Scammers Are Coming for Your MyChart Account
By Greg Collier
For millions of Americans, MyChart has become a routine part of managing healthcare. Patients use it to check test results, communicate with doctors, schedule appointments, and access their medical records. That familiarity is precisely what scammers are now exploiting.
Hospitals around the country are warning patients about a phishing campaign that uses the MyChart name and branding to make fraudulent emails and messages appear legitimate. The campaign appears to be particularly targeting older Americans, with some messages promising Medicare-related benefits, wellness programs, or a free health kit.
The scam is a good reminder that criminals don’t necessarily need to break into a hospital’s computer system to steal sensitive information. Sometimes, all they need is for a patient to fall for the wrong email.
The MyChart Name Makes the Scam More Convincing
The messages reportedly use the MyChart name and may even include logos that look legitimate. Some versions mention a supposed “2026 MyChart Senior Health Package,” Medicare wellness benefits, or a free health kit.
That combination is carefully designed to get attention.
A Medicare-related offer is particularly likely to catch the eye of an older patient who regularly receives healthcare communications. The message may suggest that the recipient is entitled to a benefit or simply needs to confirm some information to receive it.
Then comes the important part for the scammer.
The recipient is told to click a link, confirm an address, or provide personal information.
That’s where the phishing attack can begin.
This Is Bigger Than One Hospital
The warnings aren’t limited to a single healthcare system.
According to reports, a growing number of hospitals have been warning their patients about the campaign, with the number tracked by healthcare industry media increasing from seven hospitals to 20 in recent days.
That’s significant because MyChart isn’t some obscure service used by a handful of patients.
MyChart is operated by Epic Systems, which the reports identify as the world’s largest electronic medical record company. Epic has about 44% of the U.S. hospital market, and approximately 253 million Americans have an electronic record in an Epic system. About 190 million people have a MyChart account.
That enormous user base makes the MyChart name extremely valuable to scammers.
The more people who recognize a brand, the easier it becomes to use that brand as bait.
The Scam Doesn’t Have to Hack MyChart
There’s an important distinction here.
The warnings do not indicate that scammers have hacked MyChart itself.
Instead, criminals are taking advantage of the name’s familiarity. They can create emails, websites, text messages, and other communications that appear to be connected to MyChart even though they aren’t.
That’s a classic phishing strategy.
The scammer wants you to make the mistake for them.
You click the link. You enter the information. You provide the details.
And suddenly, information that should have remained private is in the hands of someone who never should have had access to it.
The information could potentially include login credentials, personal information, medical information, Medicare details, insurance information, or financial information, depending on what the fraudulent message requests.
Why Seniors May Be Especially Vulnerable
The campaign’s apparent focus on older patients is particularly concerning.
Scammers understand that seniors may be dealing with Medicare, multiple healthcare providers, prescriptions, medical appointments, and insurance paperwork. A message promising a Medicare wellness benefit can therefore seem perfectly reasonable.
It also gives scammers an opportunity to exploit urgency.
A message telling someone that they need to confirm information or claim a benefit can create the feeling that ignoring it means losing something valuable.
That’s when people make mistakes.
Instead of stopping to ask whether the message is legitimate, they click.
Don’t Let a Logo Convince You
One of the most important lessons from this scam is that a familiar logo isn’t proof of anything.
Scammers can copy logos.
They can copy colors.
They can create convincing websites.
They can also spoof telephone numbers and even make an email address or website look close enough to the real thing that a hurried recipient won’t notice the difference.
That’s why healthcare consumers should be especially careful when a message involving medical or insurance information asks them to take action.
If you’re unsure about a MyChart-related message, don’t use the contact information contained in the message. Instead, contact your healthcare provider using a telephone number obtained from the provider’s official website or another source you already trust.
That extra step could prevent a major problem.
The Safest MyChart Message May Be the One You Ignore
If you receive an unexpected email or text claiming to offer a MyChart health package, Medicare benefit, wellness program, or free health kit, don’t click the link.
Don’t open attachments.
Don’t reply.
And don’t provide personal, medical, financial, or insurance information.
Mark the message as phishing or junk and delete it.
If you’re genuinely concerned that you’ve missed an important healthcare communication, open the MyChart app or website yourself rather than following a link in an unsolicited message.
That distinction is simple but powerful: go to the service yourself instead of letting the message take you there.
Scammers Follow Familiarity
This latest campaign also illustrates something we’ve seen repeatedly with scams: criminals follow whatever people trust.
They impersonate banks because people trust their banks. They impersonate government agencies because people recognize government authority. They impersonate technology companies because consumers know their brands.
Now they’re using a familiar healthcare brand.
And healthcare information can be particularly valuable because it can contain details that go far beyond a credit card number.
The fact that scammers are using the MyChart name should therefore serve as a warning to anyone who uses the platform, regardless of age.
MyChart itself can still be used normally. The problem isn’t necessarily the healthcare portal. The problem is the person on the other end of a fraudulent message pretending to represent it.
The safest response to an unexpected healthcare message is the same response that works against most phishing scams: slow down, don’t click, and verify independently.
A free health kit isn’t worth handing a stranger your personal information.
Leave a Reply