A Bulgarian scheme scammed Spotify for $1 million—without breaking a single law