The connection between a user equipment (UE) and a base station may be authenticated in the physical layer, and the presence of an unauthorized intervening device may be identified based on predicted measurement values of downlink reference signals and the actual measurement values for the current downlink reference signals. The predicted measurement values are produced based on previous measurements of downlink reference signals that are known to be received from the base station, e.g., after upper layer initial authentication. The predicted values may be for positioning measurements, channel measurements, or velocity or direction of travel measurements, or a combination thereof. A difference between the predicted and actual measurement values indicates that the previously received reference signals and the currently received reference signals are not from the same entity, and thus, an intervening entity is likely present in the communication channel performing a man in the middle or replay attack.