Stay Secure Against MyChart Phishing Scams: Essential Tips

If you’ve ever accessed lab results or sent messages to your doctor online, you’re possibly familiar with MyChart. This popular patient portal from Epic provides access to health information and care teams, increasing the reliance on digital communication.

Mary M. expressed concerns about the shift towards online patient communications after receiving updates from her primary care doctor and specialists. Many patients share these concerns due to scams targeting MyChart users.

Criminals impersonate MyChart through phishing schemes, not by breaching the platform itself.

Epic documented scams imitating MyChart to steal login details, with one version installing malware on Windows computers. Understanding how these scams work can protect you before a fake alert catches you off guard.

Why MyChart Phishing Scams Demand Attention

Several credible sources, including Penn Medicine and Pennsylvania’s Attorney General, have reported scams involving emails and texts mimicking MyChart. Epic’s security team investigated two phishing campaigns, underscoring the need for caution.

The familiarity of getting legitimate emails about appointments or test results makes fake MyChart alerts particularly convincing. They blend in, hoping you’ll react hastily.

Scam Tactics

One campaign starts with a routine-looking email. Epic says it carries MyChart branding and prompts, “Your recent results are ready.” Clicking the button directs you to a fake sign-in page, crafted to look authentic by copying code from the real site.

After entering login information, scammers capture those details, proceeding with more aggressive tactics. Fake medical records, claiming “AI-powered reviews” detected critical issues, pressure victims emotionally.

Real critical results are communicated by your care team, not through website pop-ups. A site requesting human verification steps to see more information means danger, especially if it installs malware.

Fake alerts may instruct Windows users to execute commands that install malware. August saw an instance with a button labeled “Unlock Full Report & See Diagnosis,” downloading malware while bypassing security warnings. Trustworthy patient portals never require Windows program downloads for diagnoses.

Medicare Health Kit Scam

Another phishing scheme offers a “2026 Medicare Health Kit,” pushed by fake MyChart emails. Patients are lured through fake surveys, eventually asking for credit card details for a “free” kit.

Staying Safe from Fake MyChart Messages

• Open MyChart directly via the official app or your healthcare provider’s website.
• Pay attention to full sender addresses and verify with previous legitimate emails.
• Avoid running commands for patient portal verification. Legitimate sites won’t use this tactic.
• Implement two-step verification for added account security.
• Maintain unique passwords for MyChart that haven’t been reused elsewhere.
• Ensure security software is running to detect malicious sites and files.
• Verify urgent medical claims independently through the app or contacting your provider.
• Use data removal services to minimize personal details available to scammers online.
• Treat MyChart giveaways as suspicious; Epic confirms no such promotions exist.

Reacting to a Scam if You’ve Interacted

Your response to interaction depends on specifics:

• If you clicked without entering information, close the site and mark the email as phishing.
• If credentials were entered, change your MyChart password via the official site immediately.
• Entered credit card information demands contacting your bank to replace the card.
• For executed commands or downloads, disconnect from the internet and seek professional tech support to secure your system. Run an antivirus scan, and change relevant passwords on a trusted device.
• Contact your healthcare provider if medical information appears incorrect.

Key Takeaways

Using portals like MyChart enhances accessibility to care, yet scammers exploit their popularity. Change your response to urgent emails, focusing on using the app directly over linked messages. Particularly watch out for malware tactics asking to bypass security protocols.

The emotional urgency in messages about abnormal medical results requires pausing and independently verifying details. This safeguards your patient account and computer from harm.