For one, how carefully did the user input information into fields. If you're making it up, it will be much faster and less hesitant than a legitimate entry.

That and a hundred other data points help create a ML model that reliability identifies illegitimate activity.