A method includes, in a receiver, identifying an event that involves replacement of a ciphering key used by the receiver. In response to the event, at least a portion of a payload of an Internet Protocol (IP) packet received by the receiver is deciphered using the replaced ciphering key. A verification is made whether a predefined location in the deciphered portion of the IP packet, which is expected to specify an IP version of the IP packet, indeed specifies a valid IP version. Upon detecting that the location does not specify the valid IP version, a recovery process that recovers from improper replacement of the ciphering key is initiated.