If an app pops up a modal that looks just like the Apple password request modal, how can I tell the difference?
Press on the Home button on your device - if the app quits, it is a fake popup. If the app persists, it is real.
The safest is to always assume that the popup is fake. Then access the Apple supplied program that supposedly gave the popup (for example Settings => iCloud) and enter your password there if indicated.