The GST QR Code on Your Invoice

On 23 April 2026 the GST department in Karnataka arrested an operator who had run ₹ 410 crore worth of paper invoices through a stack of shell firms over the previous eighteen months. One case. Pull back the camera and the picture gets uglier — since May 2023 the same investigation track has flagged 29,273 fake firms and ₹ 44,015 crore of bogus input tax credit. The number that should bother you, though, is not the headline. It is that for every one of those crore figures there were buyers on the other end of the bill. Small businesses, mostly, who took the invoice in good faith, claimed the ITC on it, and got a GSTR-2B mismatch notice three months later reversing the credit with interest under section 50. Section 16 of the CGST Act puts the burden on the buyer to ensure tax was actually paid. The supplier has vanished by the time the notice arrives. You are holding the bag.

The single fastest way to catch a fake on your own desk, before the credit lands in your books, is the QR code in the corner of the invoice. A lot of people never scan it. Some don't realise it's mandatory. And most who do scan it don't actually know what they are looking at in the result, which is the gap I want to close.

When the QR Is Actually Supposed to Be There

E-invoicing under GST is mandatory for any registered business whose aggregate annual turnover crossed ₹ 5 crore in any financial year from 2017-18 onwards. That threshold has come down in stages. ₹ 500 crore originally in October 2020, then ₹ 100 crore, ₹ 50 crore, ₹ 20 crore, ₹ 10 crore, and finally ₹ 5 crore from August 2023. Below the ₹ 5 crore line, e-invoicing is not mandatory and you'll see plenty of B2B invoices without QR codes, all of them legitimate. Above it, the supplier is required to generate the IRN through the Invoice Registration Portal and print the resulting QR on the invoice copy.

A separate rule applies to B2C invoices from very large companies. Anyone above ₹ 500 crore turnover has to print a dynamic QR on consumer-facing bills as well, but that is the small QR pointing at a UPI payment link. It is not the same thing as the IRP-stamped QR on a B2B e-invoice. Don't confuse the two.

Exemptions are narrow but worth knowing. SEZ units, banks, insurers, GTAs, passenger transport operators, and suppliers of OIDAR services don't have to e-invoice. So a missing QR is not automatic proof of fraud. It is proof you should check whether the supplier's turnover and category make the QR mandatory in the first place, which is the first red flag we'll come back to.

What's Actually Inside the QR Code

Pull a recent B2B e-invoice off your desk. The QR is usually a 1.5-inch square sitting in the upper-right or lower-right of the page. Scan it with any phone camera. What comes out is not a URL. It is a JWT — a signed JSON payload — and the unsigned middle of it carries eight fields the government cares about most: the supplier and recipient GSTINs, the document number and date, the total invoice value (tax included), the number of line items, the HSN code of the main item, and the 64-character IRN hash itself.

That is the whole point of the QR. Even when the supplier prints an artistic version of the invoice in a custom template, the QR carries an IRP-stamped copy of the eight fields that matter for tax. The hash at the front of the IRN is computed over those fields. Tamper with any of them on the printed page and the IRN won't match what the IRP has on record.

You don't need to verify the cryptographic signature yourself. Pasting the IRN into the public verification portal does that for you, and gives back a green tick or a "no record found" in two seconds.

Verifying It in Under Thirty Seconds

There are two ways to verify and either gets you to the same answer, so pick whichever is closer to hand at the moment.

The official portal route is the slower of the two but it pulls live cancellation status. Go to einvoice1.gst.gov.in. Top menu, Search → "Verify Signed Invoice" or "Search IRN". Paste the 64-character IRN from the QR (or upload the signed JSON) and submit. You get back the IRP record: supplier, recipient, date, value, status (active or cancelled). If the printed invoice and the IRP record disagree on any field, you have your answer.

The mobile route is faster for batch checks. NIC publishes the official "e-Invoice QR Code Verifier" on Play Store and the App Store. Open the camera, point at the QR, and the app decodes the JWT and validates the signature against the NIC public key offline. No internet needed for the signature check itself. You only need the network for the cancellation lookup.

Either way the whole exercise takes about twenty seconds once you've done it twice, which is faster than copying the supplier's GSTIN into Excel by hand.

For the GSTIN itself, separately from the QR, our own GSTIN Validator checks structure and the mod-36 checksum in the browser without a portal round-trip. Run the supplier's GSTIN through it before you even open the verifier app. Plenty of spoofed GSTINs fail the checksum and you can throw the invoice out at that step.

Three Red Flags Worth Stopping For

After looking at a few hundred B2B invoices you start picking these up without thinking, but the three patterns to consciously watch for are these.

A missing QR on an invoice from a supplier whose turnover is plainly above ₹ 5 crore. Big logo, branded template, public listing on Tracxn or MCA showing turnover in tens of crores, no QR code anywhere on the page. That combination should not exist. Either the supplier is operating outside the e-invoicing rule (illegal) or somebody made the bill in a hurry on a stale template that was never updated for the August 2023 threshold cut. Either way, ask for a fresh invoice with the IRP stamp before you book it.

