Spotify has spent the past year quietly removing tens of thousands of fake podcasts that were allegedly being used to promote illegal online pharmacies and scam websites. Now, a new congressional report is raising questions about how the scheme was able to flourish on one of the world’s largest audio platforms in the first place.

According to the Wired report, bad actors created thousands of fake podcasts that were never intended to attract real listeners. Instead, they were designed to manipulate Spotify’s search rankings and boost the visibility of websites selling prescription drugs without prescriptions, including opioids, stimulants, and benzodiazepines.

Spotify reportedly removed more than 57,000 podcast episodes, over 3,000 podcast shows, and took action against roughly 3,500 accounts connected to the operation. The takedown came after sustained scrutiny from lawmakers and media investigations that highlighted the scale of the problem.

The report was led by Senator Maggie Hassan, who criticized Spotify for not moving quickly enough and for failing to report the activity to law enforcement despite links to websites involved in illegal drug sales.

The podcasts were never really podcasts

One of the more surprising details is that most of the content wasn’t created to be consumed.

Spotify told investigators that many of the fake podcasts functioned primarily as search-engine spam. The operators reportedly stuffed podcast titles, descriptions, and cover art with links directing users to online pharmacy websites and scam operations. The goal was to exploit Spotify’s authority in search engines and improve the ranking of those external sites.

In fact, Spotify said 94% of the removed episodes received zero plays, while 99% attracted fewer than 10 streams. However, some episodes did find an audience. A handful reportedly generated thousands of listens and included instructions for purchasing drugs such as modafinil using cryptocurrency.

The report also found similar content appearing across other podcast platforms, highlighting how easy it has become to distribute large amounts of low-quality content across multiple services at once.

AI is making the spam problem even bigger

Researchers and lawmakers believe artificial intelligence is making these operations easier to run.

The report points to AI-generated podcasts featuring synthetic voices and automatically generated content designed to mimic legitimate shows. Spotify told investigators it currently has AI moderation systems for music spam but does not specifically prohibit AI-generated podcasts. The company also acknowledged that it is not particularly well-positioned to identify AI-created podcast content.

Spotify says it uses automated detection tools, human reviewers, and external moderation services to identify rule-breaking content. However, the congressional report argues that the scale of the fake podcast operation demonstrates significant gaps in those defenses.

The incident highlights a growing challenge facing internet platforms. As AI makes it cheaper and faster to create content at scale, spam campaigns no longer need websites alone. They can exploit trusted platforms, search algorithms, and recommendation systems to reach users in ways that are increasingly difficult to detect.

For Spotify, the controversy is a reminder that content moderation challenges are no longer limited to social networks. Even podcast platforms are becoming targets for sophisticated spam operations designed to game search rankings and funnel users toward illegal or potentially dangerous services.

Spotify has removed more than 57,000 fake podcast episodes and banned 3,500 accounts tied to illegal drug promotion after a US Senate investigation exposed the scale of the problem. The episodes, spread across more than 3,000 shows, used AI-generated audio to direct listeners to websites selling modafinil, opioids, and cryptocurrency on unregulated marketplaces. Senator Maggie Hassan, a Democrat from New Hampshire, led the congressional inquiry that forced the platform to act.

The numbers are damning not for their size but for the timeline. In all of 2024, Spotify actioned just 87 accounts for similar violations. The surge to 3,500 bans in 2025 came only after CNN published an investigation in May documenting the drug-spam pipeline in detail. One podcast identified by CNN linked directly to a site called opioidstores.com, which the DEA subsequently seized.

Spotify’s own data reveals how deeply the spam had embedded itself before anyone noticed. Ninety-four percent of the removed episodes had zero plays, and 99% had fewer than ten streams, suggesting the content was indexed and searchable long before any human listener encountered it. The episodes functioned less as listenable content and more as SEO vectors, directing search traffic toward illegal storefronts.

But not all of it went unheard. Some episodes had accumulated thousands of listens, with AI-generated voices reading aloud instructions for purchasing modafinil and cryptocurrency. The content was not subtle, it was keyword-stuffed, algorithmically optimised, and designed to exploit Spotify’s historically permissive approach to podcast moderation.

The platform acknowledged in its response to Hassan’s office that it is “not particularly well-positioned” to identify AI-created podcast content. Spotify uses automated moderation for music, where it has deployed tools to detect AI-generated songs and streaming fraud, but no equivalent system exists for podcasts. The company does not specifically prohibit AI-generated podcasts in its terms of service, creating a gap that bad actors have exploited at scale.

That gap is especially striking given Spotify’s recent moves on the music side. In April, the company launched a Verified by Spotify badge that explicitly excludes AI-persona artist accounts and has begun flagging AI-generated songs that mimic real artists. But podcasts, which number in the millions and require no distributor relationship to upload, remain largely unpoliced.

Hassan’s investigation also found that Spotify did not report any of the removed drug-promotion content to law enforcement. The company pulled the episodes and banned the accounts but did not refer the material to the DEA or any other agency, even when the content contained direct links to sites the DEA later seized independently. Hassan called the response insufficient and urged Spotify to implement proactive detection rather than waiting for external pressure.

