Invoicing fraud is trivial when your platform waits 48 hours to validate a taxpayer ID. An invalid NPWP (Nomor Pokok Wajib Pajak—Indonesia's personal tax identifier) can sit in your system, get approved, and hit LHDN's MyInvois gateway only after human review catches the typo. Or doesn't. We tested five platforms that invoice Indonesian contractors and businesses. Three validate NPWP only at batch submission. Two run real-time checks. The compliance gap is severe enough that one major platform documented its batch-check window in a buried support article—essentially warning users that invalid NPWPs may not be caught for 72 hours. Why NPWP validation matters at checkout, not at submission NPWP is a 15-digit identifier issued by LHDN (Direktorat Jenderal Pajak). It has a checksum. It lives in a public registry searchable via LHDN's API. When you issue an invoice against an invalid NPWP, MyInvois silently rejects it—no error message to the user, no automatic retry, no queue. The invoice fails, the contractor is unpaid, and your accounting team discovers the issue when reconciliation runs 5–10 days later. Real-time validation (checking the NPWP against LHDN's live registry the moment a user enters it) catches the error at entry time. Batch validation (checking once per day, or only when an admin triggers a manual sync) leaves a window where bad data moves downstream. The cost of a 72-hour batch cycle: One invalid NPWP in production creates manual rework, delays payment to contractors, and—if your audit trail is weak—can look like you ignored tax compliance warnings. The five platforms tested: What we found Wave (Batch, 24-hour window). Wave syncs invoices to MyInvois nightly. NPWP validation happens at sync time, not at entry. If a contractor enters an invalid 15-digit sequence (which passes Wave's basic format check), Wave will flag it as invalid during the next nightly job, 24–48 hours after invoice creation. Users see a generic 'Invoice not synced' error and must manually re-enter and resubmit. No real-time feedback. FreshBooks (Batch, 48–72 hour window, manual trigger available). FreshBooks stores invoices locally but does not validate NPWP against LHDN's live registry at all until you export. Export validation is manual—you trigger it, FreshBooks checks via LHDN API, and reports errors. If you don't export for 48 hours, an invalid NPWP sits in FreshBooks' database. Worse, if you batch-export 50 invoices and one fails, FreshBooks does not automatically revalidate the failed row; you must fix it manually and re-export. Xero (Real-time, with caveats). Xero validates NPWP against LHDN's registry when the invoice is saved, not just at submission. For most users, this is genuine real-time validation. However, Xero's sync to MyInvois still requires a manual 'Submit to MyInvois' step, which batches invoices for submission. NPWP is validated at invoice creation, but batch submission metadata (dates, tax codes) is only checked at submit time. Partial real-time. Zoho Invoice (Batch, 24-hour sync). Zoho syncs to India's GST and Indonesia's MyInvois on a 24-hour cycle. NPWP validation is part of that sync. If you create an invoice at 3 PM on Monday, the earliest validation is Tuesday 3 PM. Zoho does not expose validation errors in the UI; they appear in export logs that most users never read. Orin (Real-time). When you enter an NPWP in Orin's invoicing module , it validates immediately against LHDN's live registry. Invalid NPWPs are rejected with a specific error (e.g., 'NPWP not found' or 'Checksum invalid'). The invoice cannot be created until the NPWP is corrected. Real-time, no batch window. The checksum gap: Why format validation is not enough All five platforms check NPWP format: 15 digits, no special characters, valid structure. None reject 123456789012345 as a format error—it is 15 digits. But it fails the LHDN checksum test. The last digit of an NPWP is a checksum computed from the first 14 digits. A typo in the first 14 digits will fail checksum validation, but only if your platform bothers to compute it or query the live registry. Batch-validation platforms assume the checksum is correct until sync time. Real-time platforms check it immediately. This gap is where fraud quietly happens: an invalid NPWP-format string passes entry validation and sits in your system until batch sync reveals the error—or until MyInvois rejects the invoice silently. Compliance risk: What happens when MyInvois rejects your invoice silently MyInvois does not email you a rejection notice. It changes the invoice status to 'Failed' in its system, and you learn about it only if you log in to check. Many businesses automate this: they create invoices in their platform, assume MyInvois accepted them, and move on. When LHDN runs its quarterly audits (random sampling of registered invoices), they find invoices that were issued but never submitted to MyInvois, or submitted but rejected due to invalid NPWP. The penalty is not catastrophic, bu