An apparatus for a first path acceptance for secure ranging comprising a channel estimator circuit (40, 92), an attack detector circuit and a first path detector circuit, the channel estimator circuit (40, 92) comprising: a symbol correlator circuit configured to generate a plurality of symbol correlation values of a sequence of pilot symbols, the pilot symbols received by the apparatus and correlated to a predefined sequence of secure symbols; a plurality of accumulator circuits (60a-c), configured to summate the plurality of symbol correlation values for a respective channel tap to generate a respective estimated Channel Impulse Response, CIR, value, each channel tap corresponding to a phase of a symbol; and a memory circuit configured to store the estimated CIR values for each channel tap, the attack detector circuit configured to extract a statistical characteristic from the plurality of estimated CIR values within a temporal range of the channel taps chosen to be outside a range wherein a direct path is expected to arrive, and to compare the statistical characteristic to a reference value to detect a distance decreasing attack, the first path detector circuit configured to determine a first path of the estimated CIR values when the attack detector circuit determined that no distance decreasing attack has occurred, wherein the first path corresponds to an earliest channel tap comprising a respective estimated CIR value with correlation to an expected secure training sequence, STS, exceeding a detection threshold, wherein the statistical characteristic is a probability distribution of the estimated CIR values within the temporal range of the channel taps, wherein the attack detector circuit is configured to indicate that a distance decreasing attack has occurred if another type of probability distribution than the reference value is detected. a symbol correlator circuit configured to generate a plurality of symbol correlation values of a sequence of pilot symbols, the pilot symbols received by the apparatus and correlated to a predefined sequence of secure symbols; a plurality of accumulator circuits (60a-c), configured to summate the plurality of symbol correlation values for a respective channel tap to generate a respective estimated Channel Impulse Response, CIR, value, each channel tap corresponding to a phase of a symbol; and a memory circuit configured to store the estimated CIR values for each channel tap, the attack detector circuit configured to extract a statistical characteristic from the plurality of estimated CIR values within a temporal range of the channel taps chosen to be outside a range wherein a direct path is expected to arrive, and to compare the statistical characteristic to a reference value to detect a distance decreasing attack, the first path detector circuit configured to determine a first path of the estimated CIR values when the attack detector circuit determined that no distance decreasing attack has occurred, wherein the first path corresponds to an earliest channel tap comprising a respective estimated CIR value with correlation to an expected secure training sequence, STS, exceeding a detection threshold, wherein the statistical characteristic is a probability distribution of the estimated CIR values within the temporal range of the channel taps, wherein the attack detector circuit is configured to indicate that a distance decreasing attack has occurred if another type of probability distribution than the reference value is detected.