"GST notice fake or real" is a query that spikes every quarter-end, and the department's own advisories confirm why: fraudsters are impersonating tax officers at scale. Small businesses are the target because they are more likely to pay a "penalty" over the phone than to call a CA. Here is how the current scams work and how to be un-scammable.
The scams doing the rounds
1. The "final notice" phone call
A caller with a convincing Hindi/English script says a GSTR-3B mismatch has led to a penalty; pay ₹8,000 by UPI within the hour to avoid registration cancellation. They quote your real GSTIN (public data) to sound legitimate. Real officers never call to demand payment by UPI.
2. Forged DRC-01/ASMT-10 notices on WhatsApp
A PDF that looks like a show-cause notice, with a QR code that leads to a UPI payment or a fake portal. Real notices are issued only on the GST portal under "View Notices and Orders", and every genuine document carries a DIN (Document Identification Number) verifiable at the CBIC DIN portal.
3. Portal phishing
An SMS: "Your GST return is pending, log in at gst-portal-verify.in". The fake page steals your username, password and then the OTP. The only portal is gst.gov.in.
4. "Udyam / MSME renewal" fees
Udyam registration is free and permanent. Any "renewal", "certificate" or "MSME award" fee is a scam.
5. Fake input tax credit offers
"Buy invoices" from a shell company to claim ITC. This one is not a scam against you — it makes you the criminal. Since IMS, the department sees every such invoice; arrests under Section 132 happen monthly.
6. Refund scams
"Your GST refund of ₹42,180 is approved, share bank OTP to receive." Refunds credit to the bank account registered on the portal; nobody needs an OTP from you.
Verify any notice in two minutes
- Log in to gst.gov.in → Services → User Services → View Notices and Orders. If it isn't there, it isn't real.
- Check the DIN on the CBIC website ("Verify CBIC-DIN").
- Check the officer's jurisdiction on your registration certificate; a Delhi officer does not issue notices to a Chennai GSTIN.
- Never pay tax anywhere except via a challan (PMT-06) generated on the portal.
The 6-point defence
- Unique, long passwords for GST, income-tax, Udyam, bank and email — generate them with the password generator and check anything you already use with the strength checker. Password reuse is how one leak becomes five.
- Two-factor authentication on the GST portal (mandatory for turnover above ₹20 crore, optional and wise for everyone), on email, and on your bank.
- Separate the OTP phone. Keep the number registered on the GST/bank portals on a phone that isn't used for random downloads.
- Authorised signatory hygiene. Remove ex-employees and ex-CAs from the portal's authorised signatory list today.
- Scan QR codes before paying. The scanner shows exactly which UPI ID a QR pays — if it isn't a government or known merchant VPA, stop.
- A rule for staff: no one pays any government demand without the owner seeing it on the portal.
If you've already paid
- Call 1930 (national cyber-crime helpline) immediately and report on cybercrime.gov.in — banks can freeze funds within the first hour.
- Change passwords and revoke sessions on the GST and bank portals.
- Inform your CA; if a fake return or amendment was filed, it must be corrected in the next period.
FAQ
Do GST officers ever call taxpayers?
Officers may call to schedule a visit or clarify a filing, but never to demand payment. Any payment demand comes as a portal notice with a DIN.
Is a notice without DIN valid?
No. CBIC has held that communications without a DIN are invalid, barring narrow exceptions that must be regularised within 15 days.
Can I receive a genuine notice on email?
You receive an alert on the registered email/SMS; the notice itself is on the portal.
How do I check if a website is the real GST portal?
The address must be exactly https://www.gst.gov.in. Bookmark it and never follow links from SMS.