A device (110) arranged for wireless communication (130) according to a communication protocol has a processor (112) to execute a connection sequence according to a discovery protocol. The connection sequence comprises determining a current cluster identity and a current discovery window timing used by the device. Next, at least one other device (120,120′) within wireless range is detected, while further determining a detected cluster identity and a detected discovery window timing of the detected other device. Then it is detected whether the detected device is operating in a different cluster than the device by comparing the current cluster identity with the detected cluster identity or comparing the current discovery window timing with the detected discovery window timing. Finally, upon detecting said different cluster, a security process is executed, which may warn the user or abort the connection sequence. Thereby, a malicious device trying to manipulate the connection sequence is detected.