Picture an invoice with a QR code at the top of its first page. You scan it with your phone, and the tax authority replies: "Factura encontrada", invoice found: it knows this invoice, exactly as it stands. That is the idea behind VeriFactu, the anti-fraud scheme Spain has been preparing since 2021. The customer becomes a small-scale tax inspector. The scheme has also been postponed three times, the last time by a mere announcement.
Where does VeriFactu come from?
From a 2021 anti-fraud law, which imposes integrity and traceability requirements on accounting and business-management software (BOE, Ley 11/2021); the BOE is Spain's official gazette. Then from a royal decree of December 2023 that sets out the rules (BOE, Real Decreto 1007/2023). Invoicing software must guarantee that records, "una vez generados y registrados, no puedan ser alterados sin que el sistema informático lo detecte y avise de ello": once created, they cannot be altered without the system detecting it and flagging it (art. 8). Each record is given a digital fingerprint (a hash) and contains part of the previous record's hash (arts. 10 and 12): the invoices are chained, as in Portugal (see the Portuguese episode).
Two modes exist side by side: the "VERIFACTU" mode, in which the software automatically sends each record to the Spanish tax authority (the AEAT), and a mode without reporting, in which the software keeps the chained, electronically signed records, to be produced in the event of an inspection. In VERIFACTU mode, an electronic signature is not required: the hash is enough (art. 16).
What does the QR code do?
The decree adds to the invoicing regulations a requirement for a "representación gráfica del contenido parcial de la factura mediante un código "QR"", a graphic representation of part of the invoice's content as a QR code, whatever the mode, and, in reporting mode only, the words "VERI*FACTU" or "Factura verificable en la sede electrónica de la AEAT" (invoice verifiable on the AEAT's website). On a structured electronic invoice, the QR code can be replaced by the address it contains.
The QR code must measure between 30 and 40 millimetres square (BOE, Orden HAC/1177/2024, art. 21). According to the AEAT's FAQs, it appears only once, before the content of the invoice, at the top of the first page. The customer scans it with any phone and gets one of three answers (AEAT):
- "Factura encontrada" (invoice found): the AEAT holds an identical invoice;
- "Factura no encontrada" (invoice not found): the AEAT has no invoice matching these details;
- "Factura no verificable" (invoice not verifiable): the invoice comes from software in non-reporting mode; the information may still be used for inspections.
The QR code contains the address of the AEAT's verification service, with four pieces of information: the issuer's tax number (NIF), the invoice series and number, its date and its total amount (BOE, Orden HAC/1177/2024, art. 21).
One practical consequence: a genuine VeriFactu QR code should lead to the Spanish tax authority's website, on the agenciatributaria.gob.es domain. A QR code that leads anywhere else is suspect. This is not official guidance but an inference from the specification; the reflex is the same as for any QR code you receive in a document (see QR code phishing in PDFs).
Who is affected, and what are the penalties?
Any company or self-employed person who invoices using software, with some exceptions: businesses that keep their VAT records through the immediate reporting system (SII), and those that fall under the tax regimes of the Basque Country and Navarre, which have their own rules (AEAT).
Two cases deserve attention:
- handwritten invoices fall outside VeriFactu: the regulations do not apply if every invoice is made by hand, including duplicate invoice books and typewriters; mixing handwritten invoices and software is not, in principle, allowed;
- so do Word and Excel, as long as they are used only to type up and print invoices. If the spreadsheet directly produces the VAT records or the accounts, through a macro for example, it becomes a computerised invoicing system subject to the regulations.
The penalties are heavy: €50,000 per financial year for the user of non-compliant or tampered software, and €150,000 per financial year and per type of software for the developer or seller (AEAT).
When does it apply?
This is the part that keeps moving. Originally planned for July 2025, VeriFactu was first pushed back in 2025 to 2026, then, by a decree-law of December 2025 (Real Decreto-ley 15/2025), to 1 January 2027 for companies subject to corporation tax and 1 July 2027 for other taxpayers (AEAT). On 5 October 2026, the Ministry of Finance (Hacienda) announced a further postponement, to October 2028, so that VeriFactu coincides with mandatory electronic invoicing between businesses with turnover of up to €8 million a year (Hacienda). As of 18 October 2026, this postponement has only been announced: the AEAT's page refers to a "previsión de ampliación del plazo", an expected extension of the deadline, and no text has yet been published in the official gazette (AEAT). Legally, the 2027 dates still apply.
What about e-invoicing between businesses?
That is coming too, by a different route. A royal decree of March 2026 (Real Decreto 238/2026), implementing the 2022 "Crea y Crece" law, requires businesses to exchange electronic invoices with one another, through private platforms or through a free public solution provided by the AEAT; invoices issued outside that public solution must be copied to it, in UBL format, at the moment they are issued (AEAT). An order dated 2 October 2026, published on the 5th and in force from the 6th, governs this public solution, "especialmente pensado para ser utilizado por pequeñas y medianas empresas (pymes) y profesionales", designed above all for small and medium-sized businesses and the self-employed, and starts the clock on the timetable (BOE, Orden HAC/1028/2026).
The official timetable (AEAT):
- 6 October 2027: businesses with turnover above €8 million, for both issuing and receiving;
- 6 October 2028: all other businesses and the self-employed, for both issuing and receiving.
What can an entrepreneur in France take from this?
Two philosophies. France routes invoices through approved private platforms, with no free public solution: the public invoicing portal "ne transmet plus aucune facture", no longer transmits any invoices, as LegalPlace, a French legal-services platform, points out (LegalPlace; see also Your first invoice in France). Spain combines control of the software (VeriFactu), a copy of every invoice sent to the tax authority and a free public solution for small businesses. France has no QR code that the customer can check with the tax authority; that is the genuinely Spanish innovation.
The customer as the last line of defence. The VeriFactu QR code lets you check that an invoice has really been declared. It does not protect against everything: it does not contain the IBAN, and a genuine invoice can be intercepted and resent with fake bank details. Checking any change of bank details remains essential, in Spain as in France (see Fake invoice, fake bank details).
Fake invoices arrive before the real reform. On 11 March 2026 the AEAT flagged a fake email announcing a "notificación de factura electrónica" (electronic invoice notification) that led to a page designed to steal login details, and reminded people that it "ni adjunta anexos con información de facturas u otros tipos de datos": it never attaches files containing invoice information or any other data (AEAT). A suspicious attachment should be inspected before it is opened: Inspect PDF flags, in your browser, the presence of JavaScript, automatic actions, embedded files or links. It does not show where the links point and does not read QR codes: for a QR code, look at the address your phone displays before opening it.
PDFKami does not produce invoices and does not read VeriFactu QR codes; it is for inspecting and preparing PDFs without sending them to a server.
Glossary
VeriFactu: Spanish scheme requiring invoicing software to ensure integrity and chaining of invoices and, optionally, to report them to the tax authority.
AEAT (Agencia Estatal de Administración Tributaria): the Spanish tax authority.
SII (Suministro Inmediato de Información): Spanish system for near-immediate reporting of invoices, mandatory for large businesses.
Digital fingerprint (hash): a string of characters calculated from a file or a record; the slightest change alters it.
UBL: a structured electronic invoice format, one of the formats compatible with the European standard EN 16931.
Inspect an invoice you've received without sending it to a server: PDFKami, in your browser.