How to Verify an E-Invoice in Saudi Arabia: A Step-by-Step Guide

When you receive an invoice from a supplier or store in Saudi Arabia, how do you make sure it is a genuine e-invoice approved by the system, and not just a printed sheet with no legal value? Verifying an e-invoice is the practical answer to that question. It is a simple procedure that takes seconds, yet it protects your purchase from fake invoices, protects your business from claiming input VAT on an invalid invoice, and gives you confidence that the seller is genuinely registered in the e-invoicing system.

In this guide we explain, step by step, how anyone can verify that an e-invoice is valid: what verification actually means, how to scan the QR code using the Fatoora platform app, what verification shows on screen, how to read the result of the cryptographic stamp check along with the seller name and tax number, and finally how to spot a fake invoice before you record it in your books. This guide is part of our Saudi e-invoicing compliance series, and is linked toQoyod’s e-invoicing software.

What does “verifying an e-invoice” mean?

Verifying an e-invoice means confirming that the invoice in your hands was actually issued by a compliant invoicing system, that its data has not been altered after issuance, and that the seller who issued it is known to the Zakat, Tax and Customs Authority (ZATCA). An e-invoice is not just a nice-looking image or a formatted PDF file. It is a digital document that carries within it a technical signature that proves its identity and reveals any tampering.

The difference between an e-invoice and a traditional paper invoice is fundamental. Anyone can print a paper invoice, change its figures, or even fabricate it from scratch. An e-invoice in the second phase of e-invoicing, on the other hand, carries encrypted data that cannot be easily forged. When you verify it, you read this encrypted data and compare it with what is written on the face of the invoice. If they match, the invoice is sound. If they differ, there is a problem.

This verification matters to three groups. It matters to the individual buyer who wants to make sure the seller is legitimate and that the invoice will serve them if they need a return or a warranty. It matters to the business that receives its purchase invoices, because it cannot deduct input VAT except from a valid invoice issued by a tax-registered supplier. And it matters to the auditor and accountant who reviews a client’s books and needs to confirm that expense invoices are genuine and not fabricated to inflate expenses.

The foundation that makes verification possible: the second phase of e-invoicing

To understand how verification works, we need a quick look at the phases of e-invoicing. The Authority launched the e-invoicing program in two phases. The first phase, the generation phase, became mandatory for all taxpayers registered for VAT as of 4 December 2021. In this phase every business had to issue its invoices from an electronic system and place a QR code on final-consumer invoices.

The second phase, the integration phase, began on 1 January 2023 in waves according to the taxpayer’s annual revenue. This phase is the one that added the security elements on which verification is built. Every invoice now has to carry a cryptographic stamp, a unique invoice identifier (UUID), a hash of the previous invoice to link invoices in a connected chain, and a QR code that holds the invoice data and its signature together.

These four elements are what make an invoice verifiable. The cryptographic stamp proves that the invoice was issued by an approved system and has not been modified. The unique identifier distinguishes each invoice from the others. The hash links invoices in a chain, so no invoice can be deleted from the middle without breaking the chain. And the QR code combines all of this in a small square that can be scanned by a phone camera in a single second.

Here an important difference between the two types of invoice appears. A standard tax invoice between businesses (B2B) must pass through the Fatoora platform and be cleared before it is sent to the buyer. A simplified tax invoice directed at the final consumer (B2C), on the other hand, is handed to the buyer immediately, then reported to the Authority within 24 hours. This difference affects what verification shows, as we will see later.

How Qoyod helps you

Qoyod is a Saudi accounting software compliant with the second phase of e-invoicing. Every invoice you issue from Qoyod is signed, stamped, and given a unique identifier and a QR code automatically, in line with the Authority’s specifications. Qoyod manages the signing certificate (CSID) on your behalf and keeps the chain of invoice hashes for verification and compliance purposes. Standard invoices between businesses pass through the Fatoora platform for instant clearance, and simplified consumer invoices are reported to the Authority within 24 hours. The result is that every invoice you issue from Qoyod passes verification on the other side without trouble, because it is built on the official specification from the very first moment.

