Phishing scams are targeting users of MyChart, a widely used patient portal, with fraudulent emails that mimic legitimate medical alerts. These deceptive campaigns aim to steal sensitive login information and, in some instances, infect Windows computers with malware.

The scams do not indicate a breach of the MyChart platform itself, but rather exploit the trust users place in the portal. Criminals impersonate MyChart through various phishing tactics, often using fake medical results or bogus offers to coerce victims into revealing personal data.

Recent warnings from credible sources, including Penn Medicine and the Pennsylvania Attorney General's office, highlight the increasing prevalence of these attacks. Epic, the company behind MyChart, has detailed at least two phishing campaigns investigated this summer, prompting increased caution among patients.

How the Fake Results Scam Works

One common tactic involves emails that appear to come from MyChart, stating "Your recent results are ready." These emails contain links that lead to fake sign-in pages, meticulously designed to resemble the legitimate MyChart portal. Scammers have reportedly copied code from the real MyChart site to enhance the authenticity of these pages. Upon entering login credentials, victims risk having their information captured.

Following the credential theft, a fake site may display a fabricated medical record, sometimes claiming an "AI-powered review" has identified critical patterns in blood work. This tactic is designed to create a sense of urgency and fear, pressuring users to act without careful examination. Epic notes that legitimate critical results are communicated by a care team, not through a website pop-up.

Installation of Malware

A particularly concerning aspect of the scam involves a verification step for Windows users. Victims may be instructed to perform specific keyboard commands that, when executed, can install malware on their computers. In some variations, clicking a button to "Unlock Full Report & See Diagnosis" prompts the download of a malicious Windows executable file, disguised as a medical report.

Another campaign impersonates MyChart by offering a "2026 Medicare Health Kit" or a similar health package. These emails lead users through a series of advertising sites to a fake survey. While advertised as free, a shipping fee is requested, and personal information is collected before a final request for credit card details. No kit is ever shipped.

Why These Scams Are Convincing

The effectiveness of these scams stems from their ability to blend with routine patient communications. Patients often expect electronic messages from their healthcare providers, and fake alerts can arrive alongside genuine notifications. The use of fear tactics, such as alarming medical claims, further reduces the time a user might take to scrutinize a suspicious message.

Tips for Staying Safe

To protect against these phishing attempts, users are advised to take several precautions:

  • Access Portals Directly: Instead of clicking links in emails or texts, open the MyChart app directly or navigate to the healthcare provider's official website. MyChart.org can help locate the correct portal URL.
  • Verify Sender Information: Examine the full sender email address, not just the display name, to ensure it matches legitimate communications from the healthcare provider.
  • Avoid Running Commands: Never execute computer commands or download files from a patient portal website. A prompt to open the Windows Run box is a significant red flag.
  • Enable Two-Step Verification: Utilize MyChart's two-step verification (2FA) or passkey options for an added layer of security.
  • Use Unique Passwords: Employ a strong, unique password for MyChart, ideally managed by a password manager, to prevent credential stuffing if one account is compromised.
  • Maintain Security Software: Keep antivirus software updated and active, as it can help detect malicious downloads and suspicious websites.
  • Verify Urgent Claims: Treat alarming medical claims with skepticism. Always verify urgent messages by contacting the healthcare provider directly through a trusted channel.
  • Limit Personal Information: Reduce the amount of personal data available online through data removal services, which can make phishing messages less targeted.
  • Treat Giveaways as Red Flags: Be wary of any offers for free Medicare kits or health packages under the MyChart name, as MyChart does not conduct such giveaways.

Actions if a Fake Link is Clicked

If a user clicks a suspicious link but enters no information, they should close the page and mark the message as junk. If login credentials were entered, the MyChart password should be changed immediately via the official portal, and account information reviewed for any unauthorized changes. Entering credit card information requires contacting the bank or card issuer. If a command was run or a file downloaded on a Windows computer, it should be disconnected from the internet and scanned for malware before further use. Any discrepancies in medical information should be reported to the healthcare provider and insurer.