Features

GSTIN-PAN Consistency Checker

Every GSTIN embeds its holder's PAN. Check that the PAN printed on a vendor's invoice actually belongs to the GSTIN on the same invoice — a mismatch is a classic invoice-fraud tell.

Match an invoice PAN to a GSTIN — free, instant, in your browser

This check runs entirely in your browser — it contacts no external database and no government registry. A “pass” means only that the PAN embedded in the GSTIN matches the PAN you entered. It does not confirm the GSTIN is registered, active, or belongs to a real business — for that confirmation, use the GSTIN Health Check once its live registry lookup is available.

Enter the vendor's 15-character GSTIN and the 10-character PAN printed on their invoice. The GSTIN's structure is validated, then its embedded PAN (characters 3–12) is compared against the invoice PAN. Comparison ignores case and spaces. Nothing you type is sent, stored, or logged.

A GSTIN is not a random number: characters 3–12 of every genuine GSTIN are the registrant's own 10-character PAN. So on an honest invoice, the PAN printed in the header and the PAN buried inside the GSTIN are the same ten characters. When they differ, the two identifiers belong to different entities — the invoice is carrying someone else's GSTIN, a fabricated PAN, or both.

That is exactly how a common vendor-invoice fraud works: a fraudster copies a real, active GSTIN from another business (so a registry lookup "passes") and pairs it with their own bank account and PAN. The consistency check above catches that pairing in one second, before the payment leaves your account.

What this checker actually does

GSTIN structure first

Before comparing anything, the GSTIN itself is validated: 15-character layout, a real GST state code, and the official base-36 check digit. A structurally invalid GSTIN fails immediately — there is nothing meaningful to match against.

The embedded PAN

Characters 3–12 of the GSTIN are extracted — five letters, four digits, one letter — exactly as the GST registration rules define them. This is the PAN the GSTIN was actually issued against.

Character-for-character match

The embedded PAN is compared against the PAN printed on the invoice, case-insensitively and ignoring stray spaces. Either all ten characters agree, or the invoice is telling you two different stories about who the vendor is.

What it does not claim

A match proves internal consistency only. It does not prove the GSTIN is currently registered, active, or that the business is genuine — for that, run the full GSTIN Health Check against the live registry.

How to use it

Copy both numbers off the invoice

Every GST invoice must print the vendor's GSTIN; most also print the PAN. Copy both exactly as printed — the checker ignores case and stray spaces.

Run the consistency check

The GSTIN's structure is validated, its embedded PAN extracted, and the two PANs compared — all in your browser, in under a second.

Escalate a mismatch

A mismatch means the invoice is inconsistent about who the vendor is. Hold the payment, confirm the vendor through a known-good channel, and run the GSTIN through the full registry health check.

GSTIN-PAN checker FAQs

What is the PAN embedded in a GSTIN?

A GSTIN is built from the holder's PAN: characters 3 to 12 of the 15-character GSTIN are the registrant's 10-character PAN, sandwiched between the 2-digit state code at the front and the entity code, the letter Z and a check digit at the end. That means the PAN printed on a genuine vendor invoice must appear, character for character, inside the same vendor's GSTIN.

What does a GSTIN-PAN mismatch mean?

If the PAN printed on an invoice does not match the PAN embedded in the GSTIN on the same invoice, the two identifiers belong to different entities. That is a classic invoice-fraud tell: a fraudster has borrowed a real, valid-looking GSTIN from another business and paired it with their own or a fabricated PAN. Treat the invoice as suspect, confirm the vendor through an independent channel, and do not pay until the discrepancy is explained.

Does a match mean the vendor is genuine?

No. A match only confirms internal consistency between the two numbers — it does not confirm that the GSTIN is currently registered, that the registration is active rather than cancelled, or that the business behind it is legitimate. For registration status, legal name and filing history, run the GSTIN through ScamShield AI's full GSTIN Health Check.

Is anything I type sent to a server?

No. The consistency check runs entirely in your browser with plain JavaScript. The GSTIN and PAN you enter are never sent, stored, or logged — only anonymous outcome flags (pass or fail) are recorded for product analytics, never the numbers themselves.

Consistency is step one. Confirm the rest.

Check registration status, legal name and filing history on any GSTIN, and scan every vendor invoice for fraud signals, free during your trial.

Start free trial Book a demo

✓ 30-day free trial ✓ No credit card ✓ Data stays in India