The QR code: the gateway to verification

The fastest way to verify an e-invoice is the QR code printed on it. This black-and-white square is not just decoration. In the second phase of e-invoicing, the code holds compressed data written in a standard format called TLV, which includes the seller name, tax number, the invoice date and time, its total, the VAT amount, and part of the cryptographic stamp data.

In other words, the QR code is a machine-readable copy of the most important invoice data, cryptographically signed. When you scan it with the official verification tool, the tool reads this data, displays it to you, and verifies that the signature is valid. For more detail on the structure of this code and its content, see the guide The QR code in the e-invoice.

It is important to know that the mere presence of a QR code is not enough to judge an invoice as sound. Anyone can print a square that looks like a QR code. The difference is that a genuine code carries signed data that matches the face of the invoice and passes the check of the official tool. A fake code either does not scan, or scans but its data does not match what is printed, or fails the signature check. That is why we do not settle for looking at the code; we scan it and read the result.

The practical method: verifying through the Fatoora platform app

The Authority has provided an official tool for reading the QR codes on e-invoices and verifying them. The tool is available through the Fatoora platform app on your phone, and works on Android and iPhone devices. The verification steps are simple and require no technical expertise.

First, download the official app from the app store on your phone. Make sure the publisher is the Authority and not an imitation app with a similar name. Second, open the app and choose the option to read a QR code or verify an invoice. Third, point your phone camera at the QR code printed on the invoice, and wait until the app captures it. Fourth, read the result the app displays on the screen.

If the QR code is on a paper invoice or on a screen, point the camera directly at it in good lighting. If the invoice is a PDF file on a computer screen, you can point your phone camera at the screen, or use tools that read the code from the image directly. The idea is the same in every case: the app reads the encrypted data inside the code, then displays it and verifies it.

The whole process takes less than half a minute in a normal case. This speed is intentional. The Authority designed the verification mechanism to be within reach of any consumer standing at the checkout, not a complex tool that needs an accountant. The goal is for invoice checking to become a simple daily habit, just like making sure your cash change is correct.

What does verification show you on screen?

When the app reads the QR code of a sound invoice, it displays a set of fields extracted from inside the code. These fields are the heart of the verification process, because you will compare them with what is printed on the face of the invoice. The most important items that usually appear:

• The seller name as registered in the system.
• The seller’s tax number, which is a 15-digit number.
• The exact date and time the invoice was issued.
• The invoice total, including value added tax.
• The value added tax amount at a rate of 15%.
• The status of the cryptographic stamp, i.e. whether the signature is valid or not.

The golden step after reading these fields is matching. Look at the seller name that appeared in the app, and compare it with the store name on the invoice. Look at the tax number in the app, and compare it with the printed tax number. Look at the total and the VAT amount, and make sure they match the invoice figures. If everything matches and the signature passes the check, the invoice is sound with a high degree of confidence.

Remember the difference between the two types of invoice. The simplified consumer invoice (B2C) carries a full QR code that can be read directly, and this is what most people scan. The standard invoice between businesses (B2B), however, follows a different path, because it passes through the Fatoora platform and is cleared before it reaches the buyer, and it is often verified through the clearance data rather than by merely scanning the code. If you are a business receiving a B2B invoice, the most important evidence of its validity is that it reached you cleared by the platform through the seller’s system.

Checking the cryptographic stamp, the seller name, and the tax number

The cryptographic stamp is the most important security element in the invoice. It is a digital signature created using an encryption certificate from the Authority, and it proves two things at once: that the invoice was issued by an approved system, and that its content has not been modified after signing. If someone changes a single figure in the invoice after it was issued, the stamp breaks and verification fails. To understand how this stamp works in detail, see the guide The cryptographic stamp in the e-invoice.

When you verify, the tool tells you whether the stamp is valid. A positive result means that the data inside the QR code is consistent with the signature, and that the invoice has not been touched. A negative result means either that the code is corrupted, or that the data has been modified, or that the code was not issued by an approved system in the first place. In all these cases, do not accept the invoice, and go back to the seller.

