Welcome to PokéCommunity! Register now and join one of the best fan communities on the 'net to talk Pokémon and more! We are not affiliated with The Pokémon Company or Nintendo.
Imgur has blocked certain regions from viewing any images uploaded to their site. If you use Imgur, please consider replacing any image links/embeds you may have on PokéCommunity so everyone can see your images. Click here to learn more.
Legitimacy can easily be determined unless the hacker is smart, for instence I just got a hacked Quagsire off the GTS, it's in a Master ball, but funny thing it was "caught in the Great Marsh..."
If you have any knowledge of what features and attributes Pokemon have, you automatically recognize a hack. For example, any event Pokemon caught in a Cherish Ball, must have a Classic Ribbon. I got a Mew that was caught in a Cherish Ball, but didn't have a Classic Ribbon. Aeon already posted a link to the Hacked Pokemon thread, so just go there and post all info about the suspected Pokemon.
or, if you want to be precise, download Pokesav and use an R4 to upload your data. Then check the Secret ID etc, along with everything else, and usually you can get the idea. If the pokemon has a Secret ID of 00000, then it is hacked, and most will if they are hacked, because many people don't know their own Secret ID. :)