The problem is not unique to Spotify. Similar AI-generated drug-spam podcasts have been found on other platforms, though none have disclosed removal figures on this scale. The ease of creating synthetic audio, combined with the open-upload model most podcast platforms use, has made the medium a low-cost, high-volume channel for illicit advertising. AI-generated content already floods Spotify’s music catalogue without labels, and the podcast side appears even further behind on detection.

The enforcement pattern, reactive and media-driven rather than proactive, raises questions about what else is sitting on the platform undetected. Spotify went from 87 account bans in a full year to 3,500 in a matter of weeks once reporters and legislators started looking. The 94% zero-play rate means the company’s existing systems were not surfacing this content through engagement metrics or user reports, invisible until someone searched for it deliberately.

Spotify has not announced any new automated detection tools for podcast content in response to the investigation. The company said it is working to improve its systems but offered no timeline or technical details. For a platform that hosts more than five million podcast titles, the absence of podcast-specific AI moderation is no longer an oversight, it is a policy choice with measurable consequences.

TL;DR

Over 4,300 fake FIFA domains, banking malware in pirate streaming apps, and credential-harvesting phishing operations are already targeting World Cup 2026 fans ahead of the 11 June kickoff. The FBI, Group-IB, Fortinet, and Kaspersky have all published warnings.

The most oversubscribed sporting event in history is also the most phished. With more than 150 million ticket requests in the first 15 days and just six million seats across 16 cities in the US, Canada, and Mexico, the 2026 FIFA World Cup has created exactly the conditions that fraud thrives on: scarcity, urgency, and money moving fast.

Security researchers, the FBI, and multiple cybersecurity firms have published warnings in the past week describing a fraud infrastructure that is already operational, well-resourced, and scaling. The picture that emerges is not a handful of opportunistic phishing pages. It is a layered ecosystem of fake domains, banking malware, credential theft, and social media impersonation, all converging on the same window.

One operator, 300 cloned FIFA sites

The most detailed findings come from Group-IB, which tracked more than 4,300 fraudulent FIFA domains registered since August 2025. At the centre is a group it calls Ghost Stadium, a Chinese-speaking, financially motivated operation running a single phishing kit across more than 300 of those sites.

The fake is good. The page is a near-perfect copy of fifa.com, mimicking FIFA’s real single sign-on login, run by PingIdentity, down to the genuine client ID copied from the live site. It loads images directly from FIFA’s own servers, so the page looks authentic and slips past tools that flag copied assets.

The damage is in the details: the fake login also asks to reset the password. Once a victim enters credentials, the attacker locks them out of their real FIFA account and resells any tickets tied to it. Most traffic comes from Facebook ads with reused tracking codes, plus links on Telegram, WhatsApp, and in search results. Payment options include card entry, money-transfer apps like Chime and Nequi, Mexico-only processors, and a crypto option that converts card payments into cryptocurrency. That last one is a reliable tell, since FIFA’s official ticketing never accepts crypto.

13,000 domains and counting

FortiGuard Labs counted more than 13,000 World Cup-themed domains registered between January and May, roughly 8.8% of them classified as malicious or suspicious. The FBI’s public service announcement lists dozens of fake FIFA domains, from misspelled lookalikes to phony job pages, and warns more are coming.

Ticket fraud is just one piece. Group-IB also found counterfeit merchandise shops, bogus streaming sites that take a subscription fee and then install malware, and fake betting platforms that collect passport scans and selfies for identity theft. Bitdefender separately tracked FIFA lottery emails promising payouts of up to $2 million.

Group-IB estimates losses from premium and hospitality ticket fraud alone at $71 million to $474 million, with the broader campaign potentially reaching into the billions. Those are projections based on visible infrastructure, not confirmed losses.

Banking malware in streaming apps

For fans chasing free match streams, the bigger danger is on the phone. ThreatFabric observed a spike in malicious unofficial streaming apps, many posing as the popular RojaDirecta, around the recent Champions League final and expects a repeat at the World Cup on a larger scale.

Kaspersky tied those apps to two Android banking trojan families: Massiv and Perseus. Neither is distributed through Google Play, so installing one requires clicking past Android’s built-in warnings. Once installed, the malware uses accessibility tools to overlay fake bank login screens on real apps, record keystrokes, intercept one-time codes from SMS and authenticator apps, and control the screen remotely.

Perseus, built on leaked code from the older Cerberus trojan, even reads note-taking apps for saved passwords and crypto recovery phrases. The simplest red flag, according to ThreatFabric, is a streaming app requesting accessibility access. No legitimate streaming app needs it.

Social media, stolen credentials, and open Wi-Fi

Fortinet counted over 1,700 spoofed FIFA accounts, nearly 90% on Facebook and Instagram, plus a scheme using fake FIFA job ads and calendar invites to redirect applicants to a lookalike Google login. Bitdefender found more than 55 football-themed ad campaigns on Facebook and Instagram pushing counterfeit kits, fake Panini stickers, and phishing pages.

