: Click the padlock icon in your browser. If it says "Connection is not secure" or the certificate doesn't match the site name, it is a fake. 2. Using Decoy (Fake) Passwords for Protection
The most dangerous faking is psychological. A user receives a call from "IT support" asking for their password to "verify an update." The victim provides their real password, but the attacker has now faked legitimacy. De-faking in this context means training systems (and humans) to challenge every authentication request.
: Once a hacker has your password, they often use it to try and access your other accounts, a technique known as credential stuffing . Common Password Attack Methods
If you are a defender, assume attackers will attempt to de-fake. Build redundancy by mixing honeytokens across different deception layers (files, logs, network shares, configs). If you are an attacker, remember: the safest fake is the one you never touch.