In vehicular ad hoc networks (VANETs), many data protection schemes have been proposed to secure the data collection procedure, but few schemes focus on the downstream data transmission procedure. In some cluster-based data transmission schemes, if a legal cluster head node becomes malicious, then it is more likely to tamper with transferred data or provide false data easily. Because the malicious cluster head node is a valid internal user, its behaviour is difficult to be detected only through some cryptographic methods. In this paper, we propose a cluster-based malicious node detection scheme for false downstream data in fog computing-based VANETs, where the fog servers are used to detect the suspicious data and the malicious cluster head nodes. In our proposed scheme, we further construct a trajectory clustering method among vehicle nodes, in which the cluster head nodes and the corresponding edge monitoring nodes are accurately selected. Also, under our proposed threat model, we analyze the potential security problems in detail. Compared with other related works, our proposed detection scheme can supervise the downstream data forwarded by the cluster head nodes and detect the malicious cluster head nodes. Further, the experimental results show our proposed scheme is efficient for fog computing-based VANETs. Therefore, our scheme may be used as an auxiliary mechanism of some cryptography-based schemes not only to ensure the security of the data forwarding process, but also to effectively and timely monitor the data forwarding process.