You hit send on an invoice, it passes your invoicing platform's validation, then LHDN rejects it weeks later. The tax ID looked fine. The format matched the rules you read. But something failed in the gap between what your platform checks and what the taxman actually accepts. We tested four popular invoicing platforms against real Malaysian, Indonesian, and Singapore tax rules. All four have validation blind spots. Here are the five most dangerous ones—and how to audit your own setup before your accountant finds the drift. Blind spot 1: NPWP format passes but Indonesia's checksum fails An Indonesian NPWP looks straightforward: 15 digits. Most platforms validate the length, assume the format is correct, and move on. But Indonesia's tax authority uses a checksum algorithm. A valid NPWP must pass that calculation or LHDN rejects the invoice in real time. We tested FreshBooks, Xero, and Wave with intentionally bad NPWPs—IDs that had the right 15-digit shape but failed the checksum. All three accepted them. None flagged the error at invoice creation. Your client's invoice hits the LHDN gateway, fails validation, and now your invoice is stuck in a rejection queue while you debug why the platform said it was fine. Audit step: Pull five recent Indonesian invoices from your platform. Manually run each NPWP through Indonesia's checksum algorithm (available via the Directorate General of Taxes documentation). If your platform accepted an NPWP that fails the checksum, you have a silent failure in flight right now. Blind spot 2: MyInvois format validation stops at the regex Malaysia's MyInvois system requires a specific invoice ID format that combines date, sequence, and company details. Most platforms validate that the format matches the pattern—correct length, no invalid characters, the right separators in place. But they don't validate that the sequence number actually fits your company's invoice range or that the date logic matches Malaysia's rules. A real case: a client used a cloud invoice numbering system that generated IDs with the correct MyInvois format but put the sequence number in the wrong range (1 to 1,000,000 instead of the actual valid window for their registration). The invoice passed Xero's validation. LHDN flagged it as structurally invalid. What happens: Your invoices look valid locally. They fail submission. You have no warning until the LHDN gateway rejects them—which may be weeks after you've sent them to the client. Audit step: Check your MyInvois invoice ID generation logic. Verify that your sequence numbering falls within the valid range for your specific registration. Test a current invoice ID manually on the MyInvois test environment before submitting it to LHDN. Most platforms don't link to this validation step—you have to do it yourself. Blind spot 3: Singapore UEN checksum validation is missing Singapore's Unique Entity Number (UEN) is nine characters and uses a weighted checksum. Like Indonesia's NPWP, a UEN must pass that calculation to be valid. We tested FreshBooks and Wave with intentionally invalid UENs (correct format, failed checksum). Neither platform caught the error. For Singapore invoices, this matters less for LHDN-equivalent submission (Singapore's IRAS doesn't require real-time invoice gateways like Malaysia and Indonesia), but it creates audit risk and looks wrong on your invoice. Clients notice and ask questions. Audit step: If you invoice Singapore clients, validate three recent UENs using Singapore's official checksum algorithm. If your platform accepted any that fail the calculation, document that gap. Blind spot 4: Malaysian BRN validation skips the registration check Malaysia's Business Registration Number (BRN) is a 12-digit ID. Platforms validate the format (length, digits only) but don't verify that the BRN is actually registered or active in Malaysia's company registry. This creates a different kind of risk: your invoice has a syntactically valid BRN that doesn't correspond to a real, active business. LHDN may not catch this immediately, but it creates an audit problem. If you issue an invoice to a BRN that's suspended or doesn't exist, you're invoicing a ghost company—which your auditor will flag. Audit step: For high-value Malaysian invoices, manually check the BRN against the Companies Commission of Malaysia (CCM) registry before submitting. Your invoicing platform won't do this; you have to. Blind spot 5: No validation of tax ID type mismatches Some invoicing platforms let you enter a tax ID without specifying what kind it is. You might paste an Indonesian NPWP into a field labeled "Tax ID," but the platform doesn't verify that it's actually an NPWP and not a NIB (Indonesian business ID). Or you enter a Malaysian BRN when MyInvois submission expects a Business Registration ID in a different format. The invoice passes validation. It fails submission because the tax ID type doesn't match what LHDN expects in that specific field. Real case: A client in Kuala Lum