Many mobile apps access users’ trajectories to provide critical services (e.g., trip tracking). Unfortunately, in such apps, malicious users may upload fake trajectories to cheat providers for illegal benefits. There are few works in the literature that delicately study trajectory forgery problems. In this paper, we first take the perspective of attackers and consider how they fabricate vivid trajectories confronting a strict provider. In particular, we use the technique of adversarial examples in deep learning to propose a trajectory forgery method, which produces fake trajectories satisfying two conditions: (1) having the motion characteristics indistinguishable from those of real ones, and (2) matching a reasonable walking, cycling, or driving route when being projected to the map. We show through experiments that they can hardly be detected by mainstream trajectory service providers, even after being equipped with machine learning-based approaches. Therefore, we further present a dedicated countermeasure by validating the reasonability of reported received signal strength indicator (RSSI) data of WiFi access points (APs) nearby every location. It can well deal with the most challenging replay scenario, which can hardly be handled by existing WiFi-based location verification methods. We conduct extensive real-world experiments in three local commercial areas covering walking, cycling, and driving scenarios. Results demonstrate the high detection accuracy of this method.