Fake GST officer call on WhatsApp

The phone lights up at 8:50 pm. WhatsApp video. A man in a half-visible shirt says he is from “GST department, flying squad”. He names your trade name almost correctly. He says a summons is already issued. He wants the GST portal OTP that just arrived on your SMS, “only for verification”. Your helper is locking the shutter. Your stomach drops. This is the moment many shops lose their login.

Real GST officers do not need your OTP to “verify” you. The OTP is the key to your gst.gov.in account. Anyone who asks for it on WhatsApp, Telegram, or a random phone number is not doing official work. Hang up. Do not read the OTP aloud. Do not forward the SMS.

This article is about GST officer impersonation. It is not a general fraud tour. We will not walk through every money-app trick on earth. We will stay on the GST login, fake summons, and the only place a real notice should appear: the portal.

What a real GST notice looks like

A real communication is tied to your GSTIN and shows up after you log in on https://www.gst.gov.in. Typical path:

gst.gov.in → login → Services → User Services → View Notices and Orders

Some logins also list additional notices under a similar User Services menu. Open those menus yourself. Do not tap a short link from a WhatsApp status.

A genuine notice has a reference number, a form type (many shops see DRC-series or a scrutiny notice), a period, and a demand or query written in official language. You download it from the portal. You reply on the portal when a reply is required.

A PDF that arrives only on WhatsApp, with a blurry seal, a Gmail address, and a demand to “pay in this personal account today or arrest”, is not a substitute for the portal. Even if the PDF looks scary, verify on gst.gov.in before you do anything.

OTP, password, and DSC are not for video calls

The GST portal sends OTPs for login, for adding a bank, for changing an authorised signatory, and for filing. That OTP is yours. A officer who already has legal power does not sit on WhatsApp waiting for you to whisper six digits.

Never share:

• Login OTP
• Password or username
• DSC token PIN
• Aadhaar OTP used for GST authentication
• Full PAN plus OTP together “for a case file”

If you already shared an OTP, change the password on gst.gov.in immediately. Path after login:

Services → User Services → Change Password (wording can vary slightly on the screen)

Add a strong password you do not reuse. Check authorised signatory and bank details the same night. If a new email or mobile was added, that is an emergency. Get local help and use the portal grievance or helpdesk channels listed on gst.gov.in — not a number the caller gave you.

Fake summons, fake flying squad, fake “video hearing”

Scammers like three scripts.

Script one: “Summons tomorrow, pay compounding now.” Real summons and hearing details, when they exist, are on the portal or served in the manner the law allows. A WhatsApp video is not service.

Script two: “Your GSTIN will be cancelled in one hour.” Cancellation and suspension show on the portal under registration status. You can also search your GSTIN as a taxpayer:

gst.gov.in → Search Taxpayer → Search by GSTIN/UIN

If the status is still active, the one-hour threat is theatre.

Script three: “We are from the facilitation centre, share screen on WhatsApp.” Screen sharing while you type the OTP is how the login is stolen. Real helpdesks on gst.gov.in do not need you to share the OTP screen.

If a person at your door claims to be from the department, ask for their identity card, note the name, and still verify any demand on the portal. Do not hand cash. Do not install a “GST recovery app” from a link they dictate.

How to check whether any case actually exists

Log in only by typing gst.gov.in yourself or using a bookmark you created. Look at the address bar. The official domain is gst.gov.in. Look-alike spellings exist.

Then:

1. Open View Notices and Orders.
2. Open Returns Dashboard and see if returns are actually pending. Path: Services → Returns → Returns Dashboard.
3. Open registration certificate / profile and see if anything was amended without you.
4. Read email on the address registered on the portal. GSTN and tax-office mails still tell you to log in to the portal. They should not ask you to reply with an OTP.

If the portal is empty of notices and a caller is screaming, the caller is the problem, not your GSTIN.

If the portal does have a notice, do not ignore it because the WhatsApp call felt fake. Fake calls and real notices can exist in the same week. Handle the real notice on gst.gov.in. Block the fake number.

What to tell staff so this does not happen on a busy evening

Write one line near the billing counter: “GST OTP is never given on phone.” New helpers answer unknown calls. Scammers wait until the owner is at a wedding.

The authorised signatory’s mobile should not sit on a public table. If the OTP SMS lands on a number the whole staff can read, change the mobile on the portal through the proper amendment path, with documents. Do not paste OTP in a staff WhatsApp group “for the CA”. Send the CA a portal role if you want them to file — that is what authorised signatory and GST practitioner mapping are for. You still should not forward OTPs casually.

If you use a GST practitioner, confirm their GSTP ID on the portal. A stranger saying “I am your new practitioner, share OTP to map me” is another theft script.

After a scare, file the return anyway if it is due

Scammers love due dates. They call when GSTR-3B is near, because you are already nervous. Do not freeze. Log in yourself. File from:

gst.gov.in → Services → Returns → Returns Dashboard

Pay through the official challan on the same portal. Do not pay a personal account dictated on a call, even if they say it is “GST settlement”. Government GST is paid into the electronic cash ledger via the portal challan, then offset in the return. A personal wallet is not a GST challan.

If you paid a fraudster, that payment does not count as GST. You still owe the tax on gst.gov.in. Report the fraud through the police and the channels listed on official sites. GST Atka cannot recover the money.

FAQ

A WhatsApp caller wants the GST portal OTP. Should I share it to “close the case”?

No. Never share the OTP. Real notices are on gst.gov.in under Services → User Services → View Notices and Orders. Hang up. Log in yourself.

The caller sent a PDF summons with a case number. Is that enough?

No. Open the same case on the portal. If it is not there, treat the PDF as fake until the portal shows it. Do not pay any personal account mentioned in the PDF.

How do I know the website is real?

Type https://www.gst.gov.in yourself. The official domain is gst.gov.in. Do not use a link from a chat. Check the address bar before you enter the username.

I already gave the OTP. What now?

Change the password on the portal at once. Check bank, email, mobile, and authorised signatory. If anything changed, get local help the same night. Watch notices on the portal. File due returns yourself. Do not send a second OTP to the same caller “to undo”.

GST Atka is not a GSTN office. File on gst.gov.in. Rules change. Do not evade tax. Personal case: get local help.