Preamble
DISCLAIMER: It is impossible to differentiate a well-made hacked Pokemon from a legitimate Pokemon. Though your Pokemon may 'pass' each of the checks on this list, there remains the possibility that it was created by a careful hacker using a sophisticated save file editor. The only way to guarantee you will not get a hacked Pokemon is by trading only with people you know and trust, i.e. by avoiding services like the GTS. We cannot give you final confirmation of whether your Pokemon is legit if it passes all the checks.
IMPORTANT: An 'illegitimate' Pokemon is not the same as an 'illegal' Pokemon. An illegitimate Pokemon is a Pokemon that was obtained dishonestly, but not all Pokemon that are obtained dishonestly have traits that would render them illegal. Hack checkers, including those used by transfer facilities and at competitions, are not magic and cannot pick up illegitimate Pokemon if they have no illegal features. Checkers are noted to have flaws and to pick up false positives. Do not rely on them to determine your Pokemon's legitimacy.
Many people investigating hacked Pokemon wonder whether hacked Pokemon will damage their save file. It is extremely unlikely that receiving a Pokemon that was hacked by somebody else will damage your save file, especially in modern games. Poor/sinister editing technique may rarely cause them to crash the game (example), but hacked Pokemon seldom corrupt save files. The process of editing save files to create hacked Pokemon more commonly causes damage. It is also unlikely that using hacked (but legal) Pokemon will cause your account to be banned from online games, as hacks are very difficult to prove in this case. However, you should not take Pokemon with blatantly illegal traits (i.e. available only through hacks) into online matches.
Guide
For the purposes of this thread, a hacked Pokemon is defined as one that was created or edited using external software, or changed from being exposed to it. The list below will help you detect Pokemon with illegal traits that could only have been created through hacking, or breeding hacked Pokemon. It will not tell you whether a Pokemon that passes all the checks is hacked (see disclaimer above).
Ways of identifying hacked Pokemon are listed in bold, and explanation is provided in dot points.
Common sense
- Common sense is the first technique, because it will resolve the issue for 90% of people reading this thread. If it looks too good to be true, then it probably is. If your suspicions of a hack were great enough that you went looking for confirmation online, then there's probably something in it!
- The average person does not hand out legitimate Shiny Pokemon, rare legendary Pokemon, or competitive battle-ready Pokemon on random trading services. If you received one of these in a random trade, e.g. on the GTS, Wonder Trade or Surprise Trade, then you should assume it is hacked.
- Hackers intentionally craft Pokemon to imitate event distributions or static encounters that could have been accessed legitimately. Those Pokemon might look real, but that does not excuse how unlikely it is that a person was willing to give away a legitimate rare Pokemon at random. The older and more niche an event is, the less likely it is to be in fair circulation.
Location or method of capture
- If, on its summary screen, a Pokemon is listed to have been obtained in a location where its species isn't normally found (and it is not indicated to have been bred), then it is hacked. Use location guides on Bulbapedia to see where your Pokemon can be found legitimately. Pokemon that were obtained by breeding could have hatched in any location the player can access and walk inside.
- As of Gen 7, Pokemon that are transferred do not have entries listed on their summary screens about their date of encounter, level of encounter, or the precise location at which they were encountered. If your Pokemon is transferred and is missing these, it does not necessarily mean it is hacked. needs update
- Due to glitches, some Pokemon can be met at locations that they wouldn't normally, without the involvement of hacking software. For example, it is possible to catch an infinite amount of Arceus from Jubilife City in Diamond and Pearl using the RETIRE exploit. Despite having an illegal encounter location, such Arceus will transfer to Gen 7 games.
Event Pokemon
- If your Pokemon's location entry indicates it was obtained through an event, e.g. 'a fateful encounter', and it does not share necessary traits with any of the event Pokemon distributed for its species, then it is hacked. Use Serebii's Event Database to track event distributions for your Pokemon's species. Especially, compare their IDs, OTs, Ribbons, encounter levels, shininess, moves they can remember and games they were distributed in, and make sure everything checks out. Event Pokemon IVs can be another discriminating factor, though information on them is scarce.
