A nationwide phishing campaign is impersonating MyChart and promising consumers a free “Medicare Kit” or “Senior Health Package.”
The promised kit doesn’t exist; scammers may use the offer to collect MyChart credentials, personal information and credit card numbers.
Consumers should avoid links in unexpected MyChart messages and instead access their accounts through the official app or their health provider’s website.
There’s another scam masquerading as MyChart, the patient portal used by doctors to communicate with their patients. The new scam uses email and texts to target seniors with the promise of a free “Medicare kit.”
Health systems across the U.S. are warning patients about a growing phishing campaign that impersonates MyChart, the widely used patient portal developed by Epic Systems. The messages may promise a “MyChart Medicare Kit,” “Medicare Health Kit,” “Senior Health Package” or another free wellness product.
There is no such giveaway.
Pennsylvania Attorney General Dave Sunday issued a warning Aug. 28, saying scammers are sending emails and texts offering patients a chance to claim a “MyChart Medicare Kit.” The messages attempt to get victims to click malicious links and surrender passwords or other personal information.
A previous campaign used a fake MyChart that warned of a serious test result, in hopes of persuading the victim to download malware.
The new campaign has spread widely. Becker's Hospital Review reported that at least 41 health systems had warned about the scheme by late August.
How the scam works
The scam is particularly convincing because millions of patients are accustomed to receiving legitimate MyChart notifications about appointments, test results, prescriptions and messages from their doctors.
One version tells recipients they have been selected to receive a free 2026 Medicare Health Kit. MyChart itself warns that it does not conduct giveaways and says any email claiming MyChart is giving away a product is fraudulent.
UC Davis Health says one version directs consumers to a survey where they are eventually asked for financial information to cover the supposed cost of shipping the free first-aid and medical supply kit.
That's where a free offer can become expensive.
Gizmodo, which obtained consumer complaints filed with the Federal Trade Commission, reported that one consumer in their 70s entered a Mastercard number to pay $9.95 for shipping. According to the complaint, another attempted charge for $29.95 quickly followed.
Other versions can be even more dangerous because they attempt to steal MyChart usernames, passwords or verification codes. Cooper University Health Care warns that fake messages may also request Medicare information or direct consumers to websites designed to look like legitimate MyChart pages.
MyChart hasn't necessarily been hacked
Receiving one of these messages doesn't mean hackers have broken into your hospital's computer system or gained access to your MyChart account.
Health systems say the criminals are impersonating the familiar MyChart brand to make their messages more convincing. Virtua Health, for example, says there is no indication that MyChart, Epic or its health system was breached as part of the scam.
That's an important distinction. The scam relies on social engineering — convincing victims that a fraudulent message comes from an organization they already trust.
Red flags
Consumers should be suspicious of messages announcing that “Your MyChart Medicare Kit Awaits!” or offering free Medicare supplies, wellness packages, prizes or rewards.
Other red flags include requests to verify an address, take a survey, provide Medicare or insurance information, enter a MyChart password or pay a small shipping charge.
Don't assume a message is legitimate simply because it contains the MyChart logo. Scammers can copy logos and other graphics from legitimate websites.
Also avoid clicking an “unsubscribe” button in a suspicious message. Several health systems warn that the unsubscribe link itself may be malicious.
What to do
If you receive an unexpected MyChart message, don't use the link contained in the email or text. Open the MyChart app you normally use or go directly to your health care provider's known website.
If the message concerns something legitimate — such as an appointment, bill or test result — you should normally be able to find corresponding information inside your actual account.
Consumers who already entered a MyChart password on a suspicious website should change the password immediately and review their account for unexpected activity. If credit or debit card information was provided, contact the card issuer or bank promptly.
And remember one simple rule: MyChart is a patient portal, not a Medicare benefits program. It doesn't give away Medicare kits.