SAN BERNARDINO, Calif. (Aug. 12, 2025) — A cardboard box landing on a doorstep without a return address can feel like a harmless mystery. CSUSB police say it may be something else entirely: the first move in a nationwide scam that relies on curiosity and a quick scan of a QR code.
The California State University, San Bernardino Police Department is warning students, employees and neighbors to be on guard after reports of unsolicited packages arriving with glossy inserts or stickers that feature prominent QR codes. Scanning those codes can redirect recipients to look-alike websites that request personal or banking information, or trigger a download that installs malware on a phone.
“These packages often lack sender information, which may tempt recipients to scan the QR code out of curiosity,” Chief of Police John Guttierrez said. “We urge everyone to exercise extreme caution with unexpected deliveries.”
QR codes—those square, pixelated barcodes—are widely used by restaurants, retailers and campus departments to link to menus, forms and event pages. Police say scammers are exploiting that familiarity. In recent cases, the code led to pages that mimicked shipping updates, survey rewards or refund portals and then asked for passwords, card numbers or multifactor authentication codes. Some prompts pushed users to grant device permissions or install an app, a step that can open the door to data theft.
CSUSB police recommend treating any surprise package or unsolicited message as suspect, particularly when it comes without a sender name or pushes for immediate action. Do not scan a QR code you did not expect to receive, officers said. If you already scanned one and something seemed off—an app asked for unusual access, a site requested sensitive information or your device behaved oddly—log out, change your passwords and keep an eye on your financial accounts. Requesting a free credit report can help spot fraudulent activity early.
Community members who think they were targeted or defrauded are asked to report it. On campus, contact the CSUSB Police Department at (909) 537-5165 or email police@csusb.edu. Cases can also be filed with the FBI’s Internet Crime Complaint Center at ic3.gov, which aggregates reports to identify larger patterns. When submitting a report, include as much detail as possible: any sender or company name listed on the package, links or websites the code led to, email addresses or phone numbers used in follow-up messages, and whether any apps were downloaded.
“Staying informed and vigilant is the best defense against these scams,” Guttierrez said. “If something seems suspicious, trust your instincts and report it.”
Additional campus safety information is available at csusb.edu/police.