"Fake direct" is traffic whose referrer was stripped — dark social, email clients, PDF links, AI assistants. Fix it by putting UTMs on every outbound link from a restricted pick list, and by capturing referrer plus landing page on the form so an untagged visit still resolves to something.
The root cause is almost always that marketers hand-build URLs. Give the team a UTM builder wired to an agreed value set so they can't freelance, and enforce it with a restricted pick list on the source fields. Direct should be a residual you can explain, not a quarter of your pipeline.
Every claim above comes from work LeanScale published. These are the sources.