Scammers posing as the online patient portal MyChart are sending fake emails, texts, and calls to trick Americans into giving up passwords and credit cards, a growing threat the company says isn’t caused by a breach on its system.
In the summer of 2026, MyChart, the digital health portal widely used for communicating with doctors and accessing medical records, reported an uptick in fraudulent communications impersonating its brand. According to MyChart, these phishing attempts have included emails, text messages, phone calls, and even fake websites, all designed to steal login credentials, personal information, or payment details from unsuspecting patients.
MyChart, which is licensed by Epic Systems Corporation, investigated two scam examples over the summer. In one scheme, fraudsters sent messages that appeared to contain medical test results. Recipients were directed to a fake sign-in page or told to follow a series of keyboard instructions, pressing the Windows key and “R,” then “Ctrl” and “V,” and finally “Enter”, potentially triggering the installation of malicious software. Another scam involved offers of a “free Medicare health kit” supposedly worth $149. Victims were steered to a survey page and asked to pay a shipping fee, with some messages escalating to outright requests for credit card details.
Despite the sophisticated appearance of these scams, MyChart stated that the activity was not linked to any security problem or breach of its own platform. The company emphasized that legitimate lab results are always delivered through its official website or app, never via programs downloaded from an email or unfamiliar website. Furthermore, MyChart made clear it does not run giveaways, countering a favorite tactic of online con artists.
While the WCVB report did not identify which specific health systems’ MyChart portals were impersonated, or how many Americans may have been targeted, it outlined the risks that come with even a single click on a fraudulent message. The threat is not merely hypothetical: following the wrong instructions could mean the installation of malware or the theft of sensitive credit card data. No arrests or confirmed cases of compromised accounts were reported in the piece, but the consequences for patients are clear, and potentially costly.
As more Americans rely on digital platforms to manage their health information, criminals have adapted their tactics to exploit this trust. The impersonation of MyChart is a warning sign of the broader vulnerabilities created when massive personal information moves online under weak oversight. Patients who believe they are receiving urgent test results or government health offers may be less cautious, making them prime targets for these scams.
MyChart responded by publishing guidance for users, highlighting common red flags to watch for. Advice included double-checking the sender’s full email address and the entire website URL before clicking any links or entering information. Patients were urged to access MyChart only through the official app or a bookmarked site, not by clicking on links in surprise messages. The company reiterated that it would never ask users to download programs or provide payment information for “free” offers.
For those who fear they may have fallen victim, by entering a password on a fake site, sharing credit card information, or running a suspicious program, there are clear next steps. The article advised users to reset their MyChart password immediately if they disclosed it, contact their bank and request a replacement card if they shared payment information, and disconnect any computer from the internet for a security check if they followed risky keyboard instructions.
While MyChart’s warnings are a necessary first step, the episode exposes a deeper problem: scammers thrive in the gaps left by under-regulated digital platforms and sluggish law enforcement response. The WCVB report did not name any individual fraudsters or point to specific law enforcement investigations. Nor did it clarify how many patients have been harmed or which health care organizations’ MyChart sites were targeted.
This lack of transparency and accountability is no accident. Patient portals like MyChart are now an essential part of American health care, yet the institutions running them too often rely on users to spot the difference between a real message and a convincing fake. Meanwhile, criminals face little risk of exposure or prosecution, emboldened by a system that puts the burden of vigilance on patients themselves.
For taxpayers, patients, and seniors, especially those targeted with fake Medicare offers, this is one more example of how the promise of digital convenience often comes without the protection or oversight it requires. Americans deserve health care systems that take fraud seriously, not just when headlines appear, but with robust, ongoing safeguards that don’t leave ordinary people fending for themselves.
When tech giants and health systems leave the door open, it’s always the honest citizen who pays the price.