How to Check If a GST Number Is Fake or Fraudulent

To check if a GST number is fake, run five checks in order: length and format, the checksum digit, the state code, a live status lookup, and a cross-check of the legal name against the invoice. The first three are quick, offline, and catch typos — but a checksum-valid GSTIN can still be entirely fake, so only the live lookup actually settles the question.

That last sentence is the core point of this post, and it is worth understanding why before you rely on any "GST number checker" that only validates format. We will walk through each check, show the real checksum algorithm, and explain exactly where format checking stops being useful.

Check 1: length and format

Start with the shape of the string. A GSTIN is always exactly 15 characters, following a fixed pattern: two digits (state code), five letters and four digits and one letter (the embedded PAN), one alphanumeric entity code, a literal letter Z, and one final check character. Anything shorter, longer, or with characters in the wrong positions fails immediately — no network call required.

 ^[0-9]{2}[A-Z]{5}[0-9]{4}[A-Z][1-9A-Z]Z[0-9A-Z]$

This is the same regular expression used client-side in our verification API integration examples, and it is worth running before any paid lookup — it turns obvious typos into an instant local rejection instead of a billable request. See the full GSTIN format breakdown for what every position means.

Check 2: the checksum digit

The 15th character is a check digit computed from the first fourteen using a Luhn mod-36 style algorithm. Here is the exact, verified method: map each character to its zero-based index in the charset 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, then walk the first 14 characters left to right.

 charset = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"
sum = 0
for i in range(14):
    value  = charset.index(gstin[i])
    factor = 1 if i % 2 == 0 else 2      # weights alternate 1, 2 from the left
    product = value * factor
    sum += (product // 36) + (product % 36)

check_char = charset[(36 - (sum % 36)) % 36]

For 27AAACR5055K1Z7 (Reliance Industries Limited, Maharashtra), running the first 14 characters through this algorithm produces a check character of 7, which matches the actual 15th character — confirming the number is well-formed.

Check 3: state-code sanity

The first two characters should map to a real entry in the GST state code list. This check is weak on its own — a competent fake will use a plausible code — but it is a free, instant filter for obviously broken input, and it is worth running before you spend a lookup on a number that starts with, say, 99.

Check 4: live status lookup

This is the check that actually matters. Everything above validates the shape of a string; only a live lookup against the GST system tells you whether that string corresponds to a real, currently Active registration. You can run this manually on the government's Search Taxpayer page, or call it programmatically:

 curl -s https://gstinapi.com/api/get-taxpayer-info/27AAACR5055K1Z7 \
  -H "X-API-Key: YOUR_API_KEY" 

A live response tells you the current registration status — Active, Cancelled, or Suspended — along with the registration date and, when applicable, a cancellation date. A number that fails this lookup, or comes back Cancelled while an invoice claims an ongoing relationship, is the clearest signal available that something is wrong.

Check 5: cross-check the legal name

A live status check alone still has a gap: a fraudster can print a genuinely real, genuinely Active GSTIN on a fake invoice, as long as that number belongs to some unrelated real business rather than the one issuing the invoice. Confirm the legal name and trade name a live lookup returns match the business name and letterhead on the document you actually hold.

This is the step most manual processes skip, because it requires actually reading the response rather than glancing at a green "Active" badge. It is also the step that catches the specific fraud pattern of borrowing a real, unrelated company's GSTIN — which format and checksum checks, and even a status check in isolation, cannot detect.

Other red flags worth watching for

Alongside the five formal checks, a few practical signals tend to accompany a fake or misused GSTIN in the wild. None of these prove fraud on their own, but each one is a reason to run the full check rather than accepting an invoice at face value.

• The GSTIN on the invoice does not match the GSTIN in prior correspondence or on the vendor's website. A last-minute change with no explanation is worth a direct question.
• The state code does not match the delivery or billing address on the invoice. This is not automatically wrong — an entity can genuinely bill from one state and ship from another — but it is worth confirming with a live lookup rather than assuming a typo.
• The vendor resists sharing a fresh, verifiable GSTIN when asked directly. A genuine, currently registered business has no reason to avoid this — the information is public.
• The invoice arrives from a newly onboarded vendor with no prior filing track record you can find. A live lookup's filing history and registration-age fields, covered in the verification API guide, are useful here: a registration that is only a few weeks old is not automatically fraudulent, but it changes how much you should rely on it for large payments.

Why this matters beyond one invoice

Fake or borrowed GSTINs on invoices are not just a paperwork nuisance. Since input tax credit flows strictly through your GSTR-2B, an invoice tied to a cancelled, suspended, or fraudulent GSTIN can put your own ITC claim at risk, independent of whether you acted in good faith. Our explainer on input tax credit rules covers the supplier-compliance conditions in detail, and offences involving invoices without genuine underlying supply carry penalties under GST law — reason enough to build this five-step check into onboarding rather than treating it as optional due diligence.

It is worth being precise about what "fake" even means in this context, because the fraud patterns are not all the same problem. A completely invented GSTIN — a string nobody ever registered — is the easiest case: it fails the live lookup outright. A cancelled GSTIN still printed on new invoices is a step subtler: it once belonged to a real, registered business, so it can pass a casual glance, but a live status check catches it immediately. The hardest case is a real, currently Active GSTIN belonging to an unrelated business, copied onto a fraudulent invoice — that is precisely the pattern only the fifth check, the legal-name cross-check, is designed to catch, which is why skipping it leaves a real gap even after a clean status result.

If you are checking one supplier occasionally, the free public search tool covers five lookups a day with no signup. If this check needs to run on every invoice or every new vendor automatically, see GST verification for vendor onboarding and automating vendor GST checks in AP, or start from 20 free verification credits.

Frequently asked questions