The $100 Billion Ghost Economy: How Ad Fraud Actually Works in 2026

Somewhere right now, a server in a rented data centre is loading a blank web page. The page has no readers and no content — just an ad slot. It requests an ad. It receives one. It reports the impression as viewed. Somewhere else, a media buyer's dashboard ticks up by one, and a budget line moves by a fraction of a rupee.

Multiply that by a few billion a day and you have an industry.

Ad fraud gets discussed as if it were vandalism — bad actors breaking things for the sake of it. It is not. It is a business, with margins, tooling, staffing and a customer base, and it is profitable enough that every takedown is followed by a bigger successor. Understanding it as a business is the only way to understand why fifteen years of countermeasures have not made it smaller.

The web went majority-machine, and nobody sent a memo

In 2024, automated traffic crossed a line it had been approaching for a decade: bots generated 51% of all web traffic, overtaking humans for the first time, according to the Imperva (Thales) 2025 Bad Bot Report. Of that total, 37% was bad bots — up from 32% the year before. The remainder is the benign half of automation: search crawlers, uptime monitors, the machinery that makes the web indexable.

Sit with the shape of that for a moment. The open web is now a place where most of the visitors are software, and where more than a third of everything arriving at your server is software with an agenda that is not yours. Every assumption baked into the ad business — that an impression implies a person, that a click implies interest, that a session implies attention — was formed when the opposite was true.

The industry's response has largely been to keep the assumptions and bolt detection on afterwards. That is the design flaw the rest of this piece is about.

The number nobody wants to print

Invalid traffic — IVT, the industry's polite term for impressions that no human being saw — ran at roughly 20.64% globally in 2025, in an analysis spanning 105.7 billion impressions. The Q1 2026 figure came in around 18.12%. Whether you read that dip as progress or as noise depends on your temperament; either way, the base rate is that about one impression in five is a ghost.

The money follows. Juniper Research puts global advertiser losses to fraud at approximately $100.2 billion in 2026, rising to about $172 billion by 2028. Those are the numbers that generate headlines. The number that should generate more alarm comes from the ANA's programmatic transparency work: of the money that goes into the programmatic pipe, only 43.9% reaches a viewable impression, with roughly $26.8 billion of programmatic spend wasted in 2025.

Note what the ANA figure actually says, because it is easy to misread. It is not claiming that 56% of programmatic spend is stolen. It is saying that between the advertiser's budget and a viewable impression sit the DSP fee, the exchange fee, the SSP fee, the verification fee, the data fee, the non-viewable inventory and the invalid traffic — and that when you add them all up, less than half the money survives the journey. Fraud is one leak in a pipe with many.

But it is the leak with no legitimate claim to the money at all.

Why every vendor gives you a different number

If you have ever put two verification reports side by side and found they disagree by a factor of three, you were not looking at a bug. You were looking at two different definitions being reported under the same word.

A vendor measuring only GIVT will report a low single-digit rate and be telling the truth about what it measured. A vendor doing deep behavioural SIVT analysis on the same inventory will report something several times higher and also be telling the truth. Add in the question of what counts as the denominator — impressions bid on, impressions won, impressions rendered, impressions measured — and the same traffic can honestly produce numbers that look irreconcilable.

The practical consequence for a publisher is that "our IVT is under 2%" is a meaningless sentence without knowing who measured it, against which definition, on which side of the ad server. Ask those three questions of any vendor quoting you a number, including anyone selling you protection from the problem. A number that arrives without its methodology is marketing.

Two enemies, and only one of them is hard

The industry splits invalid traffic into two buckets, and the split matters more than the jargon suggests.

General Invalid Traffic (GIVT) is the honest kind of dishonest. Known data-centre IP ranges. Declared crawlers. Bots that identify themselves in the user agent. Activity that fails basic sanity checks. GIVT is detected with lists — you compare what arrived against a register of things that are known not to be people, and you filter it. It is close to free to catch, and any vendor claiming credit for catching it is claiming credit for reading a list.

Sophisticated Invalid Traffic (SIVT) is the other kind. Bots that render JavaScript, move a cursor along a plausible curve, scroll at human speed, and arrive from a residential IP address belonging to a real household — because the traffic is being proxied through a compromised device in that household. Hijacked browsers. Cookie stuffing. Falsified location. Malware on a real phone, driving a real browser, on a real network, generating fake attention.

Here is the uncomfortable part. Media Rating Council accreditation — the industry's quality bar for measurement vendors — requires GIVT filtration. For SIVT, it strongly encourages detection rather than mandating it. Read that again with a buyer's eye: a vendor can hold the industry's headline accreditation while doing the easy half of the job well and the hard half at whatever level it chooses.