The tax number deserves a pause. The Saudi tax number consists of 15 digits, and usually begins and ends with the digit 3 according to a specific structure. Check two things. First, that the number shown in the verification tool matches the number printed on the invoice, digit for digit. Second, that the seller name associated with this number is the same name as the store you are dealing with. Any difference between the two names, or a tax number with missing digits, is a clear warning sign.

The seller name must be the name of the registered business, not a generic personal name or a vague description. A genuine store registered for tax issues its invoices under its approved trade name. If you find an invoice under a name unrelated to the store, or under an individual’s name instead of a business where a business name should appear, ask why before you accept it.

How do you spot a fake invoice?

A fake invoice may look convincing at first glance. It may carry a logo, a square that looks like a QR code, and formatted figures. But verification exposes it. Here are the most prominent signs that reveal an invalid invoice, ordered from the most obvious to the most subtle.

The first sign: the QR code does not scan. If you point the camera at the code and the app does not capture it at all, or captures it and then shows an error message, this is a strong indicator that the code is not a genuine invoice code but a drawn image or a random code.

The second sign: the data read does not match the face of the invoice. This is the most dangerous sign, because the code scans yet reveals the truth. For example, the printed total is SAR 1,150, while the data inside the code says SAR 500. Or the seller name on the paper differs from the name inside the code. Any conflict between the printed and the scanned data means tampering.

The third sign: the cryptographic stamp fails. The app reads the code and displays the data, but tells you that the signature is invalid. This means the invoice was modified after issuance, or was not issued by an approved system. Do not accept an invoice whose stamp has failed, however logical the rest of its data may seem.

The fourth sign: the tax number is incomplete, missing, or illogical. A correct tax number is exactly 15 digits. If you find a shorter number, or the tax number field is empty, or a number that does not follow the usual structure, the invoice is suspicious.

The fifth sign: the figures match but the QR code is entirely absent from a consumer invoice. A simplified invoice directed at the consumer must carry a QR code. Its complete absence from a B2C invoice raises a legitimate question about the seller’s compliance.

What do you do if you discover a suspicious invoice? Start by asking the seller directly and give them a chance to issue a correct invoice, as it may be a passing technical error. If the seller insists or refuses, you can report the violation to the Authority through its official channels. Reporting protects the whole market, and protects your own right as a buyer to a compliant invoice that proves your transaction.

Why does verification matter to your business specifically?

If you are a business owner or an accountant, verification is not a luxury. It is a procedure that protects your money and your books from real risks. The first of these risks relates to input VAT deduction.

When filing a value added taxreturn, your business deducts the tax it paid on its purchases (input VAT) from the tax it collected on its sales (output VAT). But this deduction is conditional on the purchase invoices being valid and issued by tax-registered suppliers. If you deduct input VAT based on a fake invoice or from an unregistered supplier, you may face rejection of the deduction and penalties upon review.

The second risk relates to the integrity of the books themselves. Fake invoices are a common means of inflating expenses and reducing the apparent profit. A vigilant accountant who verifies large expense invoices, especially from new or unfamiliar suppliers, protects the business from entries built on unreal documents. This is part of due professional care.

The third risk is practical and operational. If your business accepts an invalid purchase invoice, you may later face a problem proving the expense, or recovering the amount, or claiming a warranty. A valid invoice is a legal document that proves the transaction. A fake invoice proves nothing, and may turn into a burden on you.

The reassuring side is that your business easily controls half of the equation: the invoices you issue yourself. When you use a compliant accounting software like Qoyod, you ensure that every invoice leaving your business passes verification at your customers’ end without errors. It remains for you to stay vigilant about the other half, which is the purchase invoices you receive from others.

