This paper presents UnSpoof, a UWB localization system that can detect and localize distance-spoofing tags with several collaborative passively-receiving anchors. We propose novel formulations that enable passively-receiving anchors to deduce their time-of-arrival (ToA) and time-difference-of-arrival (TDoA) just by overhearing standard two-way ranging (TWR) messages between the tag and one active anchor. Our ToA formulation can be used to precisely localize an honest tag, and to detect a distance-spoofing tag that falsely reports its timestamps. Additionally, our TDoA formulation enables spoof-free localization, which can be used to track down and apprehend a malicious tag Our experimental evaluation shows 30cm percentile error for ToA-based honest tag localization, and sub-meter error for TDoA-based localization for spoofing tags. We demonstrate successful detection of distance reduction and enlargement attacks inside the anchors’ convex hull, and graceful degradation outside.