Six reasons the clicks are still fake

Fifteen years of verification vendors, industry consortia, ads.txt, sellers.json and supply-path optimisation, and the base rate has not collapsed. That is not because nobody tried. It is because six structural forces all push the same way.

1. It is a cat-and-mouse game where the mouse iterates faster

Every published takedown is also a published post-mortem. When HUMAN Security or a platform security team explains how an operation was detected, the write-up is read attentively by exactly the people who need to avoid that detection next time. Defence has to be disclosed to be trusted; disclosure is free R&D for the other side.

The asymmetry compounds because the two sides have different failure costs. A defender who over-blocks generates false positives, angry publishers and lost revenue, so defenders tune conservatively. An attacker who gets caught loses an operation and rebuilds — the infrastructure is rented, the domains are cheap, and the playbook survives. One side is optimising to avoid embarrassment; the other is optimising to avoid extinction, and only one of those is a real constraint.

2. The economics are wildly asymmetric

A fraud-as-a-service kit can be stood up for something in the region of twenty dollars. The defensive apparatus — verification vendors, in-house data science, exchange-side filtering, industry bodies — costs billions annually across the ecosystem. The attacker needs one working method; the defender needs to close every method simultaneously, forever, without generating so many false positives that legitimate publishers start losing revenue and complaining.

3. The IP address stopped being an identity

This is the change that has quietly broken the most tooling. Agentic AI bots grew 7,851% year-on-year in 2025, and roughly 80% of automated traffic now slips past IP-based blocking by routing through residential proxy networks — real home connections, often on compromised devices, rented by the gigabyte. If your defence is a list of bad IPs, your defence is looking at an address that belongs to a real family in a real town, because it does.

4. Every new channel is a new blind spot

Connected TV is the current example. Server-side ad insertion stitches ads into a video stream on the server, which means the verification tag that would ordinarily run in a browser has nowhere to run. The measurement story for CTV is weaker than for display, the CPMs are higher, and fraudsters allocate their attention rationally. They always go where the verification is thinnest and the price is highest.

The structural problem with SSAI is that the ad request arrives from the streaming platform's server, not from the device. So the signals a verification vendor would normally lean on — what the browser reports, how the player behaved, whether anything rendered — are either absent or are being asserted by the very party whose inventory is being checked. You are asked to take the seller's word for the thing you are trying to independently verify. Every large CTV fraud operation of the last six years has walked through that gap.

5. Per-event billing was the original sin

The industry bills per impression and per click. An event is a row in a log. Fraud, stripped to its mechanics, is the mass production of rows in a log. We designed a market that pays for events, then expressed surprise when someone automated events. Any billing model priced on a signal that software can emit will be gamed by software that emits that signal.

Attention-based and outcome-based buying are the honest attempts to fix this, and they help. But they move the target rather than removing it: an outcome is also an event, a conversion is also a row, and there is a well-developed fraud economy around manufacturing those too. The lesson is not that a better metric exists. It is that any metric which can be produced by software will eventually be produced by software, and the defence has to be about who produced it rather than what was produced.

6. AI removed the last barrier to entry

Writing a convincing bot used to require skill. Generating a thousand plausible-looking websites, each with coherent article text, a believable layout and a distinct voice, used to require a content team. Neither is true now. The floor on "can you build a fake publisher" has dropped to approximately zero, and the ghost-site economy in the next section is the direct consequence.

Follow the money: how a ghost site actually earns

The mechanics are simpler than the mythology suggests, and worth spelling out because the arbitrage version of this is legal, common, and sits directly adjacent to the criminal version.

A fraud operation needs two things: inventory that can carry ads, and traffic that can be counted as visiting it. The inventory is a website — increasingly an AI-generated one, sometimes called a "cashout" or ghost site — that exists solely to hold ad slots. It may look like a real publication. It may have hundreds of articles. It has no readers.

The traffic is bought, or generated, or hijacked. And here is the line that matters: buying traffic is a legitimate business. Publishers do it. Arbitrage — buying cheap traffic and monetising it at a higher rate — is a real, above-board model, and a decent chunk of the open web runs on it.

The arithmetic looks like this. Buy traffic at a $3 CPM. Monetise the resulting page views at a $10 CPM. Keep the $7 spread. If the traffic is real people who genuinely land on a real page and have a genuine chance of seeing a real ad, that is aggressive media buying. If the traffic is bots, or if the "site" is a shell with no editorial existence, the same arithmetic is fraud. The spreadsheet is identical. Only the substance underneath it differs.

