This application provides a fake network device identification method and a communications apparatus. An uplink message sent by a terminal device is forwarded to a first network device via a second network device. After receiving the uplink message, the first network device generates a downlink message for the uplink message, performs security processing on the downlink message based on first time information, and/or sends the downlink message to the second network device. The second network device sends, to the terminal device, the downlink message on which the security processing is performed. The terminal device performs security verification on the received downlink message, and/or identifies whether the second network device is a fake network device. This helps improve communication security.