MyChart Phishing Scam: How to Spot It and Protect Your Information

Epic says MyChart itself was not breached. What is circulating is a copy — imitation login pages and a fake "Medicare Health Kit" offer, built to collect passwords and card numbers.

An older adult and her daughter reviewing a suspicious healthcare message on a phone.

MyChart is used by more than 190 million patients to view test results, manage medications and bills, and contact healthcare providers 2.

Scammers are exploiting that trust.

Fake emails, texts, and websites now copy MyChart's name and appearance. Some claim alarming medical results are waiting. Others offer a free "Medicare Health Kit." The goal is to steal passwords, personal information, card details, or access to a computer.

Epic, the company behind MyChart, says these attacks misuse the brand rather than exploit a security weakness in the platform. Patients can continue using MyChart normally—but should enter through the official app or their healthcare provider's known website 1.

How the MyChart Scams Work

MyChart documented two phishing campaigns identified during summer 2026 1.

Fake Test Results

A message says new medical results are available and links to a copied MyChart login page. After capturing the victim's credentials, the fake site may display invented, frightening lab results.

The page then asks the user to press Windows+R, paste a command, or download a program to unlock the report. These actions can install malware.

Real MyChart results do not require keyboard commands, executable files, or bypassing a Windows security warning.

The Free "Medicare Health Kit"

Another version claims the recipient was selected for a free health kit. A survey, countdown clock, limited-stock notice, and small shipping charge create urgency.

The forms collect the victim's name, address, phone number, email address, and payment-card information. MyChart states that it does not run giveaways. No legitimate kit is being offered 1.

Diagram showing the two documented MyChart impersonation scam paths.

Both versions follow the same pattern:

1. Borrow a trusted name.
2. Create fear or excitement.
3. Move the victim away from the real MyChart system.
4. Request information, payment, or computer access.

Seven Warning Signs

Seven signs that a MyChart message may be fake.

Stop if a message includes any of these signs:

1. An unfamiliar sender address. Logos and display names can be copied.
2. A strange or misspelled link. Check the complete website address.
3. A free kit, prize, or giveaway. MyChart does not offer them.
4. A countdown or urgent warning. Pressure is designed to prevent careful thought.
5. A request for passwords, verification codes, or card information. Enter these only through the official app or portal.
6. Instructions to run commands or install software. Never press Windows+R to verify a website.
7. A request to change contact information. Keep control of the email address and phone number connected to your account.

Do not use an unexpected message as the doorway to your medical account. Open the MyChart app yourself or use your healthcare organization's saved website. If the alert is real, it should also appear there.

When uncertain, call the provider using a number from its official website, a recent statement, or your insurance card. Never use the number inside the suspicious message.

What to Do If You Clicked

Your response depends on what happened.

Three response paths after interacting with a fake MyChart message.

If You Clicked but Entered Nothing

Close the page. MyChart says you are most likely fine. Do not reply or click "unsubscribe." Report the message as phishing, then check your real account through the app or official website.

If You Entered a Password

Reset your MyChart password through the official app or provider website. Change it anywhere else you reused it. Review the email address and phone number stored in MyChart, then notify your provider's help desk.

If You Entered Card Information

Call the bank using the number printed on the card or shown in its official app. Report the card as compromised and ask for a replacement. Do not only dispute the first charge.

Watch for small test charges, new subscriptions, unfamiliar transfers, and changes to account contact information.

If You Ran a Command or Program

Disconnect the computer from the internet and stop using it for email, banking, healthcare, or work. Use a separate trusted device to change important passwords. Have the affected computer examined by a qualified security professional.

If it belongs to an employer, contact the organization's IT or security team immediately.

Report the Incident

• Report cyber-enabled fraud to the FBI Internet Crime Complaint Center.
• Report consumer fraud at ReportFraud.ftc.gov.
• Create an identity-theft recovery plan at IdentityTheft.gov.
• Adults 60 and older can request filing assistance through the National Elder Fraud Hotline at 833-372-8311 4.

Helping an Older Parent Stay Safe

Discuss the scam before a suspicious message arrives. Agree on one rule: unexpected health messages must be checked through the official app or a verified phone number before any link is opened.

Then make safe verification easy:

• Save the provider and bank's verified numbers in the phone.
• Bookmark the correct MyChart website.
• Use unique passwords and multifactor authentication.
• Keep phones and computers updated.
• Review urgency tactics such as alarming results, expiring benefits, free medical products, and small shipping charges.
• Ask the healthcare provider whether authorized proxy access is available for a trusted family member.

Keep the conversation calm. Shame can delay reporting and give criminals more time. The goal is fast disclosure: "If anything feels wrong—even if you already clicked—tell me immediately."

Financial accounts should also be reviewed for unfamiliar charges, new payees, duplicate withdrawals, or unexpected transfers. A stolen email address or card number may be used again in a more convincing follow-up scam.

How Granitefield Financial Can Help

Healthcare phishing can quickly become financial fraud. A stolen card may show a small unfamiliar charge. Personal details may support a later bank-impersonation call. A compromised email account may be used to redirect bills or create a stronger follow-up message.

Granitefield Financial provides non-advisory daily money management and administrative financial oversight. Depending on the service, this may include account reconciliation, bill-management oversight, fraud monitoring, document organization, payee coordination, and reporting for the client or an authorized family member.

This does not replace a bank's fraud department, law enforcement, a healthcare security team, or a cybersecurity professional. It adds a consistent review layer that may help families notice unusual financial activity sooner.

If an unauthorized transaction is happening now, contact the bank first. For ongoing oversight, contact Granitefield Financial or call 803-500-4638 to discuss whether daily money management or fraud-monitoring support fits your situation.

Related Reading

Explore related resources from Granitefield Financial, including safeguarding senior bank accounts from modern fraud and senior financial monitoring services.

Frequently Asked Questions

Was MyChart hacked?

Epic says the 2026 scams exploited trust in MyChart's name rather than a security problem in the platform 1. However, credentials entered on a copied page may still be used against the victim's real account. Reset the password and notify the healthcare provider if that happened.

Does MyChart offer free Medicare kits?

No. MyChart states that it does not run giveaways 1. A MyChart-branded message offering a Medicare kit, first-aid kit, prize, or survey reward should be treated as fraudulent.

Should I click "unsubscribe" on a suspicious MyChart email?

No. In a suspicious message, an unsubscribe link may confirm that your address is active or lead to another unsafe page. Use your email service's Report phishing or Report junk control instead.

How do I check whether a MyChart alert is real?

Do not use the link in the message. Open the MyChart app yourself, or type your healthcare organization's known web address. A genuine notification will also be visible inside your real account.

Who should an older adult call after a healthcare phishing attempt?

Call the healthcare provider using a number from its official website, a recent statement, or an insurance card, and call the bank using the number printed on the card if payment information was entered. Adults 60 and older can also reach the National Elder Fraud Hotline at 833-372-8311 4.

References

• MyChart — Staying Safe from Scams and Fraud
• MyChart — Official Website
• FBI — 2025 IC3 Annual Report
• FBI — Elder Fraud