H.R. 10575) [1].

AI gets question 4, which asks what data connects streaming fraud to AI-generated music and to royalty licensing and distribution [1]. Fitzgerald’s letter leaned harder on it. He cited Deezer’s figures that nearly 44 percent of its daily uploads in April 2026 were AI-generated and that “up to 85% of the streams generated by fully AI-generated tracks” in 2025 were fraudulent [2]. He also wrote that “there is nothing inherently wrong with using AI as a creative tool in music development” [2]. IPWatchdog noted that the notice repeats few of the letter’s generative AI concerns [4].

What it means if you build things

This part is opinion.

Read question 7 as a KYC question. If you run a distributor, a beat marketplace or any service that hands tracks to streaming platforms, a shared fraud list would decide who you can onboard. The notice asks about building one and says nothing about who maintains it, what evidence puts a name on it or how a wrongly listed artist gets off [1]. The FinCEN comparison is telling: 314(b) sharing comes with a statutory safe harbor, which suggests the people asking for a database will also ask for liability protection [1]. If you’d be on the receiving end of false positives, November 23 is when to say what due process should look like.

The labeling item is where AI music tools come in. Fitzgerald’s letter reminds the Office that it has already advised the Mechanical Licensing Collective that AI-generated music is not entitled to a royalty payment, while three performing rights organizations now accept partially AI-generated compositions [2]. A label for “content that is ineligible for statutory royalties” would need someone to decide what is AI-generated at upload [1]. If you make a generation product, your output metadata could end up being that signal, and nobody has said who checks it.

Pro-rata payouts are the design under scrutiny. The notice cites proposals to replace the pooled model with artist- or user-centric payouts [1]. If your product pays creators out of a shared pool by consumption, music or not, question 2 is describing your incentive structure too.

No-fault injunctions land on intermediaries. The notice asks whether a remedy that doesn’t require proving fault could reach streaming fraud [1]. Whoever sits between the fraudster and the royalty pool, a distributor or a hosting service, is the obvious party to be ordered to act, whether or not it did anything wrong.

This is the second federal inquiry this month asking platforms what they owe when their systems get used for fraud. The FTC’s notice on ad tools and impersonation scams, which I wrote about Monday, asks a similar question about advertising.

What I’m watching

• November 23. Initial comments [1]. I want to see whether Spotify, Apple, DistroKid and the AI music companies answer question 2 themselves or leave it to labels and publishers.
• December 21. Reply comments, where the database and labeling fights would sharpen [1].
• The report. The Office has not said when it will send Congress its findings, or whether it will make recommendations [1]. When a Fitzgerald letter prompted its inquiry into performing rights organizations, the Office’s follow-up letter to Congress contained no new policy recommendations, according to Music Business Worldwide [3].