Comment by TrickyRick

Definitely, but it's also a lot more complex to present credible looking false data than to simply reject a request.