We have a requirement to ensure fake pages of our website is not hosted by malicious users. By understanding the APIs called from the browser developer tools, a malicious user can build a similar looking website and mimic the API calls. (Similar to how bank login pages are faked)

We have done few controls like having hidden values and random numbers generated from the button clicks which are genuinely rendered by our application. But this logic resides in client and a hacker can actually see it ( though we obfuscate client code )

I have seen few banking sites create dynamic login URLs and hide the request / response so that its not easy for hacker to understand the APIs that are called as part of login and subsequently.

If there are any patterns/approaches to handle this more efficiently, please share your thoughts

We have few controls in place to address this problem – but would like to know industry best practices around this concern, which might be already adopted by financial institutions