Recent investigations have revealed the susceptibility of phasor measurement units (PMUs) to the time synchronization attack by spoofing its global positioning system (GPS). This paper proposes a cross-layer detection mechanism to fight against simultaneous attacks toward multiple PMUs. In the physical layer, we propose a GPS carrier-to-noise ratio (C/No) based spoofing detection technique. We apply the patch-monopole hybrid antenna to two GPS receivers and compute the difference between the standard deviation of each receiver’s C/No. The priori probability of spoofing is calculated from the distributions of the difference. A counter is embedded in the physical layer to identify the most suspicious PMU. In the upper layer, the spoofing attack is considered similarly to the bad data injection toward the power system. A trustworthiness evaluation, which is based on both the physical layer information and power grid measurements, is applied to identify the PMU being attacked. An experiment has been carried to validate the proposed algorithm.