You said that you tried GTS and Pokémon Bank. In that case, there is only one solution:
The Memory Girl
The Memory Girl is located in Anistar City in XY and in Lilycove City in ORAS. She is probably the most reliable hack check out there. Talk to her, and show her a Pokémon that you believe to be illegitimate. If she answers with the phrase,
>The Pokémon seems to have a good memory, but it doesn't seem to be able to remember…
at any time, the Pokémon is hacked. It can pass all other hack checks, but if it cannot pass the Memory Girl then it is a hacked / genned / injected Pokémon.
EDIT: I neglected to include this, as danielson317 pointed out. The above quote only means that a Pokémon is hacked if it has a blue pentagon. If it does not, then there is a good chance that it is not hacked. The same message is given for Pokémon transferred from previous generations. These will not have the pentagon.