Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, and detecting a cyber-attacker. An end-user device interacts and communicates with a server of a computerized service, or with a local application or Web-browser running on the end-user device. A usage interference is injected or introduced, or an input/output mismatch or abnormality is created, causing an output displayed on the screen of the end-user device, to be non-matching to the expected or intended output that is typically displayed in response to regular non-interfered user gestures or regular non-interfered user input. The reaction or corrective manual actions of the user are tracked and analyzed, to differentiate among users, or to differentiate between an authorized human user and a human cyber-attacker, or to differentiate between an authorized human user and a computer bot or an automated computerized script.