By Vaibhav Rane, Founder, Cresolv One
A finance head asked me recently, half-joking: "What actually happens to us if one of our vendors turns out to be a fake-ITC shell?"
In 2025 the honest answer was "probably a notice, some reconciliation, and a bad week." In 2026 the answer is sharper — and it's the reason this is worth ten minutes of your attention before your next vendor onboarding.
Three things quietly rewrote the risk math for Indian finance teams this year.
One: enforcement went multi-agency. GSTN data is now being shared with state economic-offence wings and the Enforcement Directorate to trace fake input-tax-credit networks — following the money through banking channels to the people who ultimately benefit. The significance isn't the penalty schedule, which already existed. It's that the investigation no longer stops at the entity that issued the fake invoice. It follows the credit. And the credit, in many cases, was claimed by legitimate buyers who had no idea their supplier was a shell.
Two: the reporting window is unforgiving. E-invoicing is mandatory from April 2026 for businesses with aggregate turnover above the notified threshold. For larger turnover slabs, an invoice not reported to the IRP within 30 days is simply invalid for ITC. There's no warning and no grace — a genuine invoice you posted late is a lost credit.
Three: the mismatches are now visible to everyone but you. The reconciliation between what your vendor filed and what you claimed is increasingly automated on the authority's side. The gap that used to sit quietly in your books until an audit is now a data point the system can surface on its own.
Put together, these mean the same thing: exposure that used to be invisible until an auditor made it visible is now visible by default — just not to you first.
The uncomfortable part of fake-ITC exposure is that you can do everything procedurally correctly and still be pulled in. You received an invoice. It had a valid-looking GSTIN. You claimed the credit you were entitled to. Months later, that vendor is identified as part of a circular-trading ring, and your credit is part of the amount under investigation.
The system doesn't distinguish, at first pass, between the fraudster and the buyer who trusted a fraudulent invoice. That distinction gets made later — after you've spent the time, the legal fees, and the goodwill explaining yourself. The entire cost sits in the explaining, and the explaining only starts once it's too late to prevent.
None of this is exotic. It's the difference between treating vendor GST health as a formality and treating it as a control.
1. Validate GSTIN as an onboarding control, not a checkbox. Check registration status and filing history before you onboard a vendor and before the first payment — not after a notice arrives. A vendor who has stopped filing, or whose registration is suspended, is a signal you want to catch at the front door.
2. Reconcile your purchase register against GSTR-2B every cycle. Not once a quarter, not at year-end. The mismatches between what you claimed and what your vendors actually filed are exactly where the risk lives. Monthly reconciliation turns a year-end scramble into a routine exception you resolve while it's small.
3. Treat the 30-day reporting clock like a payment deadline. You watch payment terms obsessively; the reporting window deserves the same discipline. A valid invoice reported late is money you can't claim — a self-inflicted version of the same loss.
Here's the through-line most teams miss: fake-ITC exposure and duplicate-payment leakage are the same kind of problem. Both are things your ERP won't catch on its own, because an ERP confirms that a field matches a field — it doesn't ask "should I trust this vendor?" or "have I seen this before, slightly changed?"
The finance teams closing this gap aren't adding more manual reviews. They're adding a layer that runs these checks automatically, at the moment an invoice arrives: is the GSTIN healthy, is this a duplicate, does the credit fall inside the reporting window, does it match the PO and the goods receipt? Answer those four questions before payment and posting, and most of the exposure never enters your books.
That's the shift worth making before the next quarter closes — from finding out at audit to knowing at intake.
See where your AP and compliance controls stand today with our readiness assessment, or size the opportunity with the ROI calculator.
Sources for the 2026 changes: GST e-invoicing mandate and 30-day reporting rule, and DGGI fake-ITC enforcement / GSTN data-sharing coverage. Verify specifics against current CBIC notifications before acting.