# Public QR Security Standard (PQSS)

Source: https://pqss.ca/
Last modified: 2026-11-11
Description: PQSS is an open standard for organizations that post QR codes in public places: keep a register, inspect every placement on a schedule, and respond the same way every time a fake code is found.

PQSS sets out what an organization that posts QR codes in public places should do to find, remove and report fake codes stuck over its own. It applies to parking meters, EV chargers, transit stops, utility notices, restaurant tables, posters, kiosks and any other spot the public can reach, whatever tool made the codes.

## Documents

| Date | Document | Type | Format |
| --- | --- | --- | --- |
| 2026-11-11 | [PQSS 1.0, Public QR Security Standard](https://pqss.ca/1.0) | Standard | [HTML](https://pqss.ca/1.0), [PDF](https://pqss.ca/pqss-1.0.pdf), [Markdown](https://pqss.ca/1.0.md) |
| 2026-11-11 | [PQSS 1.0 self-assessment checklist](https://pqss.ca/self-assessment) | Checklist | [HTML](https://pqss.ca/self-assessment) |
| 2026-11-11 | [Placement register template](https://pqss.ca/templates#placement-register) | Template | [CSV](https://pqss.ca/templates/pqss-placement-register.csv) |
| 2026-11-11 | [Inspection log template](https://pqss.ca/templates#inspection-log) | Template | [CSV](https://pqss.ca/templates/pqss-inspection-log.csv) |
| 2026-11-11 | [Incident log template](https://pqss.ca/templates#incident-log) | Template | [CSV](https://pqss.ca/templates/pqss-incident-log.csv) |

## Requirements

Requirements are numbered, and each is broken into clauses (1.1, 1.2 and so on). Citations should name the version and clause, for example [PQSS 1.0, 3.2](https://pqss.ca/1.0#req-3-2).

| No. | Requirement | In short |
| --- | --- | --- |
| 1 | [Keep a placement register](https://pqss.ca/1.0#req-1) | Every code posted in public, where it is, what it should decode to, and its risk tier. |
| 2 | [Assign a risk tier and an inspection schedule](https://pqss.ca/1.0#req-2) | High, Medium or Low, by what the code leads to. The tier sets how often it is inspected. |
| 3 | [Inspect safely](https://pqss.ca/1.0#req-3) | In person, with a reader that shows what a code decodes to without opening it, and a check by eye and by touch. |
| 4 | [Respond to a mismatch](https://pqss.ca/1.0#req-4) | Photograph and remove the fake, sweep the site and similar placements, and report it. |
| 5 | [Make your codes easier to check](https://pqss.ca/1.0#req-5) | Publish your official domains, print a typed address, and use tamper-evident mounting where it counts. |
| 6 | [Keep records](https://pqss.ca/1.0#req-6) | Every inspection and incident, and every missed inspection recorded as missed, kept for 12 months. |
| 7 | [Assign responsibility](https://pqss.ca/1.0#req-7) | A named PQSS lead, briefed inspectors, and a quarterly review. |

## Inspection periods

| Tier | The code leads to | Inspect at least every |
| --- | --- | --- |
| High | Payment, login, account access, or financial or government ID details | 31 days |
| Medium | Other personal information, or ordering | 92 days |
| Low | Information only | 183 days |

A reported concern, or a placement that missed its inspection, is inspected within 2 business days for High placements and 5 for the rest ([Requirement 2](https://pqss.ca/1.0#req-2)).

## Using the standard

PQSS is a detection standard. It makes sure you uncover and resolve quishing (fake codes stuck over real ones) on a known schedule, respond in a known way, and keep a record. It can be met with a spreadsheet, a clipboard and a scanning app that shows codes without opening them.

There is no PQSS certification. Organizations assess themselves with the [ten-question checklist](https://pqss.ca/self-assessment) and, if every answer is yes, may say so in the wording the standard gives.

The text is published under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), so councils, agencies and businesses can copy it into their own procedures with attribution.

---

Site summary for agents: https://pqss.ca/llms.txt - every page in one document: https://pqss.ca/llms-full.txt
Any page is available as Markdown at its own URL with `Accept: text/markdown`, or by appending `.md` to the path.