Digital advertising is clearly an important part of an overall marketing strategy, but it’s not without its risks, as a massive online scam orchestrated by Russian cybercriminals illustrates. First revealed in December by anti-fraud group White Ops, the scam is breathtaking in its scope and the amount of money involved.

Advertisers thought they were paying for ad impressions on real sites, when, in fact, they were actually paying for fake impressions on fake sites. The impressions were worthless because no human eyes ever watched any of the videos. As of December, the scam was costing U.S. advertisers a reported $3 to $5 million each day.

Here’s how it works: Evidently, the cybercriminals acquired 600,000 IP addresses and matched them with legitimate service providers to make the addresses look like real Internet users. They then set up a bunch of counterfeit websites that looked just like the real things (examples include ESPN, Huffington Post, Fortune, Vogue, Fox News and many more) and sold video ad space on them. Once the ads were live, they had the IP addresses generate millions of pay-per-click video ad impressions each day.

It goes to show that in many ways, the Internet and digital advertising are still uncharted territory. Until security can be improved, marketers would be advised to remain cautious when advertising online.