Billions of dollars are flowing into online advertising. But marketers also are confronting an uncomfortable reality: rampant fraud.

About 36% of all Web traffic is considered fake, the product of computers hijacked by viruses and programmed to visit sites, according to estimates cited recently by the Interactive Advertising Bureau trade group.

So-called bot traffic cheats advertisers because marketers typically pay for ads whenever they are loaded in response to users visiting Web pages—regardless of whether the users are actual people.

The fraudsters erect sites with phony traffic and collect payments from advertisers through the middlemen who aggregate space across many sites and resell the space for most Web publishers. The identities of the fraudsters are murky, and they often operate from far-flung places such as Eastern Europe, security experts say.

The widespread fraud isn't discouraging most marketers from increasing the portion of their ad budgets spent online. But it is prompting some to become more aggressive in monitoring how their money is spent. The Internet has become so central to consumers, that advertisers can't afford to stay away.