How a ghost site gets into real supply

A fake site with ad slots earns nothing until real demand reaches it, and real demand arrives through the same plumbing everyone else uses. This is where ads.txt and sellers.json were supposed to help, and where they only partly do.

ads.txt lets a publisher declare which sellers are authorised to sell its inventory. It is a genuine improvement and it killed a whole class of naive domain spoofing. But it answers one question only: is this seller authorised by this domain? It does not ask whether the domain deserves to exist. A fraudster who owns the ghost domain outright can publish a perfectly valid ads.txt authorising themselves, register as a seller, and be entirely compliant with the standard while selling impressions to nobody.

Long reseller chains do the rest of the work. Each hop adds distance between the buyer and the origin, and a buyer looking at a line item three intermediaries deep has very little practical ability to establish what is at the other end. Supply-path optimisation exists precisely to shorten those chains, and it is one of the more effective things a buyer can actually do.

For a legitimate publisher, the relevant implication is uncomfortable but worth internalising: you are competing for the same budgets as inventory that costs nothing to produce. Every ghost impression that clears is a rupee that did not reach a site with an actual editorial payroll.

That tuning is why volume-based detection fails. A bot farm that produces a smooth diurnal curve, a realistic country mix and a believable bounce rate does not look anomalous on any dashboard built to spot spikes. It looks like a modest, unremarkable publisher having an ordinary month.

Who actually pays

The headline framing is that advertisers lose the money, and in the direct sense they do — it is their budget that buys the ghost impression. But the cost distribution is less tidy than that, and publishers carry a share of it that rarely gets counted.

There is also a second-order effect that hurts every honest publisher and appears on nobody's invoice. When roughly a fifth of impressions are suspect, buyers price that risk in. They bid lower across the board, demand more verification, and shift budget toward walled gardens where the measurement problem is somebody else's. The discount is applied to the whole open web, including the parts that never sent a single bot. Fraud does not just steal the money it takes — it lowers the price of everything it stands next to.

Three ways it lands on the publisher directly:

• Corrupted analytics. If a meaningful slice of your traffic is not human, then your engagement metrics, your content decisions and your audience profile are all built on a mixed signal. You optimise toward what the bots reward.
• Poisoned optimisation. Yield algorithms learn from performance data. Feed them invalid traffic and they will confidently learn the wrong lesson — bidding up the placements that fake users "engage" with most.
• Enforcement risk. This is the sharp one. Invalid traffic arriving at your tags is your problem regardless of who sent it. A competitor, an over-enthusiastic traffic vendor, or an extortionist can point bots at your site, and the platform's enforcement machinery does not distinguish between traffic you bought and traffic that was aimed at you.

That last point is the one that turns an industry-level statistic into a Tuesday-morning emergency for a specific person running a specific ad stack. We have written about the mechanics of that enforcement separately, because the way it escalates — and how rarely appeals succeed — deserves its own piece.

Shifting left: the only defence that scales

The dominant model for fifteen years has been post-hoc: serve the impression, measure it, and claw back the money afterwards if it turns out to be invalid. That model has a structural problem. By the time the clawback happens, the ad has served, the log row exists, the reconciliation is weeks away, and the publisher has already been paid and then un-paid — an experience which, from the publisher's side, is indistinguishable from being robbed by their own partner.

The direction the industry has been moving is what gets called "shifting left": doing the detection before the impression rather than after it. Pre-bid rather than post-serve. That changes the economics on both sides. The fraudster stops getting paid at all rather than getting paid and then reversed. The publisher stops carrying reconciliation risk they cannot price.

Doing it well needs three things that a list lookup does not provide: multiple independent signals rather than one, behaviour observed over time rather than a single request in isolation, and — this is the part small publishers cannot build alone — a view across many properties, so that a pattern which looks like noise on one site resolves into a signature when seen across fifty.

None of that is exotic. The signals that separate a person from a well-built bot are mostly boring: does engagement depth match click behaviour, does the timing distribution look like a population or like a loop, does the traffic source composition change faster than an audience plausibly can, does a residential IP appear on inventory that has never seen residential traffic before. Individually each is weak evidence. Together, and observed over weeks rather than in a single request, they are usually decisive.

The reason this is hard for an individual publisher is not that the analysis is difficult. It is that a single site does not have enough data to establish what normal looks like. A pattern that is indistinguishable from a good month on one property is obvious the moment you have seen the same pattern arrive at four properties in the same week.

That last requirement is why traffic quality is one of the things a network can do for a publisher that the publisher genuinely cannot do for themselves. It is the design principle behind BeeGuard, the traffic-quality layer in BeeOS: screen at the network level, correlate across accounts, and hand the publisher the evidence trail rather than just a verdict. Not because a single tool ends fraud — nothing in this article should leave you believing that — but because the alternative is a publisher watching their own dashboard, alone, for a signal that is only legible in aggregate.