Written for Mexico. This analysis applies to Mexican federal tax law — ISR (income tax), IVA (VAT) and SAT rules — and cites Mexican statutes. Amounts are in Mexican pesos (MXN).
A PDF with a logo and stamps is not an invoice: it is a drawing of an invoice. The real invoice is the stamped XML that exists in the SAT's systems — and anyone can verify it, with no password or e.firma (the SAT's digital signature), in the public verifier (link in our Resource Center). Whoever deducts, credits VAT or pays against receipts without this one-minute verification is building their accounting on the issuer's word.
How to verify it
You need four pieces of data that are on the receipt itself: the fiscal folio (UUID) — the long string at the bottom of the PDF — the issuer RFC (federal taxpayer ID), the recipient RFC and the exact total down to the cent. The verifier responds instantly with the status: valid (it exists and has not been cancelled), cancelled, or not found. Operating nuance: a freshly stamped CFDI can take hours to appear — before concluding it is fake, give it a couple of days if it was issued today.
The three ills it detects
The counterfeit PDF: a "designed" invoice that was never stamped — the classic fraud against the accounts-payable department, and the reason no payment should be released against a PDF without verifying (ideally against the validated XML, which is the real tax document). The silent cancellation: the supplier who invoices you, collects, and afterward cancels the CFDI — your deduction disappears without your knowing. From your SAT portal you can see the cancellation requests that require your acceptance and object to them; and the periodic sweep of your XMLs against the verifier catches the cancelled ones that did not require your permission. The toxic issuer: the invoice can be valid and still be poison — if the issuer is on the SAT blacklists, the validity of the receipt does not save the transaction. Verifying the CFDI and verifying the issuer are two steps of the same protocol.
Does your payment cycle verify — or trust?
The protocol we implement: the XML (not the PDF) as the input document, automatic verification of validity and of the issuer's status before every payment, and a monthly sweep of cancellations over what has already been deducted. These are controls that take hours to implement and close the door on the three most common frauds against companies — the internal one included.
The accounting corollary
Your deduction lives or dies with the status of the CFDI at the time of the audit, not at the time of payment. The serious company reconciles: every outflow with its valid XML, its CEP for the payment (the evidentiary trio) and its proof of substance (materiality). When the electronic audit arrives — and it arrives for everyone — that reconciliation is the difference between answering in three days or in three months.
Frequently asked questions
I verified and it says 'cancelled' but I never accepted the cancellation — what do I do?
Check in your portal whether there was a request pending your acceptance (there is a window to object) and demand immediate re-invoicing from the issuer. Document everything: if the cancellation was improper and the issuer does not correct it, the transaction is defended with the rest of the file, but it is an avoidable fight — hence the periodic sweep.
Does the verifier tell me whether the invoice is deductible?
No — only the status of the receipt. Deductibility also demands substantive requirements: strict indispensability, correct means of payment, substance (materiality), a clean issuer. The verifier is the first filter, not the verdict.
Can I verify invoices in bulk?
The public service is one at a time, but the SAT offers query services for batch validation and practically every serious accounting system integrates automatic verification. For company volumes, validation on receiving the XML should be automatic, not a manual chore.
Let's talk about your case
The first step is always the same: an honest diagnostic of where you stand. Write to us on WhatsApp or call — a reply the same business day.