GST Certificate Verification: How to Check REG-06 and Spot a Fake GST Certificate

GST certificate verification is the process of confirming that a GST registration certificate (FORM GST REG-06) is genuine and current. It involves checking the GSTIN format, matching the certificate’s legal name, trade name, address, and constitution against the GST portal’s taxpayer search, and examining the document itself for edits.

A GST certificate is one of the most commonly submitted business documents in India. Lenders, payment aggregators, marketplaces and procurement teams ask for it because it looks official and carries a government format.

That is exactly why it gets forged. This guide explains what REG-06 contains, how to verify a GST certificate in five steps, how fake GST certificates are made and caught, and how to run GST certificate verification across thousands of files.

What a GST registration certificate is

Under Rule 10 of the CGST Rules, 2017, once registration is approved, a certificate in FORM GST REG-06 showing the principal place of business and any additional places of business is made available on the common portal. Every certificate must be signed or verified through an electronic verification code by the proper officer.

Published REG-06 Format

• Registration number (GSTIN)
• Legal name and trade name, if any
• Constitution of business
• Address of principal place of business
• Date of liability and, for casual or non-resident taxpayers, period of validity
• Type of registration
• Approving authority details and date of issue

Annexure A

Listing additional places of business.

Annexure B

Listing details of the persons responsible for the business, with photographs.

Rule 18 requires every registered person to display the certificate prominently at the principal and every additional place of business, and to show the GSTIN on the name board at the entry.

How the GSTIN is structured

Rule 10 also defines the GSTIN as a 15-character number.

The checksum means a randomly typed GSTIN usually fails validation. It does not stop a fraudster from copying a real GSTIN belonging to someone else, which is the more common problem.

How to verify a GST certificate: five steps

Manual GST certificate verification takes a few minutes per document. The steps below are what an analyst should do every time.

1. Validate the GSTIN format: 15 characters, valid state code, a PAN in positions 3 to 12, and a passing checksum.
2. Search the GSTIN on the GST portal: Use the "Search Taxpayer" function and note the status (Active, Suspended, Cancelled), legal name, trade name, constitution, registration date, and principal place of business.
3. Compare certificate details: Compare every field on the certificate with the portal result. Any difference in legal name, constitution, or address is a red flag.
4. Verify the PAN: Confirm the GSTIN's PAN matches the business PAN collected elsewhere in the application.
5. Check return filing history: A genuine certificate attached to a GSTIN that has not filed returns for months is weak proof of an operating business.

What the portal can and cannot tell you

The portal confirms what is registered today. It cannot confirm that the PDF in your file is the one the portal issued. A fraudster who copies a real, active GSTIN onto an edited certificate will pass step 2 unless step 3 is done carefully.

How fake GST certificates are made

The scale of fake registrations shows the pressure on GST documents. PIB reported on 7 January 2024 that GST formations had detected 29,273 bogus firms involved in suspected ITC evasion of ₹44,015 crore since May 2023. In a Lok Sabha reply on 15 December 2025, the government reported 489 fraudulent registrations involving forged PAN and Aadhaar in April to October 2025.

Those are fake registrations: real GSTINs obtained with false identities. A fake GST certificate is a different problem, and usually takes one of four forms:

• Name swap: A real certificate is edited to replace the legal or trade name with the applicant's.
• Address swap: The principal place of business is changed to match a loan or merchant application.
• GSTIN transplant: A real GSTIN from another business is placed on a fabricated certificate.
• Full fabrication: A certificate is built from a template, sometimes with a cancelled or non-existent GSTIN.

Fake registrations feed schemes. Fake certificates mostly feed onboarding fraud: credit lines, merchant accounts, and vendor empanelment.

Detecting an edited GST certificate

Portal matching catches transplants and fabrications with mismatched data. Name and address swaps on a real GSTIN need document-level checks.

No single signal proves forgery. An image-only PDF can be an honest scan. The decision rule should combine document signals with the portal match: a clean portal match plus heavy edit signals is a stronger fraud indicator than either alone.

GST certificate verification at scale

For an NBFC or payment aggregator receiving thousands of certificates a month, manual checks do not hold up. A scalable design separates two questions.

1. Is the registration genuine and current? Answer with a GSTIN check against GST data on every application.
2. Is this document unaltered? Answer with automated tamper analysis on every uploaded PDF or image.

Then route by result:
Portal match and clean document: auto-approve the GST proof.
Portal match and edit signals: manual review, request a fresh download.
Portal mismatch: reject the document and flag the application.
An API-based approach fits the second question; the first is a data check. Payment aggregators should feed confirmed fakes into rules so linked applications are caught.

Illustrative scenario: a marketplace finds that several new seller applications carry certificates whose metadata shows the same editing software and identical modification timestamps. The GSTINs are real but belong to unrelated businesses. Clustering by document signal exposes a single operator behind the batch.
Where BeFiSc fits: TamperProof analyses uploaded documents for metadata anomalies, altered text, structural edits, editing tools used, signature validity, and embedded files. It answers the second question: whether the GST certificate you received has been modified, and complements your GSTIN check against GST data. Send 20 to 50 recent GST certificates for a free tamper audit and compare the findings with your current review outcomes.

Key Takeaways

• Two-part verification: GST certificate verification has two parts: confirm the registration on the GST portal and confirm the document has not been edited.
• FORM GST REG-06: Issued under Rule 10 of the CGST Rules, it contains the GSTIN, legal and trade name, constitution, address and annexures to match field by field.
• GSTIN checksum: The GSTIN checksum blocks random numbers but not a copied real GSTIN.
• Common forms of fake GST certificates: Name swaps, address swaps, GSTIN transplants , and full fabrications.
• Automated verification: At volume, combine a GSTIN data check with automated tamper analysis, and route by the combined result.

Conclusion

A GST certificate looks authoritative, which is why reviewers often stop at the GSTIN. The fraud happens in the gap between a real registration and an edited document.

Teams that run both checks, data and document, on every file close that gap. As fake registration drives continue to surface new networks, GST certificate verification belongs in the automated layer of onboarding, not the manual exception queue.