Verification and the invoice chain: the auditor’s angle

There is a deeper layer of verification that matters to the accountant and auditor more than to the ordinary consumer, which is the integrity of the invoice chain. In the second phase of e-invoicing, every invoice carries a hash of the invoice before it. In this way a business’s invoices are linked in a connected chain, each link pointing to the one before it. This linkage makes deleting an invoice from the middle, or inserting a forged invoice, something that breaks the chain and appears immediately upon inspection.

For the auditor, this chain is a powerful tool. When reviewing a business’s books, one can confirm that the sequence of invoices is logical and connected, and that there are no suspicious gaps in it. Any attempt to hide sales by deleting invoices, or to inflate purchases by adding fake invoices, collides with this structure. An e-invoice does not merely prove its own validity; it also proves its position within the business’s entire sequence.

For this reason, seasoned accountants prefer that all of a client’s invoices be issued from a single compliant system, not from scattered systems or manual files. A unified system keeps the chain intact, makes verification and review easier later, and reduces the likelihood of errors that may appear as tampering when they are merely organizational chaos. Discipline in issuance is half of discipline in verification.

A monthly habit that protects your business

Verification is not a procedure you do once and forget. Make it a regular habit tied to the month-end close. When reviewing purchase invoices before the tax return, set aside a few minutes to check large invoices and invoices from new suppliers. You are not obliged to check every small invoice, but high-value invoices deserve scanning and matching, because they have the greatest impact on input VAT and on net profit.

Document what you do. If you reject an invoice because it failed verification, record that and ask the supplier for a valid replacement. This documentation protects your business if you are later asked why a certain input VAT deduction was not made. Simple discipline today saves a long dispute upon review tomorrow. Most importantly, it builds a clearer relationship with your suppliers, as they learn that you operate by the rules and expect the same from them.

Frequently asked questions about verifying an e-invoice

Is verifying an invoice free?

Yes. The official Fatoora platform app from the Authority is available for free on the app stores, and verifying invoices through it costs nothing. Do not pay any party for a verification service.

Do I need an account or login to verify?

Basic verification of the QR code on a consumer invoice does not usually require a login. You point the camera at the code, and the app reads the data and displays it. Some advanced features may require an account, but a quick invoice check is available directly.

The invoice I received is a PDF file with no clear code. What do I do?

If it is a consumer invoice (B2C) and lacks a QR code, this is a warning sign, because the code is mandatory on these invoices. A business invoice (B2B), however, follows a different path, as it is cleared through the Fatoora platform, and the evidence of its validity is that it reached you cleared by the seller’s system.

What is the difference between a cleared invoice and a reported invoice?

A standard invoice between businesses is cleared through the Fatoora platform before it is sent to the buyer. A simplified consumer invoice is handed over immediately, then reported to the Authority within 24 hours. The difference lies in the timing and in the verification path appropriate to each type.

Does the absence of a QR code necessarily mean the seller is non-compliant?

On a consumer invoice, the code is mandatory, and its absence is a strong indicator of a problem. On a business invoice, verification relies on the platform’s clearance rather than on the code alone. So ask the seller first before passing a final judgment, as the invoice type may be different from what you think.

Does Qoyod guarantee that my invoices pass verification?

Qoyod is compliant with the second phase of e-invoicing, and signs, stamps, and gives every invoice a QR code in line with the Authority’s specifications. This makes your invoices built on the official specification, so they pass verification at your customers’ end. Registering the CSID certificate with the Authority remains a step the business owner performs, and Qoyod guides you through it.

Practical summary

Verifying an e-invoice is a simple skill with a big impact. Scan the QR code with the official Fatoora platform app, read the seller name, their tax number, the total, and the VAT amount, match them against the face of the invoice, and make sure the cryptographic stamp passed the check. If everything matches, the invoice is sound. If a conflict appears or the stamp fails, do not accept it and go back to the seller.

This habit protects the individual buyer from a non-compliant seller, protects the business from a wrong input VAT deduction, and protects the accountant from entries built on fake invoices. And on the issuance side, a compliant accounting system ensures that your invoices pass verification at the other end the first time. Compliance begins with a valid invoice, and a valid invoice begins with a valid system.