How to verify an e.firma-signed document or CFDI in Mexico

In Mexico, the e.firma (formerly FIEL) (the advanced electronic signature issued by the tax authority, the SAT) is used for tax filings, invoices, government procedures and many business transactions. But most of what it signs is not a signed PDF. Knowing where the signature actually lives tells you how to check it.

The short answer

The legal background, briefly

• The Ley de Firma Electrónica Avanzada (2012) governs advanced electronic signatures in dealings with and within the federal public sector, and the Código de Comercio covers electronic signatures in commerce.
• The SAT issues the e.firma certificate after verifying identity in person, and it is used across federal procedures.
• The CFDI: Comprobante Fiscal Digital por Internet. Is the mandatory electronic invoice. It is an XML document sealed by the issuer and certified (timbrado) by an authorised certification provider (PAC), which assigns a unique folio fiscal (UUID).

CFDI: the XML is the invoice

The PDF you receive with a CFDI is only a printed representation. It contains the folio fiscal, the RFCs, a QR code and the seals printed as text, but anyone can type those into a fake PDF.

To verify a CFDI:

1. Take the folio fiscal, the issuer's RFC and the receiver's RFC. The folio fiscal is a 36-character identifier in five groups separated by hyphens (8-4-4-4-12 characters).
2. Enter them in the SAT's Verificación de comprobantes fiscales digitales por internet service, reached through the SAT's official site, together with the image code it shows. If you have the XML, the service can also check it by uploading the file.
3. The result shows whether the SAT has a record of the CFDI and its status: including whether it has been cancelled.
4. Compare the details with the PDF. Always ask for the XML too; that is the actual invoice and the one to keep.

More on e-invoices in other countries: How to verify a signed e-invoice.

Constancia de Situación Fiscal and other SAT documents

The Constancia de Situación Fiscal shows a taxpayer's RFC, name, tax address and regime. It carries a QR code and printed seals.

To verify it:

• Scan the QR code. It should open a page on the SAT's official domain showing the taxpayer's data.
• Check the address in your browser before trusting the page. Forgers print QR codes that lead to lookalike sites.
• Compare the RFC, name, tax address and regime with the document.

For tax return acknowledgements (acuses) with a digital seal, the SAT offers a service to verify the authenticity of the digital seal of returns. You sign in with an RFC and password or with e.firma, then paste the acknowledgement's cadena original (original string) and sello digital (digital seal); the service tells you straight away whether the seal matches, and the result can be printed.

The SAT also runs a service to verify the integrity and authorship of documents signed with the e.firma or digital seal of its competent officials: the route for resolutions, notices and other documents an SAT official has signed electronically. Find it through the SAT's own list of procedures and services.

When a PDF really is digitally signed

Some documents in Mexico are signed as PDFs with an embedded digital signature: contracts, some notarial and institutional documents, documents from e-signature platforms. For these:

1. Upload the PDF to Verify PDF Signature.
2. Check Signature: Valid and Unchanged since [name] signed it.
3. Read any changes after signing; compare pages and download the signed version if needed.
4. In Certificate details, see who issued the certificate. An e.firma certificate is issued by the SAT's certification authority. Our Trust row may say Not trusted because that root is not on this service's list. That is about the list, not the signature.

Common real-life situations

A supplier sends only a PDF invoice

Ask for the XML and verify the folio fiscal with the SAT. A PDF alone is not a CFDI.

A landlord or employer asks for your Constancia

Send the original PDF downloaded from the SAT, not a scan. The QR code must be readable. If you receive one, scan the QR code and check the domain.

An invoice that was cancelled after payment

The SAT verification shows the current status. Check before recording or paying high-value invoices, and again if something seems wrong.

Bank details on an invoice PDF

The SAT confirms the invoice, not the bank account printed on the PDF. Confirm new or changed bank details by phone using a number you already had.