They sit alone on the street
Street furniture is not supervised continuously. A fake sticker can stay on top of a legitimate code for days without anyone noticing.
🏛️ Public sector guide
Quishing in public space: a guide for local governments
Municipal QR codes (parking meters, café terraces, signage, information points) are a fraud target precisely because they are on the street and invite trust. INCIBE, Spain's National Cybersecurity Institute, has documented the fake-sticker pattern. This guide proposes a realistic response: it does not promise to stop the attack, but to make official codes distinguishable from an imitation.
The risk
Why municipal QR codes are an easy target
They invite payment
Parking, fees, services: many municipal QR codes lead to a payment. That is exactly what fraudsters want, in order to capture card details.
The trust belongs to the council
When a resident falls for it, the reputation that gets burned is the administration's. Media and political pressure falls on the council, not on the attacker.
Source of the vector: INCIBE — fraudulent QR codes (in Spanish) ↗. We deliberately use the institutional source, not vendor figures.
The plan
Five realistic measures, in order
1. Own domain for every QR code
Have all official codes come from a single council domain (for example gov.yourtown.cat). A sticker that leads somewhere else stands out.
2. Signing and verifiability
Sign the codes so anyone can check with a public verifier that they belong to the council. An imitation fails the check.
3. Communicating with residents
Explain simply that official QR codes can be verified, and how. Awareness reduces the success rate of fraud.
4. Street furniture inspections
Regular rounds to spot overlaid stickers, especially on parking meters and payment points. Technology does not replace inspection.
5. Response protocol
A clear procedure for when fraud is detected: removing the sticker, a public notice and, where appropriate, a report to the authorities. Being able to say “this is how our code is verified” speeds up the response.
Realism, not promises
None of these measures stops someone from printing a sticker. Together, what they achieve is that fraud becomes harder, easier to detect and much easier to refute.
Honesty
What we can say and what we cannot
✅ What we offer
Municipal QR codes under the council's own domain, signed and verifiable by anyone with a public web verifier. Codes that never expire and whose destination is always controlled by the council (anti-hostage guarantee).
❌ What we do not promise
We do not “stop quishing”: an attacker can always print their own QR code. We do not provide anti-counterfeiting for the physical object. The signature does not prevent the attack; it prevents the council from being impersonated in front of whoever verifies.
Frequently asked questions
Common questions
Why are municipal QR codes a target for fraud?
Because they sit in public space, without continuous supervision, and often invite people to pay (parking, fees). INCIBE, Spain's National Cybersecurity Institute, has documented that the most common vector in Spain is fake stickers placed over legitimate QR codes on parking meters, café terraces and charging points, impersonating city council websites and payment gateways.
What can a city council do about quishing?
Publish all official QR codes under the council's own domain, sign them so they can be verified, tell residents about it, regularly inspect street furniture, and have a response protocol for when a fake sticker is found.
Does a signed QR code guarantee there will be no fraud?
No. Nobody can stop someone from printing and sticking on a fake sticker. What it adds is that the council's legitimate code can be verified: after an incident, residents, technicians or journalists can check what is official and what is not.
Do residents need to install an app to verify?
No. Verification uses a public web verifier that opens in the browser, with no app to install and no account to create.
Keep reading
QR security cluster
The full context of quishing.
Signed, verifiable municipal codes
We help city councils put all their QR codes under their own domain, signed and checkable by anyone. The honest answer to fake stickers on parking meters.