The older versions (or current cheaper versions) work by using a downgrade attack to 2g/3g which has next to no security. The newer versions can work with 4g directly from my understanding.
On android phones you can type this in to the dialer and disable 2g and 3g if you want, which protects against the older/cheaper stingrays at least: *#*#4636#*#*
There are a couple of android apps that try and see if you are connected to a stingray by a few methods, some of which need a baseline connection to the cell tower in your area, which you have to assume is stingray free at the time. So has caveats. One also calls you from a US number and sends text and tries to figure out the route but not had much luck with the apps even using them at events where i'm sure they are in use.
5g, or 6g if it's too late, needs to get some proper security built in to prevent these issues. They need some sort of bridge to get over the backwards compatibility issues worldwide which currently prevents them doing it. It might close the S7 protocol issues that anyone can use to track someone.
Anyone with a laptop can create a stingray by spending about 500 quid on a decent SDR/Software defined radio and software on the web. Will it take criminals using this on a larger scale to force the upgrades?
These devices, police issued or not, force all traffic in an area through them, even if they tell it to only check for a single phone. Depending on density of the area it can cause slow data, dropped calls and other deterioration of service. There is no oversight on the effects of the innocent.