Your baseband (radio) might expose neighbour cell data - iPhone field test menu shows the announced neighbour data.
Hypothesis is that a rogue tower will not have valid neighbour cells announced. They could try listen in for valid ones and advertise those.
A lot of the ways to detect will depend on the generation of network being spoofed - 4G networks will also advertise signalling for legacy 2G and 3G circuit switched networks. Rogue sites might not.