- Pay attention to wordings like 'in the Hoenn region', 'in the good old days' and 'seems to have travelled through time and space'. Respectively, these indicate your Pokemon was not obtained in the same region as your game, that they were obtained through Virtual Console transfer and that they were transferred from a previous generation. This can help you detect discrepancies: for example, if you have a Pokemon that looks like an event Victini from Black/White, but it lacks even one of the 'from the Unova region', 'fateful encounter', and 'time and space' wordings, then it is hacked. (The game stacks all of these, including in Sw/Sh.)
- Even if your event Pokemon seems legit, it is still likely to be hacked because real event Pokemon are valuable, and people generally won't give them away. (There are extra reasons you shouldn't see certain event Pokemon on the GTS and similar services; read on to learn more.) Some event Pokemon are distributed widely and do not have trade restrictions -- all the more reason to double-check using a website.
Poke Ball
- Generally, event Pokemon are distributed with a prescribed Poke Ball. If you have a Pokemon that appears to imitate an event Pokemon but does not have the correct Poke Ball, then it is hacked.
- Prior to Gen 8 and the Sw/Sh Expansion Pass (where all Poke Balls can possibly be used on any Pokemon), some Poke Balls are 'exclusive' in the sense they can only be present on certain Pokemon. For example, if you have a Pokemon in a Safari Ball whose species has never been obtainable in a Safari Zone, then it is hacked. Other common offenders include the Dream Ball and Sport Ball. Check this guide created by Smogon for an in-depth Poke Ball guide that is up to date as of the last relevant game for Poke Balls (Ultra Sun/Moon).
- A Pokemon in a Poke Ball that it could only be captured with in a past generation is not necessarily hacked if it is missing the 'time and space' memo. The Poke Ball could have been legitimately passed down through breeding in a modern Pokemon game.
- A Pokemon with an illegal Poke Ball can pass its illegal Poke Ball down through breeding.
Shiny
- Starting in Gen 5, some Pokemon are Shiny locked. This means they cannot be Shiny unless they were obtained through an event, i.e. had a 'fateful encounter'. Check the bottom of this page on Serebii for a list of Shiny locked Pokemon. If you have a Shiny, non-event Pokemon whose species is Shiny locked, then it is hacked.
- A list of Shiny-locked Pokemon which have not had Shiny event distributions, and are therefore wholly unobtainable in their Shiny forms, is available on Bulbapedia.
- People tend to value Shiny Pokemon they obtained through legitimate means. This means any Shiny Pokemon you get through a random trading service is most probably hacked.
First-met level
- Each evolution line has range/s of levels at which they can be encountered through legitimate means, as dictated by the levels each member can be found at in the wild, whether they can breed, if they can be found through in-game trade, and if they are available through event. If your Pokemon is listed as having been encountered at a level beyond its legal range/s, then it is hacked.
- For example, a Duraludon from Galar can be met between levels 45 to 48 and 50 to 52, as well as level 1, in accordance with its location data on Route 10 and the Lake of Outrage, its ability to breed, and the fact it has never been distributed through event or in-game trade. If you have a Duraludon that was not met between these ranges, then you can tell it is hacked. If Duraludon had a pre-evolution, then any level/s at which said pre-evolution could be encountered would also be added to the 'whitelist'.
- Generally, event Pokemon have static levels. This means that if you have a Pokemon that appears to imitate an event Pokemon whose 'met at' entry does not match the level/s the Pokemon was distributed with, then it is hacked.
- The level of encounter is only displayed for Pokemon that were caught in the game (or generation of game?) you're playing. Transferred Pokemon that are missing an indication of what level they were captured at are not necessarily hacked. needs clarification
Current level
- A Pokemon's current level can indicate it is hacked if it does not adhere to its evolution level or an event encounter level. In this sense, each Pokemon has a minimum level at which it is legal, which tends to be higher for evolved Pokemon. (For example, you cannot get a level 1 Rillaboom without abusing glitches. However, a Rillaboom can have a 'met at' level of level 1 if it was bred, as it could have been a Grookey at that point.)
- This guide on Serebii should be useful in determining if a Pokemon is at a level it cannot be legitimately obtained at according to its PokeBall.
- Some Pokemon can be caught in the wild or obtained through events at a lower level than evolution would ordinarily permit. Make sure to check each encounter technique for your species of Pokemon.
- The second stages of baby Pokemon can be legally gained at level 1 through breeding without the correct Incense. For example, level 1 Snorlax is legitimately obtainable.
- If you received a level 100 Pokemon through a random trading service, then you should heighten suspicions it is hacked.
