The tripcode is a hash made from a password. Only the person who knows the password will be able to use it to generate the tripcode which is added to the message by the server software. Whenever Q changed the password which will force a change to the tripcode, there will be an alert to the anons before and after the tripcode is changed. If you see it in some other place (some have used it as the UID) you know it’s fake.