Public QR Security Standard (PQSS)
PQSS sets out what an organization that posts QR codes in public places should do to find, remove and report fake codes stuck over its own. It applies to parking meters, EV chargers, transit stops, utility notices, restaurant tables, posters, kiosks and any other spot the public can reach, whatever tool made the codes.
Documents
| Date | Document | Type | Format |
|---|---|---|---|
| PQSS 1.0, Public QR Security Standard | Standard | HTML, PDF, Markdown | |
| PQSS 1.0 self-assessment checklist | Checklist | HTML | |
| Placement register template | Template | CSV | |
| Inspection log template | Template | CSV | |
| Incident log template | Template | CSV |
Requirements
Requirements are numbered, and each is broken into clauses (1.1, 1.2 and so on). Citations should name the version and clause, for example PQSS 1.0, 3.2.
| No. | Requirement | In short |
|---|---|---|
| 1 | Keep a placement register | Every code posted in public, where it is, what it should decode to, and its risk tier. |
| 2 | Assign a risk tier and an inspection schedule | High, Medium or Low, by what the code leads to. The tier sets how often it is inspected. |
| 3 | Inspect safely | In person, with a reader that shows what a code decodes to without opening it, and a check by eye and by touch. |
| 4 | Respond to a mismatch | Photograph and remove the fake, sweep the site and similar placements, and report it. |
| 5 | Make your codes easier to check | Publish your official domains, print a typed address, and use tamper-evident mounting where it counts. |
| 6 | Keep records | Every inspection and incident, and every missed inspection recorded as missed, kept for 12 months. |
| 7 | Assign responsibility | A named PQSS lead, briefed inspectors, and a quarterly review. |
Inspection periods
| Tier | The code leads to | Inspect at least every |
|---|---|---|
| High | Payment, login, account access, or financial or government ID details | 31 days |
| Medium | Other personal information, or ordering | 92 days |
| Low | Information only | 183 days |
A reported concern, or a placement that missed its inspection, is inspected within 2 business days for High placements and 5 for the rest (Requirement 2).
Using the standard
PQSS is a detection standard. It makes sure you uncover and resolve quishing (fake codes stuck over real ones) on a known schedule, respond in a known way, and keep a record. It can be met with a spreadsheet, a clipboard and a scanning app that shows codes without opening them.
There is no PQSS certification. Organizations assess themselves with the ten-question checklist and, if every answer is yes, may say so in the wording the standard gives.
The text is published under CC BY 4.0, so councils, agencies and businesses can copy it into their own procedures with attribution.