A QR that decodes but the data does not match the printed page. Usually this is a single-character GSTIN drift — the QR ends in F1Z5, the printed letterhead reads G1Z5, and a quick eyeball misses it on a Friday afternoon. Totals get swapped on you in the same way (₹ 1,18,000 versus ₹ 1,80,000 is one I've seen recently), as do document numbers when a digit transposition slips through (INV/2026/0042 in the QR, INV/2026/0420 on the print). Any single mismatch is enough to stop. The IRP-stamped fields are the authoritative copy; the print on the page is whatever the supplier's billing software felt like printing, and if the two disagree, it is the page that is wrong.

A QR that does not decode at all. Garbled blob, fuzzy low-resolution scan, or a clearly fake-looking image that no app can read. This one is rarer than the first two, and it is the most diagnostic of the three. A real IRP-generated QR encodes a signed JWT, and signed JWTs decode cleanly even from a poor photocopy. A QR that won't open in any app is almost always a placeholder image dropped in by someone whose only goal was to make the invoice look right at a glance.

If the invoice clears all three checks and still feels off, you are probably overthinking it. If it fails any one of them, you have a problem.

What ₹ 44,015 Crore of Fake Invoices Looked Like

The Karnataka case from 23 April is a useful one to study because the operating model is identical to most of the 29,273 firms flagged since May 2023. A small group of operators registers fifteen to twenty firms in three or four states using rented PAN cards and forged electricity bills as address proof. Each firm gets a real GSTIN and a real bank account. Each firm starts issuing invoices to genuine downstream buyers without ever supplying a single physical good. The buyer claims ITC, which is real money. Ten lakhs at a time, sometimes more. The operator collects a small commission from the syndicate, files token returns to keep the GSTIN looking active, and rotates to the next firm before the department's analytics catch up.

The reason a buyer-side QR check matters here is that some of these firms generate IRNs (the IRP doesn't actually verify whether the underlying transaction is real, only that the GSTIN is active and the format is valid), but plenty of them don't bother. The ones that don't are the ones whose invoices either lack a QR entirely or carry a placeholder QR that doesn't decode. A two-minute QR check at booking time would have caught a meaningful slice of the ₹ 44,015 crore that ended up in the news.

Even when the IRN exists and is genuine, a buyer who pulls the supplier's filing history (GSTR-1 versus GSTR-3B mismatch, sudden inactive status) catches the rest. The QR is the cheapest first-pass filter you have.

What to Do If a Bill Fails the Check

Don't claim the ITC. That is the headline rule. Once a notice arrives reversing it, you are paying the credit back with eighteen percent interest under section 50, plus a penalty up to the credit amount under section 74 if the department considers the claim wilful. The arithmetic gets ugly fast.

Practically: park the invoice, email the supplier with a screenshot of the IRP mismatch, and ask for a fresh IRP-stamped invoice. If the supplier goes quiet or the response is hand-wavy, that is your answer. Don't sit on the bill for three months and hope it sorts itself out.

To report a confirmed fake, the GST portal has a dedicated flow at gst.gov.in → Services → User Services → "Report Fraud / Provide Information". You can also email [email protected]. Reports are anonymous if you want them to be, and they feed into the same enforcement workflow that produced the Karnataka arrest. Doesn't bring back the ITC you avoided losing, but it slows the operator down for the next buyer in the chain.

Catching This Across a Folder of Invoices

At ten or fifteen B2B bills a month you can scan every QR by hand and not feel it. Beyond that, the cost of doing it manually goes up faster than the cost of skipping it goes down, which is exactly the volume range where fraud usually slips through.

GSTExtract pulls the supplier GSTIN, recipient GSTIN, invoice number, date, and total off every PDF in a batch and gives you one Excel sheet back with the suspicious rows surfaced at the top. Drop a folder of bills in, walk the suspicious rows in five minutes, run the IRP verifier on the few that actually look off, leave the rest alone. No signup, free to try.

Convert to Excel

It does not replace the IRP verification step on high-value bills. It does mean you are only running that step on rows that actually deserve it.

Related Tools

• GSTIN Validator — check structure and mod-36 checksum on any GST number in the browser
• GST Invoice Reader — pull GSTIN, invoice number, date, taxes, and total out of a folder of PDFs into Excel
• GST State Code List — the first two digits of every GSTIN, with an Excel download
• How to Verify a GSTIN Online — the ten-second checksum test plus when to check the portal for active status
• 7 Common GST Invoice Errors — the mistakes that quietly kill your ITC at reconciliation
• How to Read a GST Invoice — field-by-field walk-through of every invoice field
• GST 2.0 on Your Invoice — what the 22 September 2025 rate cutover means for your bills
• GSTR-2B Reconciliation in Excel — clearing exceptions in the six-day window before the April 2026 hard lock blocks your filing
• How to Find Company Details from a GST Number — the portal lookup catches the carefully-constructed fakes that pass the structural validator