Scammers sometimes try to trick patients by using the MyChart name or logo to make emails, text messages, phone calls, and websites look official. Some might try to steal your login information or promise free gifts if you enter payment details. A few simple habits go a long way toward keeping you safe. Always remember: stop and check if it doesn’t feel right.
Phishing attacks are on the rise across all industries. Cybercriminals are using new technology to trick people into handing over personal information. The FTC reported that in 2025, consumers lost $3.5 billion to imposter scams—nearly triple the reported losses in 2020. The FTC has guidelines for avoiding phishing attacks here.
Below are two examples of real scams (phishing campaigns) we’ve seen. Both examples are from Epic security investigations in summer 2026.
This email includes the MyChart logo and a button to sign in and see your results.
The button from the email opens a page that looks exactly like MyChart because scammers copied the real site’s code. The fake website asks for your email address and then your password.
The “Sign In to MyChart” button does not go to MyChart. It goes to a copy of the MyChart website that the scammers built, at an address like mychart-epic[.]com. Real MyChart emails come from your own healthcare organization or MyChart Central and show the name of the organization. If you are unsure if an email is real, do not click any links or buttons in the email. Instead, open MyChart using the mobile app or the official URL for your organization’s MyChart website.
The web address at the top of the browser is not a real MyChart URL. The address here is my-chart[.]org, not your healthcare organization’s real MyChart address nor the official MyChart Central address (mychart.org).
If you were to log in to the fake site, you’d see something that looks like your chart. The name, birthday, and patient number are made up. A pop-up says an “AI-powered review” found critical patterns in your blood work that need immediate attention.
This step exists to give you a sense of urgency and trick you into installing software on your computer. Real critical results come from your care team, not a website pop-up.
To see the results, the site says you must pass a human verification check. It tells you a verification code has been copied for you and then walks you through three keystrokes: hold the Windows key and press R, press Ctrl and V, and press Enter.
This is the attack. No website should ever ask you to type keyboard shortcuts to prove you are human. Those three keystrokes open a Windows command box, paste in something the site secretly put on your clipboard, and run it. If a page ever gives you instructions like these, stop immediately and report it.
If you did follow the verification instructions, you wouldn’t see anything else happen, but the scammer has now installed malware on your computer.
In August 2026, we saw the same fake site with the last step changed. This time, the fake chart shows a table of scary lab values, some of them blacked out, with an “Unlock Full Report & See Diagnosis” button. The button downloads a program: Full_Analysis_Report.exe.The page then guides you past your computer’s security warning, telling you to click “More info” and “Run anyway.”
Remember: Lab results are available directly in MyChart, not in a program you download. Any page that tells you to click through a Windows security warning is telling you to ignore the one thing that was trying to protect you.
You receive a fake email that says congratulations on receiving an exclusive benefit, a 2026 Medicare Health Kit. It might include a delivery notice for a kit already on its way or a plain letter thanking you for being a valued member. These scenarios were reported by real patients within a two-week time period, and the wording changes every time.
Remember: MyChart is a place for your medical records. It does not hold giveaways. An email where “MyChart” is giving you a product is fake. The small print here signs off as “MyChart Health Network” at an address in Verona, Wisconsin. There is no such company, and the address is wrong.
The words you see and where the link takes you might not match. In the third example, the link text reads mychart.org, but resting your cursor on it shows a different web address that scammers use to send you somewhere else.
If you click the link, you’ll see several unrelated advertising websites before the page finally opens.
The address is different for every person who gets the email. That is part of why these scams are hard to shut down.
You land on a page with the MyChart logo, today’s date, a banner claiming over $300,000 in MyChart products have already been given away, and a few easy questions about your experience with MyChart.
The countdown is the scam working on you. Nothing real expires in six minutes, and the survey answers are never read—the same reward appears no matter what you click. The clock is there for one reason: to stop you from pausing long enough to ask whether any of this makes sense. Whenever a page rushes you, that is the moment to slow down.
The page shows the kit as a $149 value, now $0, with only a few left in stock. You click Claim Reward, and a pop-up confirms one has been reserved exclusively for you. Then you see a step that was not mentioned before: pay the shipping fee.
Remember: A prize you have to pay for is not a prize; it is a purchase. This switch from “free” to “just cover shipping” is the whole scam. The “5 remaining” and “reserved for you” lines are fake and they change every time the page loads.
Now a price appears: $13.77. Before you can pay, the form asks for a lot of personal details: your first and last name, email address, phone number, and full mailing address. It shows a reassuring “Secure 256 Bit Encrypted Connection” badge.
The scammers steal everything you type here, even if you close the page before paying. They sell that full set of details—your name, home address, phone number, email address—and use it for the next round of scam calls and mail. The padlock and the “256 bit encrypted” badge do not help. Encryption only means nobody could read your details on the way to the scammer.
The final page, on yet another unrelated website, asks for your credit card number, the expiration date, and the three-digit code from the back. It offers you a $2.87 discount for paying with Mastercard.
Every step before this one existed to get you to this form. No kit ships. The charge is often small on purpose, so it is easy to ignore...until it repeats or grows larger.
If you have already entered your credit card information, call your bank, report the charge as fraud, and ask for the card to be replaced. Do not just dispute the one charge.
.svg){kind=small}