Three layers, in the order they help: the login captcha, the page banner, and the operator signed announcements on Dread.
Fingerprint in the captcha
The login captcha draws the real v3 onion fingerprint into the image itself, in a font that survives compression and a human can still read. A clone that proxies the real captcha shows the real fingerprint, which will not match its own address bar. A clone that draws its own captcha cannot put a matching fingerprint in it without the private key.
Page banner
The canonical onion is reprinted in the header on every page. Compare it letter for letter against your address bar before you log in. The string is 56 characters, so do not stop at the first eight.
Signed announcements
When the onion set changes, the operator posts a PGP-signed message on Dread. Import the public key once and you can check every announcement after that. An address that turns up on Telegram or Reddit with no signature is a phishing attempt until proven otherwise.