To automatically identify an attempt at presenting falsified vehicle identifiers to portable devices, (i) a vehicle identifier reported by a vehicle with which the portable device is establishing a short-range communication link, and (ii) an indication of a current location of the portable device, are received from a portable device at a first time. An indication of a recent location at which the vehicle identifier was reported at a second time is obtained. The current location of the portable device is compared to the recent location of the vehicle, in view of the first time and the second time. In response to determining that the current location is not proximate to the recent reported location of the vehicle, an indication that the reported identifier is likely falsified is generated.