PQSS templates
PQSS can be met with a spreadsheet, a clipboard and a scanning app that shows codes without opening them. These three CSV files cover its record-keeping. Open them in Excel, Google Sheets or Numbers; each has example rows to delete.
Keep inspection and incident records for at least 12 months (6.4), and have the PQSS lead review them every quarter (7.3).
Placement register
One row per placement: every spot where a code is posted. One code printed in 300 places is 300 rows. Required by clause 1.1.
Download: pqss-placement-register.csv (CSV)
| Column | What goes in it | Req. |
|---|---|---|
placement_id | A unique ID. | 1.1 |
location | A description a stranger could follow. | 1.1 |
latitude, longitude | Map coordinates, where practical. | 1.4 |
expected_content | The exact data the code should decode to, including the domain. | 1.1 |
leads_to | What the code leads to: payment, login, form, menu, information. | 2.1 |
tier | High, Medium or Low. If unsure, choose the higher tier. | 2.2 |
posted_on | Added before or on the day it is posted. | 1.2 |
removed_on | Marked within 30 days of being taken down. | 1.2 |
Inspection log
One row per inspection, and one row per placement that was not inspected in its period. Required by clause 6.1.
Download: pqss-inspection-log.csv (CSV)
| Column | What goes in it | Req. |
|---|---|---|
placement_id | Which placement. | 6.1 |
inspected_at | Date and time. | 6.1 |
inspector | Who inspected it. | 6.1 |
result | genuine, mismatch, altered, unreadable, gone (confirmed not there), or missed (not inspected, or the spot couldn’t be found). | 6.2 |
decoded_content | What the inspection reader showed, without opening it. | 3.2 |
physical_check | Overlay, lifting edges, misalignment, a second code nearby, damage. | 3.3 |
on_site_evidence | Location or other evidence the check happened on site. | 3.6 |
action_taken | Anything done about it. | 6.1 |
Incident log
One row per mismatch. Never open the fake content to fill this in: record what the reader showed. Required by clause 6.3.
Download: pqss-incident-log.csv (CSV)
| Column | What goes in it | Req. |
|---|---|---|
photo_ref | The photo taken before removal. | 4.1 |
removed_at | When the fake was removed or covered. | 4.1 |
same_site_sweep_on | Every other placement at the site, the same day. | 4.2 |
same_kind_high_sweep_on | Every High placement of the same kind, within 2 business days. | 4.2 |
cafc_report_ref, police_report_ref, cccs_report_ref | Reports to the Canadian Anti-Fraud Centre, police and the Cyber Centre. | 4.3 |
public_warning | Where the public was warned, if they may have entered details. | 4.4 |
browser_phishing_report | Reported to browser makers’ phishing services. | 4.5 |
genuine_restored_on | When a genuine code went back up. | 6.3 |
Running a round
- Filter the register to placements due this period and sort by route.
- At each placement, look and feel for overlays, then read the code with an inspection reader.
- Genuine: log it and move on. Mismatch: without opening it, photograph it, remove it and log it, then start an incident.
- At the end of the period, log every uninspected placement as
missedand inspect it within 2 business days (High) or 5 (Medium, Low).