Free resource · forward to a client

Fake GST notice: the red-flag checklist

A threatening "GST demand notice" is one of the most common ways an Indian SME loses money. Genuine notices follow rules a fake almost never gets right. Run any notice past this checklist before you pay or respond.

By Darshil Thummar, MSc Information Security & Digital Forensics · CTO, ScamShield AI

Treat it as suspect if…

The link is not `*.gov.in`

Genuine GST and CBIC communications only ever link to a *.gov.in address. A "verify" or "pay" link to something like gst-verify-portal.in is a forgery.

It gives you hours, not weeks

"Pay within 24 hours or face cancellation/arrest." Real notices give a statutory window to reply and follow an appeal process. Hour-long deadlines are pressure, not procedure.

It wants a personal account

A genuine demand is paid only through the official GST portal challan. A notice asking you to transfer to a personal UPI ID, wallet or bank account is fraud, every time.

The DIN / RFN is missing or won't verify

Since 2019, CBIC communications carry a Document Identification Number (DIN), formatted CBIC-YYYY MM ZCDR NNNN; GST-portal notices carry a Reference Number (RFN). No identifier, or one that will not verify, means do not act on it.

It threatens arrest

Tax departments issue notices and follow an appeal process. They do not threaten immediate arrest by email, SMS or WhatsApp.

The details are slightly off

Wrong GSTIN, mismatched business name, odd formatting, or a reply-to address on a free-mail domain are all signs the letterhead was copied, not issued.

Before you act, verify it

Verify a CBIC DIN on the official CBIC website, cbic.gov.in ("Verify CBIC-DIN").
Verify a GST-portal RFN at services.gst.gov.in.
Never pay a demand into a personal account. Pay only through the official GST portal challan.
If it is fake, do not click any link. Report it on cybercrime.gov.in or call 1930.

Not sure? Paste the notice into the free GST notice checker. It flags these signals in seconds, entirely in your browser.

Add ScamShield AI to your practice.

CA firms use ScamShield AI to protect every SME client from one dashboard, flagging fake GST notices, payment-change and vendor fraud before a client acts on them. Ask about the CA Partnership programme: partner pricing, and clients onboarded under your own dashboard.

Explore the CA Partnership Talk to us about partnering