Fake MyChart Medicare kit text or email scam

What the message looks like

How this scam works

The message usually arrives by email or text and links to a survey. MyChart describes one version step by step: a 'you've been selected' email, a survey with a countdown clock, a 'win', then a request to pay a small shipping charge and fill in your personal details. Scammers keep whatever you type, even if you never pay, and no kit ever ships.

The shipping charge is the hook. In FTC complaints described by the BBB, a consumer in their 70s entered a card number to pay $9.95 for shipping, and another attempted charge for $29.95 quickly followed. Other versions go after your MyChart password or verification code, which could let someone read your records or message your care team as you.

An earlier MyChart-themed campaign used a fake 'your results are ready' email that told people to press a series of keys to 'prove you're human', which installs malware. Getting one of these messages does not mean your hospital was hacked. Scammers copy the MyChart name because patients trust its real notifications.

Red flags

• A text or email offering a free Medicare kit, health kit, senior package, prize or reward 'from MyChart'. MyChart says it does not give away free prizes.
• A survey with a countdown timer or 'only a few left' line.
• A 'free' item that needs a shipping payment, your card number, or your Medicare or insurance details.
• A link that asks you to sign in to MyChart, or a message asking for your password or a verification code. MyChart and Epic say they will never ask for those by text, email or phone.
• Instructions to press keyboard shortcuts or download something to 'unlock' your account or results.

How to tell it’s fake

1. Open the MyChart app you already use, or your health system's website from your own bookmark, instead of tapping the link. A real message about an appointment, bill or result should also be waiting inside your account.
2. Check where the link really goes. MyChart notes the link text can say mychart.org while the address points elsewhere. Each health system has its own MyChart address, listed at mychart.org.
3. Don't use the 'unsubscribe' link. The BBB and the Pennsylvania Attorney General warn that it may be malicious too. Mark the message as junk or phishing instead.
4. If you aren't sure, call your doctor's office using a number you already have, or get a second opinion from a family member or a scam expert before you type anything.

What to do if you clicked, paid or shared info

Don’t panic, and don’t blame yourself. These scams are built by professionals. Act quickly, one step at a time.

If you clicked a link or called back

• If you opened the page but entered nothing, close it. If you followed keyboard steps or ran a download, disconnect the computer from the internet and have it checked by a professional before using it again, as MyChart advises.

If you paid

• If you entered a card number, even for a few dollars of shipping, call your card issuer, report the charge as fraud and ask for a new card. Watch for follow-up charges, since a second attempted charge was reported in at least one case.

If you shared personal info, a password or a code

• If you typed your MyChart password, reset it through the real app or site, then check that the email and phone number on the account are still yours. If you shared your Medicare number, review your Medicare statements for services you didn't receive.

How Gmork Scam Guard would warn you

Scam Guard runs in Chrome and Edge on your computer. When you open a message like this in Gmail or Outlook on the web, it checks the sender and link domains and can warn when a 'MyChart' email doesn't come from a health system or Epic. It can't read texts on your phone, so open your MyChart app yourself instead of tapping the link.

Scam Guard can miss things, so the checks above still matter. See what it warns about and what it keeps private.

Chrome に追加Edge に追加Firefox に追加Opera に追加

Questions people ask

Is the MyChart Medicare kit real?

No. MyChart is a patient portal, not a Medicare benefits program, and it says it does not hold giveaways. Any message offering a free kit from MyChart should be treated as phishing.

Does this mean my hospital or my MyChart account was hacked?

Not necessarily. Health systems say criminals are borrowing the familiar MyChart brand. If you didn't enter your password anywhere, your account is likely fine, but you can sign in through the real app and check.

What addresses do real MyChart messages come from?

MyChart says its messages may come from mchrt.org or mchrt.io, and lists MyChart.com, MyChart.org, Epic.com and EpicHosted.com as official sites. The list isn't complete, so ask your healthcare organization if unsure.

Sources

• MyChart (Epic): How do I protect myself from MyChart scams and fraud?
• KNOE / Better Business Bureau (Nov 2026): New scam targeting trusted patient health portal
• Pennsylvania Attorney General: Phishing scam targeting MyChart patient portal users