Fraudulent emails claim that new or potentially serious medical test results are waiting in MyChart.
A convincing imitation portal may instruct users to run a “human verification” command that secretly installs malware.
Patients should access MyChart through their healthcare provider’s official website or mobile app — not a link in an unexpected message.
Here’s a new one: Scammers are impersonating MyChart, the widely used online patient portal, in a sophisticated campaign designed to exploit one of consumers’ biggest concerns: their health.
The phishing messages may tell recipients that recent test results are available and provide a button to sign in. Clicking it takes the user to a fraudulent website that closely resembles a legitimate MyChart login page, according to a warning from MyChart.
The fake site may capture the victim’s email address and password. But in one version of the scam, stealing login credentials is only the beginning.
After a user signs in, the imitation portal displays a fabricated medical record and claims an “AI-powered review” has detected critical patterns in the person’s blood work. The alarming message is meant to create a sense of urgency and persuade the victim to follow additional instructions.
The site then asks users to prove they are human by pressing the Windows key and “R,” pasting a command and pressing Enter. Those actions can run a command secretly copied to the computer’s clipboard and install malware.
No legitimate website should require someone to run a Windows command to verify that they are human.
Another version displays frightening laboratory values and offers an “Unlock Full Report & See Diagnosis” button. Clicking it downloads an executable file with a name such as “Full_Analysis_Report.exe.” The site may even instruct users to bypass a Windows security warning and run the program anyway.
MyChart says legitimate laboratory reports are viewed directly in the portal and do not require patients to download a separate program.
A second scam promises a free Medicare kit
Scammers are also using the MyChart name in messages claiming recipients have been selected to receive a free “2026 Medicare Health Kit.”
The link leads to a survey featuring the MyChart logo, a countdown clock, and claims that only a few kits remain. After completing the survey, the victim is told the kit is free but must pay a small shipping charge.
The checkout form collects the victim’s name, address, phone number, email address, and credit card information. According to MyChart, no kit is delivered, and the small initial charge may be followed by additional unauthorized charges.
MyChart does not conduct giveaways or distribute free Medicare products. The portal is a service used by healthcare organizations to give patients access to records, appointments, messages, and billing information.
How patients can protect themselves
An unexpected MyChart message is not necessarily fraudulent. Hospitals and medical practices routinely send notifications when test results, appointment updates, or messages are available. The safest response, however, is to avoid using the link in the message.
Instead, patients should open the MyChart mobile app or enter the known web address for their healthcare provider. Official provider portals can also be located through MyChart.org.
Consumers should also remember:
Epic and health care organizations will not request a MyChart password or verification code by phone, email, or text.
Critical medical findings should be discussed with a care provider, not presented only through a pop-up demanding immediate computer action.
MyChart will never instruct patients to run computer commands, install software, or bypass a security warning.
A countdown clock, free gift, or request for a shipping payment is a strong warning sign.
The presence of a logo, padlock symbol, or encryption claim does not prove a website is legitimate.
People who entered their password on a suspicious site should immediately change it through the real MyChart portal and contact their healthcare organization’s help desk. They should also review the email address and phone number connected to the account.
Anyone who downloaded or ran a suspicious file should disconnect the affected computer from the internet and have it checked for malware. If credit card information was provided, the card issuer should be contacted immediately to report fraud and replace the card.
Victims who disclosed personal information can obtain a recovery plan through the FTC’sIdentityTheft.gov and report the scheme atReportFraud.ftc.gov.
The scam does not necessarily mean the recipient’s health care provider or MyChart account has been breached. In many cases, criminals send large numbers of messages and rely on the platform’s widespread use to find recipients who happen to have an account.