Well battle them 1st..then wen the oppertunity comes ask if u can see there pokes...The way 2 tell they have hacked pokemon is on how they got them...their stats (for this u need a device) the ribbons (pretty obvious if ur smart)...the ot and id (ot means thier name, id means the numbers) If there name has question marks then u noe its hacked...if thier id is 00000 then well hacked..If it has thier name and id and it all looks legit...check were they got them..if anywere impossible then hacked....if it has thier name and everything looks legit then if it says apprently and they said they caught it by them self then its hacked..
The stats are the hardest 2 spot out but if u have a device like shoddy battle..try and max out everything..if its all maxed then its hacked....Well the 999 thing is stupid...The moves are the easy 1s.....just open a new tab and search it on bulbapedia..if the pokemon cant learn that move well u got urself a hacked pokemon lol...Condition is also easy...if u see everything maxed out then yea not legit....Lastly the ribbons....see all the ribbons..if they have more than 50 then yea hacked.....
Well i hope this helps Kisame88 if u need anymore info just pm me....Razor711