GNSS spoofing threats must be recognized, especially in maritime logistics, because many maritime electronic devices depend heavily on GNSS time, position, and speed for safe vessel operation. Herein, a multistage spoofing detection technique that combines two different algorithms for ships is proposed. This robust and stand-alone spoofing detection method is expected to be used for safe vessel operation and safe GNSS use in future remote vessel operations. Stage one involves pre-correlation level spoofing detection by multipath monitoring using a dual polarization antenna. On the ocean, most of the large delay multipath comes from sea reflections. Therefore, if the GNSS spoofing signal originates from a low elevation, its multipath will be caused by sea reflection, and its multipath characteristics will be the same for all satellites. These characteristics were estimated using SDR GNSS receivers for spoofing probability determination. One dual-polarization antenna and one SDR GNSS receiver are required for the first part. The second stage involves post-correlation level spoofing detection by moving-baseline analysis using two antennas and two receivers. When both receivers track the spoofing signal, its carrier phase had the same delay for all satellites between the two receivers. These phase delays were removed in the double difference calculation and the result of baseline length become zero. A spoofing detection algorithm was developed that applies this principle and required two RHCP antennas and two consumer receivers that output raw observation streams. The proposed method was evaluated on the sea environment and the algorithm was optimized for the ship.