Detect tampered and deepfake GST Certificate

What a genuine GST certificate contains

A GST registration certificate carries the GSTIN, the legal name of the registered person, the trade name where one differs, the constitution of the business, and the address of the principal place of business, with additional places listed in an annexure. It states the date of liability, the date of validity where the registration is casual or non-resident, the type of registration, and the particulars of the approving authority: office, name, and designation. The certificate is issued with the government emblem, a QR code, and an annexure showing the photograph and details of the proprietor, partners, or directors.

The GSTIN ties the certificate to a taxpayer who already exists. The ten characters in its middle are the entity's PAN, so they must match the PAN of the legal name printed on the same page, and the two-digit state code must agree with the state of the principal place of business. The thirteenth character counts registrations held against that PAN in that state, and the fifteenth is a checksum over the other fourteen. The QR encodes the same particulars, so any edit to the name or address leaves the code describing a different registration.

How GST certificate forgeries are made

• GSTIN borrowed from a registered business

  A valid GSTIN taken from a real taxpayer is printed against a different legal name. The number passes a structural test and a checksum test, and only comparing it against the name it actually belongs to exposes the mismatch, which is a step many onboarding reviews skip.

• Legal and trade name overwriting

  The names on a genuine certificate are replaced so an unregistered seller can present someone else's tax status as their own. Because both names sit in a fixed table layout, a substituted entry usually breaks the cell alignment or the baseline it shares with the row beside it.

• Registration date edits

  The date of liability is moved so a registration appears to have been in force during a period that has already been invoiced, or long enough to satisfy a platform's minimum tenure rule. The revised date then conflicts with the registration count encoded in the thirteenth character of the GSTIN.

• Pasted proprietor photograph and particulars

  The annexure photograph and the details beside it are replaced so the certificate appears to belong to whoever is presenting it. A pasted portrait carries its own compression grid and its own noise characteristics, which sit visibly apart from the page they were dropped onto.

• Emblem and QR reproduction

  The state emblem is upscaled from a low-resolution source and a fresh QR is generated so the certificate scans. The regenerated code encodes whatever the forger typed rather than the registration on record, and the emblem arrives with the soft edges of an image enlarged past its native resolution.

• Certificates rebuilt from a scanned template

  A clean scan of a real certificate is stripped of its particulars and refilled for any entity that pays for one. The result is internally consistent apart from the GSTIN checksum, which forgers frequently get wrong because it is computed rather than chosen.

What TamperCheck checks on a GST certificate

TamperCheck runs 200+ forensic checks across three layers and returns a risk score from 0 to 100 with plain-English findings tied to specific regions of the document. These three carry the most weight on this document class.

• Barcode and QR payload comparison

  Encoded payloads are decoded and compared against the human-readable values printed alongside them. Editing the visible text without re-encoding the barcode is a common and highly detectable mistake.

• Date and validity consistency

  Issue, expiry, and period dates are checked against one another and against the file's own creation metadata, which catches backdating and validity extension.

• Reference and document number checks

  Document, account, and reference numbers are checked for issuer format conformance and against every other place the same value appears on the page.

• And many more checks

  The three above are the layers that carry the most weight on a GST certificate. Every upload runs the full suite of 200+ checks regardless of document class, spanning file structure and metadata, pixel-level forensics, font and text rendering, optical and print characteristics, provenance signals, AI-generation signatures, and many more checks.

Who verifies a GST certificate, and why

Lenders, marketplaces, and procurement teams validating business tax status. In each case the document is being used to unlock money, access, or a legal status, which is exactly what makes it worth forging.

How to verify a GST certificate in 4 steps

1. 1

   Test the GSTIN structure

   Check the number is fifteen characters, that the first two form a valid state code, that characters three to twelve are a well-formed PAN, and that the final character is the correct checksum over the preceding fourteen. An invented GSTIN normally fails the last of these.

2. 2

   Cross-check the number against the page

   The state code has to match the state of the principal place of business, and the embedded PAN has to belong to the legal entity named on the certificate. A valid GSTIN printed against the wrong name is the single most common presentation of this forgery.

3. 3

   Scan the QR and compare it

   Decode the QR and set what it returns against what is printed: legal name, trade name, address, and registration date. A regenerated code will scan cleanly and still disagree with the record, and a code that does not decode at all is a strong signal on its own.

4. 4

   Analyse the certificate as a file

   The annexure photograph and the name fields are the regions most often replaced, and both survive a visual review. TamperCheck runs 200+ checks across the page and returns findings tied to the specific region that was edited, priced at $0.50 per document.

Frequently asked questions