Maybe the application could generate a randomized number of empty fakes whenever a new user signs up, and then fill them up overnight or during another low-load

Maybe the application could generate a randomized number of empty fakes whenever a new user signs up, and then fill them up overnight or during another low-load period. But this would obviously not help as much if the system was already compromised. Also, to make things really convincing, there would also need to be fake transactions which the application could somehow recognize as such. The solution to that might be with fake products, these being in fake product categories that are in a fake category root. Complicated, yes.