The case nobody prosecuted
In 2017, a single Bulgarian operator ran 1,200 Spotify Premium accounts on continuous loop across 467 tracks. Estimated monthly plays: 72 million. Estimated diverted royalties: roughly $1 million. The Quartz investigation that documented the case made the operational detail public.
What made it a forensic landmark was not the prosecution. There was no prosecution. The operator had not technically violated Spotify's terms of service at the time. The platform identified the pattern, closed the loophole, and the activity stopped. The model survived in spirit. Other operators studied it and refined it.
Why the model worked
The Bulgarian case is the archetype because it shows what plausibility looks like at scale. 1,200 accounts is small enough to remain below most aggregate thresholds and large enough to move the metric. Continuous loop across hundreds of tracks distributed listening, smoothing the per-track shape that a tighter focus would have produced. Subscription costs were carried as the cost of doing business, offset against per-stream royalty payouts.
The structural lesson is unchanged eight years later. Manipulation that looks like high-volume normal listening behaviour is harder to flag than manipulation that looks like manipulation.
The clustering principle
Geographic concentration is the most reliable first marker. Not because it proves manipulation. Because it raises the cost of explanation.
A single city spike can be explained. A cluster across multiple smaller markets, with limited historical engagement, appearing simultaneously, requires more scrutiny. The Bulgarian case clustered in one country because that was where the accounts and infrastructure lived. The fingerprint was not in the play counts. It was in the listener-side uniformity those play counts implied.
The pattern's modern shape
Eight years on, the infrastructure has matured. Eurojust's November 2024 disclosure of an illegal streaming network operating across Romania, Croatia, Italy, the Netherlands and Sweden documented 22 million users and reported revenues of approximately EUR 250 million monthly. Eleven arrests followed in Croatia, EUR 1.6 million in cryptocurrency was seized, and 31 individuals were charged.
The Eurojust case is a piracy operation rather than fake-stream inflation. The structure is what carries across. Eastern European hosting and operator networks running music-related infrastructure at industrial scale are documented in law enforcement record. The geography is not coincidental.
The Bulgarian model in 2017 was identified, not prosecuted. The Smith case in 2024 was identified and prosecuted. The model is the same. The enforcement environment is not.
The enforcement paradigm has shifted
For most of the 2017 to 2023 window, streaming manipulation carried weak consequences. That has changed. In September 2024, US federal prosecutors charged Michael Smith with running an AI-generated catalogue of hundreds of thousands of tracks across 1,040 platform accounts. Smith pleaded guilty in March 2025 and forfeited $8.09 million. It is the first US criminal prosecution of streaming fraud.
Per-track financial penalties for artificial activity, royalty withholding, and distributor-level penalties extend the cost beyond the individual track. The financial calculation has moved.
The distributor's dilemma
Once a pattern is identified, the question shifts to what to do. The options are not simple. Immediate takedown removes the artificial activity but risks removing legitimate listeners on the same network. Monitoring allows further documentation but permits continued manipulation. Partial intervention is operationally complex.
Real audiences exist in every market repeatedly cited as a fraud source. Acting too broadly harms legitimate users. Acting too narrowly allows the manipulation to continue. The decision is always made under uncertainty.
The repeatable lesson
The value of the case archive is not in the specific territories. It is in the pattern. Unexpected geographic clustering. Behavioural uniformity. Lack of external corroboration. Sustained, controlled activity. The architecture from 2017 is recognisable in 2025. The enforcement environment around it is not.
Without an internal flagging structure, responses are inconsistent. With one, they become operational.
Close
A geographic anomaly is not proof. It is a starting point. The Bulgarian case showed what the model looked like when it was profitable and unprosecuted. The Smith case showed what happens when it is not. The structure between them is the same.
The difference between audience growth and artificial support is not always visible at first glance. With named cases, primary sources, and a method to read the pattern, it is observable.