A good way to test is to put it through the GTS.
Since the GTS is hosted by Nintendo's servers, they will scan the Pokemon to make sure it's not hacked. Ask for an impossible Pokemon, to make sure no one will trade in the brief moment it will be up for. (Just in case! xD)
Also, you can always check with PokeBank, however that costs money. :P
You can also put the Pokemon in the many legitimacy checkers over the internet, to make sure.
If you don't have internet connection, or money (though I'd assume you'd have internet connection because most hacked Pokemon come through sources with internet connections such as trading etc. but whatever) then there are rumours that the blue pentagon is a way to see it's legitimacy. However, this is still unconfirmed as of yet.
Can you see the shapes below the Pokemon? The blue pentagon is on the left of those shapes.
Hope I helped. :)