How do I protect myself from MyChart scams and fraud?
Scammers may use the MyChart name and logo to make emails, texts, calls, and websites look real. If something doesn't feel right, stop and check.Phishing attacks are on the rise across all industries. Cybercriminals are using new technology to trick people into handing over credentials, personal information, and payment details. The FTC reported that in 2025, consumers lost $3.5 billion to imposter scams, nearly triple the reported losses in 2020. The FTC has guidelines for avoiding phishing attacks here.
How to protect yourself
Check the sender and web address. Look for small misspellings or extra words. Each healthcare organization has its own MyChart web address. You can find yours at mychart.org.
Official Epic websites include: MyChart.com, MyChart.org, Epic.com, and EpicHosted.com
MyChart messages may come from mchrt.org or mchrt.io
These lists are non-exhaustive. If you are unsure, contact your healthcare organization
Keep your password and codes private. Only enter them in the MyChart website or app.
Neither MyChart nor Epic will ever:
Ask for your password or authentication codes via SMS, email, or phone call
Ask you to change your email or phone number to one you don’t control
Give away “free prizes”
Ask you to run commands on your computer to complete a challenge
When in doubt, ask. Call your healthcare organization's help desk.
If you think you were a victim
Clicked but entered nothing? Close the page.
Don't reply or click unsubscribe. Mark the email as junk or phishing instead.
Entered a password? Reset your MyChart password. Then check that the email and phone number in MyChart are yours.
Entered a credit card? Call your bank, report fraud, and ask for a new card.
Ran a program or followed keyboard steps? Disconnect from the internet. Get your computer checked by a professional before you use it again
Below are two real examples of phishing scams we’ve observed this year.
Scam 1: The fake MyChart website
A "results are ready" email. It has the MyChart logo and a sign-in button. Don't click. Open MyChart with the app or your own bookmark instead.
A fake sign-in page. It looks just like MyChart, but the web address is wrong.Scammers have copied the website.
A scary fake result. A pop-up says your blood work needs attention right now. Real critical results come from your care team.
A "prove you're human" test. It tells you to press Windows+R, then Ctrl+V, then Enter. This puts malware on your computer. No real website will ask you to do this.
A download to "unlock" your report. Another version asks you to download a program and click past a security warning. Your results are in MyChart, not in a download.
This step exists to give you a sense of urgency and trick you into installing software on your computer. Real critical results come from your care team, not a website pop-up.
Image 1 of 6
Scam 2: The free "Medicare Kit"
A "you've been selected" email. It offers a free health kit from MyChart. MyChart does not hold giveaways.
A survey with a countdown clock. The clock is there to rush you. When a page rushes you, slow down.
You "win," but you have to pay shipping. A prize you have to pay for is not a prize.
A form for your personal details. Scammers keep whatever you type, even if you don't pay. A padlock or "secure" badge does not make a site safe.
A payment form. This is what the scammer wants. No kit ever ships. If you entered your card, call your bank.
The small print here signs off as “MyChart Health Network” at an address in Verona, Wisconsin. There is no such company, and the address is wrong.
The words you see and where the link takes you might not match. In this example, the link text reads mychart.org, but resting your cursor on it shows a different web address that scammers use to send you somewhere else.
Remember: A prize you have to pay for is not a prize; it is a purchase. This switch from “free” to “just cover shipping” is the whole scam. The “5 remaining” and “reserved for you” lines are fake and they change every time the page loads.
.svg){kind=small}