Stolen FIFA logins are already circulating. Fortinet found hundreds of thousands of user credentials, plus more than 4,600 FIFA-related URLs, in data collected by credential-stealing malware families including Vidar, LummaC2, and RedLine.

Host-city Wi-Fi is its own problem. A Kaspersky survey that drove around Mexico City, Monterrey, and Guadalajara found 10% to 12% of networks open and password-free, with the WPS pairing feature still active on nearly half. Both leave openings for rogue “evil twin” hotspots that copy a real network and quietly intercept traffic.

What to watch for

The scams leave clear tells. Buy tickets only through fifa.com, typed directly, not via an ad or search result. Enable multi-factor authentication, and treat any seller requesting cryptocurrency as a scam. On Android, refuse accessibility permissions for streaming apps. On open Wi-Fi in host cities, use mobile data for banking and email.

Meta says it is now showing warning pop-ups when people search Facebook for FIFA tickets, and it partnered with Visa to take down a Facebook network linked to fake World Cup gambling sites. The FBI is asking victims to report at IC3.

The bigger concern is what has not yet been activated. Group-IB counted roughly 3,800 fraudulent FIFA domains sitting parked and unused, ready to switch on. With ready-made scam kits and ticket-buying bots already for sale, the peak window is easy to predict: 11 June to 19 July, when searches for tickets, streams, and travel will be at their highest.

Google announced on Tuesday that Android is launching fake call detection to protect against AI deepfake impersonation scams. The feature is rolling out globally in Phone by Google to Android 12+ devices this month, starting with Pixel devices.

As people increasingly refuse to answer calls from unknown numbers, scammers are shifting their tactics by spoofing trusted phone numbers and using AI deepfake technology to sound like authority figures, family members, or employers.

For example, a person may receive a phone call showing the caller ID “Mom,” and the voice may sound exactly like her, but the caller is actually a scammer using AI tools to impersonate her and request money for a fake emergency.

The new feature is on by default and works automatically behind the scenes.

Google explains that the new feature works kind of like a “digital handshake between devices.” When a contact calls you, and you’re both using Phone by Google, their phone sends a silent confirmation signal to your device to verify the call is legitimate and actually coming from their phone.

“If a scammer tries to impersonate your trusted contact, that initial confirmation signal will be missing,” Google explained in a blog post. “Your device will instantly notice this and ping your contact’s actual device to double-check. If their real device says, ‘I’m not making a call right now,’ you’ll get a warning on your screen advising you to hang up immediately.”

The tech giant notes that it built this feature on top of Rich Communication Services (RCS), making it possible for other apps and companies to adopt the technology.

The launch of fake call detection was announced alongside other updates from Android, including a new Google Photos feature that lets users mix and match outfits and try them on virtually. The new “wardrobe” feature catalogs the clothes you’re wearing in your photo library by turning them into snapshots you can browse on your phone. The feature is rolling out next week to eligible users in the U.S., India, and Brazil with Android 10+.

Additionally, Google Play Books is getting a new “Catch me up” feature that lets users jump back into a story with a recap. Users can also highlight a passage to ask questions. These features are rolling out today for select English titles.

Google is also making it possible to search entire outfits with its “Circle to Search” feature. Now the feature will be able to find every item in an outfit at once, getting rid of the need to search piece by piece. This update is now available on all Android 14+ devices that have Circle to Search.

Yes, advancements in AI help people from different walks of life, but they have some cons. One of the most exploited con has been AI voice cloning. Over the years, it has reached the point where most people can no longer tell a deepfake voice from a real one. 

Scammers already know this, and they’ve been spoofing users’ contacts, cloning their voice, and committing financial frauds for quite some time. Android’s new fake call detection is designed to stop that exact scenario before it costs you.

How does fake call detection actually work?

Fake call detection is an industry-first feature. It identifies when a caller is not who they claim to be, even when the caller ID looks legitimate and the caller’s voice sounds familiar.

Without any action required from you, the feature operates silently in the background. When a contact calls you, and both of you are using Google’s Phone app, the caller’s device sends an encrypted confirmation signal to your device, functioning like a digital handshake, verifying that the call is coming from that person’s phone. 

This handshake is built on end-to-end encrypted RCS technology; the verification is completely private. When a scammer spoofs your contact’s number, the signal will be absent, and your device immediately pings your contact’s actual phone to check whether they are making a call.

Does the feature work for all Android phones?

When their real device confirms it is not making a call, a warning appears on your screen, telling you the call may be fake and that you should immediately hang up. The entire process happens instantly, before the scammer has had a chance to manipulate you.

Fake call detection is enabled by default. It is rolling out globally in Phone by Google this month, starting with Pixel devices, running on Android 12 and above. The only catch is that both the caller and the recipient must be using Phone app and the recipient’s device also needs RCS enabled in Google Messages.