Anti-quishing for printed QR codes
Sign the QR codes people pay through
QRalo signs each code with your organization's key. Scanning it opens qralo.com, which shows your verified name, the full payment address and whether the code is still valid. A sticker on top can't show your name.
3 signed codes free. No card.
METER 0423
Signature valid
ActiveSigned by
QRalo Demo
Domain verified: demo.qralo.com
Goes to
demo.qralo.com
https://demo.qralo.com/pay/meter-0423
Printed for
Opening demo.qralo.com in 5 s
Scanning opens qralo.com first. It shows the verified name and the payment address before the payment page.
Demo label · fictional organization "QRalo Demo"
- Signature
- Ed25519, one key per organization
- Scan opens
- qralo.com/verify
- Revoke
- Any code, from your dashboard
- Free plan
- 3 signed codes, 100 scans each
01The problem
One sticker sends the payment somewhere else
Scammers print a look-alike code and stick it over yours. Drivers pay them in your name. On a meter, the two codes look the same.
Public service announcement ·
FBI Internet Crime Complaint Center
Criminals tamper with physical QR codes, for example by sticking a fake over the real one, to collect payment details.
Read the FBI notice(opens in a new tab)Consumer alert ·
U.S. Federal Trade Commission
Scammers covered the QR codes on parking meters with their own.
Read the FTC alert(opens in a new tab)
Taking the codes down also takes away the easiest way to pay.
How fake QR stickers work02How it works
From dashboard to meter in three steps
- Label · Meter 0423
Step 1: Create and sign
Enter the payment address, pick a purpose and add a label like “Meter 0423”. QRalo signs them with your organization’s key.
- Download PNG
Step 2: Print with the label
Download the PNG and print it next to the same label, so people can match the code to the meter or table.
- qralo.com/verify
Step 3: Scan and check
Any phone camera opens qralo.com/verify. The page checks the signature and the link, then shows who signed and where it goes.
Revoke a code and the next scan shows it as withdrawn.
03What people see
What the driver sees before paying
The check opens on qralo.com. The payment page opens after it.
- Signed by
Who signed it
The account name, and whether it proved its domain with a DNS record. Names without a verified domain are marked unverified.
- Goes to
Where it goes
The full address, before anything opens.
- Status
Whether it’s still valid
Active, expired or withdrawn. Checked on every scan.
- Details
The details
Signature status, issue date and code ID, one tap away.
Signature valid
ActiveSigned by
QRalo Demo
Domain verified: demo.qralo.com
Goes to
demo.qralo.com
https://demo.qralo.com/pay/meter-0423
Printed for
Check it matches the label on the meter.
Opening demo.qralo.com in 5 s
A regular QR code next to a signed one
- Shows who issued it and whether their domain is verified
- RegularNoQRaloYes
- Shows the full address before opening
- RegularDepends on the camera appQRaloAlways
- Can be switched off after printing
- RegularOnly dynamic (redirect) codesQRaloYes, from your dashboard
- Expires on a date you pick
- RegularOnly dynamic (redirect) codesQRaloYes, if you set one
- Stops someone sticking a fake on top
- RegularNoQRaloNo. The fake can’t show your verified name on qralo.com.
04Use cases
Wherever someone pays by scanning
- Meter 0423Parking & payment metersOne signed code per meter, labelled with its ID. If a post is tampered with, revoke that one code.For parking operators
- LYO-012 · 2EV chargingDrivers check the operator and the charger reference before they type a card number.For charging networks
- Table 5Restaurants & hospitalityTable codes for menus and pay-at-table. Guests check them in one tap.For restaurants
- InvoiceInvoices, letters & donationsShow that the payment code on your document came from you.Start free
05Your dashboard
Every code you’ve printed, in one list
- Revoke any code whenever you want. Or set an expiry date when you create it.
- See scans by day, device and city.Business
- Put your logo in the middle of the code.Business
- Verify your domain with a DNS TXT record. One click with supported DNS providers.
- Export codes and scan data to CSV or JSON.Business
Signed codes
QRalo Demo · 5 codes
| Label | Destination | Status | Expiry | Actions |
|---|---|---|---|---|
| METER 0423 | demo.qralo.com/pay/meter-0423 | Active | None | |
| METER 0424 | demo.qralo.com/pay/meter-0424 | Active | None | |
| METER 0417 | demo.qralo.com/pay/meter-0417 | Revoked | None | |
| TABLE 5 | demo.qralo.com/menu | Active | 31 Dec 2026 | |
| COUNTER | demo.qralo.com/pay/counter | Expired | 1 Oct 2026 |
06Before you print
What a valid signature tells the person scanning
It shows
- The code was signed by the QRalo account on screen, and whether that account verified its domain.
- Nobody has changed the code since it was signed.
- Whether the code is active, expired or withdrawn right now.
It can't show
- Whether a fake was stuck over your code. A fake never opens qralo.com, so put “Scanning opens qralo.com first” on your signs.
- Whether a website is harmless. Our link checks flag common phishing patterns and can still miss one.
- Who runs an account with no verified domain. Until the domain is verified, the name is whatever the account typed.
07Pricing
Free for 3 codes. €9.99 a month for unlimited
Free
For trying it on a few signs.
€0/ month
No card required.
- 3 active signed codes
- 100 scans per code
- Public verification page
- Revocation and expiry dates
- Basic scan stats
- Domain verification by DNS
Business
For codes that are out on the street every day.
€9.99/ month
Billed monthly. Cancel from your billing portal.
- Unlimited signed codes
- Unlimited scans
- Your logo in the code
- Advanced analytics and scan map
- CSV and JSON export
Fair use: up to 20 new codes every 15 minutes.
Operators & public sector
For parking, charging and city networks.
Customon quote
Scope and price agreed with you.
- A guided 90-day pilot on your own sites
- Account setup and domain verification
- One signed code per meter or charger, with its label
- Help with signage wording
- An inspection round with the QRalo scanner
- A written report at the end
Not available yet: bulk generation, API access and scan alerts. We’re building them with pilot customers.
Prices in euros, taxes included. Free codes past 100 scans show as paused until you upgrade. Subscribed in the iOS app? Manage it in the App Store.
Compare plans08FAQ
Questions
Something else? contact@qralo.com
Do my customers need an app?
What if someone sticks a fake code over mine?
Can I change the destination after printing?
Does QRalo check links for phishing?
What does “signed with Ed25519” mean?
What data do you collect when someone scans?
What happens if I cancel Business?
Is QRalo right for a city or a parking operator?
Sign one code and scan it yourself
It takes a few minutes. You’ll see exactly what your customers will see.
3 signed codes free. No card.