How to verify a signed e-invoice (India, Saudi Arabia, Mexico, EU and more)

An invoice arrives as a PDF with a QR code, a long reference number, maybe a signature block. Is it genuine? Has anyone changed the amount or the bank details?

With e-invoices, the answer is almost never "check the PDF's signature". In most countries that run mandatory e-invoicing, the real invoice is data held or registered by the tax authority's system, and the PDF is a human-readable copy. Knowing that tells you where to look.

The short answer

• Find the system the invoice belongs to: usually shown by a QR code, a registration number or a stamp from the tax authority.
• Verify the invoice there: with the tax authority's official app or portal.
• Compare what the authority returns (seller, buyer, date, amount, tax) with the PDF in front of you.
• Check payment details separately. E-invoicing systems confirm the invoice was registered; they generally do not confirm the bank account printed on the PDF.

Why the PDF isn't the invoice

E-invoicing systems are designed for software, not people. The seller's system produces structured data (XML or JSON), which is signed, cleared or registered by the tax authority's platform. A QR code or ID printed on the PDF points back to that record. The PDF may or may not be signed at all, and even if it is, the signature proves only that the PDF was not changed, not that it matches what was registered.

So a forged invoice can carry a genuine-looking QR code copied from a real one. What catches it is checking the QR code against the authority's record and comparing the details.

India: GST e-invoices (IRN and signed QR code)

For businesses in scope of GST e-invoicing, each invoice is reported to an Invoice Registration Portal (IRP), which returns an Invoice Reference Number (IRN) and a QR code signed by the IRP.

How to verify:

• Use the official e-Invoice QR Code Verifier app listed in the GST portal's help pages. It checks the QR code's signature against the IRP's public key and shows the key invoice details: seller and buyer GSTINs, document number, type and date, total value, number of line items, main HSN code, the IRN and its date. It covers invoices from all the IRPs and does the check offline, so it confirms the QR code was signed by an IRP, not whether the invoice was later cancelled.
• Compare every detail with the PDF. A mismatch in amount, GSTIN or date means the PDF does not match the registered invoice.
• A signed QR code proves the IRP registered an invoice with those details. It does not verify the bank account on the PDF.

Documents such as Form 16 and other certificates in India are a different matter. Many are PDF-signed with a DSC. See How to verify a DSC-signed PDF in India.

Saudi Arabia: ZATCA e-invoices (FATOORA)

Saudi e-invoicing, run by the Zakat, Tax and Customs Authority (ZATCA) and branded FATOORA, came in two phases. The generation phase (Phase 1), in force since 4 December 2021, requires invoices to be produced by compliant electronic systems and simplified invoices to carry a QR code. The integration phase (Phase 2), rolled out in waves of taxpayers from 1 January 2023, connects those systems to ZATCA's FATOORA platform: standard tax invoices (business to business) are cleared by ZATCA before they are issued, and simplified invoices (mostly business to consumer) are reported to ZATCA within 24 hours. In this phase the QR code also carries cryptographic elements, including a hash and the cryptographic stamp, linking the printed invoice to the invoice data.

How to verify: ZATCA's own guidelines point to its official VAT app, which scans the QR code on tax invoices and simplified tax invoices and shows the QR code's contents and the verification result. Compare the seller name, VAT number, date, total and VAT amount with the PDF. More on signatures in the Kingdom: How to verify a digitally signed document in Saudi Arabia.

Mexico: CFDI

In Mexico the invoice is the CFDI, an XML document sealed by the issuer and certified (timbrado) by an authorised certification provider, which assigns a folio fiscal (UUID). The PDF is only a printed representation.

How to verify: use the SAT's service "Verificación de comprobantes fiscales digitales por internet" with the folio fiscal, the issuer's RFC and the receiver's RFC, or upload the XML file itself. It reports whether the SAT has a record of the CFDI and its status, including whether it has been cancelled. Always ask for the XML as well as the PDF; the XML is the invoice. More in How to verify an e.firma-signed document in Mexico.

European Union: structured e-invoices and PDFs

Across the EU, e-invoicing is based on a European standard for structured invoice data, and public-sector buyers must be able to receive such invoices. Several member states are rolling out wider business-to-business mandates on their own timetables, and EU-wide digital reporting is being phased in. The details and dates vary by country and have moved before, so check your own country's current rules.

What that means for verification:

• A structured e-invoice (XML such as UBL or CII, or a hybrid PDF with embedded XML) may be exchanged through a network such as Peppol or a national platform, where the sender's identity is established by the network.
• Some countries require or allow a qualified signature or seal on invoices; others rely on the exchange channel. A Factur-X/ZUGFeRD hybrid is a readable PDF with the XML invoice embedded; the XML is what systems process.
• If a PDF invoice carries a PAdES signature or seal, you can check that PDF with Verify PDF Signature, which also reports the eIDAS level from the EU Trusted Lists.

Other countries, briefly

Many other countries run clearance or reporting systems: among them Turkey (e-Fatura and e-Arşiv), Indonesia (e-Faktur), Egypt, Kenya, Nigeria and much of Latin America. The pattern is the same: a code or ID on the document, verified in the tax authority's own system. Find the official verification method on the authority's own site, not through a link on the invoice.

When a PDF signature check does help

• Non-mandatory invoices that a supplier signs as a PDF (common with business suppliers using certificate-based signing). Verify PDF Signature tells you whether the PDF changed after signing (including whether someone added a text box over the bank details) and who signed it.
• Invoices sent through e-signature platforms, which carry the platform's seal.
• Supporting documents: statements of account, credit notes, remittance letters. That are PDF-signed.

The payment-fraud warning

Most invoice fraud does not fake the tax registration. It changes the bank details: on a genuine invoice, or in an email saying "our account has changed". No e-invoicing QR code protects you from that.

• Confirm any new or changed bank account by phone, using a number you already had.
• Be suspicious of urgency and of changes arriving by email alone.
• If a signed PDF shows changes after signing, look at exactly what changed. An overlay on the payment details is a classic sign.