This is how you treat credit card fraudsters too. Those that use your site to run a bunch of stolen cards trying to find the active/good ones. You start telling them they're successful or false randomly in what looks like a normal process.