There’s a rapper on Spotify named Lil Kambo who’s racked up 2 million streams and counting on his song “Kid Carti.” This would be a significant feat for any unsigned, self-releasing artist in the modern day. The only problem is that “Lil Kambo” doesn’t exist and “Kid Carti” is a pitch-shifted leak of Playboi Carti’s yet-unreleased track “Kid Cudi” (previously referred to as “Pissy Pamper”), a song the rapper’s been teasing for some time and even playing out live. Lil Kambo isn’t a viral hit—he’s a fraudster.

This unofficial leak, uploaded to Spotify on April 19, racked enough plays in recent days to top the U.S. Viral 50 chart on Spotify, as Genius pointed out earlier today. A peek around the metadata gives us a couple bits of information: “Kid Carti” is credited on Spotify as being written and performed by Lil Kambo, and it was uploaded to the platform via Distrokid, the digital distribution company in which Spotify owns a minority stake as of last year. The only other songs on Lil Kambo’s profile, “Diamonds Real” and “Made It Back,” are previously leaked Lil Uzi Vert songs.

The “Fans Also Like” tab on Lil Kambo’s Spotify profile reveals even more impersonators, two of whom are using a press shot of Playboi Carti with the monikers Unocarti and Unocompac. All of these profiles—which are “verified” by Spotify as of press time—are seemingly operated by the same person behind Lil Kambo. Unocarti and Unocompac’s profiles also feature previously leaked music, much of it distributed via Distrokid. Searching for those artist names on Apple Music reveals similar leaks, also distributed via Distrokid.

Fraudulent releases are nothing new on sites like YouTube and SoundCloud. But these recent unauthorized uploads, as demonstrated by the unauthorized Beyoncé and SZA releases back in December and a “Fenty Fantasia” leak of Rihanna songs in March are indicative of a growing trend that’s only grown more apparent in the past several months: leaks or unreleased snippets that make their way to “legitimate” streaming platforms, racking monetized streams by fans eager to consume that content regardless of who owns it or who benefits from the plays. (It’s unclear how services like Spotify, Apple Music, or Distrokid handle payments for fraudulent streams; Spotify has not yet issued comment on the matter.) In this case, the Distrokid user seemingly responsible for the uploads goes by “Unocompac,” and has even gone so far as to link his Twitter and Instagram accounts, where he promotes new leaks. The Instagram account has over 117,000 followers.

There’s little doubt that Carti’s record label will issue takedowns to Spotify and Distrokid to remove Lil Kambo and similar leak accounts. (If they don’t, and the leak is allowed to stay up, that would raise further questions. Pitchfork has reached out to representatives for Universal Music Group, Spotify, and Apple Music for comment.)

That said, it’s unclear what—if anything—is stopping other would-be fraudsters from following in Unocompac’s tracks. In April, Spotify CEO Daniel Ek told investors that nearly 40,000 tracks are uploaded to the streaming platform every 24 hours. The case of Lil Kambo raises questions as to how many of these uploads might be ripping artists off.

Update (05/22 11:18 a.m. Eastern): As of May 22, fraudulent music on the profiles of Lil Kambo, Unocarti, and Unocompac have been removed from Spotify. The artist profile for Unocompac on Apple Music still features leaks, available to listen on the platform.