MyChart’s anti-fraud page

Scammers sometimes try to trick patients by using the MyChart name or logo to make emails, text messages, phone calls, and websites look official. Some might try to steal your login information or promise free gifts if you enter payment details. A few simple habits go a long way toward keeping you safe. Always remember: stop and check if it doesn’t feel right.

How to protect yourself

Check the sender and the web address. Before you click a link, enter login information, or provide payment details, look closely at the sender's full email address and the complete website URL. Small misspellings and extra words are common signs of a fake. Each healthcare organization has its own URL for MyChart. You can look up your healthcare organization's official MyChart website using the tool at mychart.org . MyChart.com, MyChart.org, and Epic.com are all official Epic websites.

When in doubt, ask. Not sure if a message or website is real? Don't enter your login or payment info yet. Call your healthcare organization’s help desk first and ask.

Guard your password and verification codes. Epic and your healthcare organization will never ask for your password or verification codes. The only safe place to enter them is the MyChart website or app. No one should ask for them by phone, text, or email.

Keep your communications private. Epic and your healthcare organization will never ask you to change your email address or phone number to one you don't control. Don't forward messages from MyChart to others.

Be skeptical of "free" offers. Some messages promise free gifts or prizes, such as a "free first aid kit," in exchange for your info. These are most likely scams. MyChart does not run giveaways.

Never run commands on your computer. MyChart will never tell you to press keyboard shortcuts or to run a command to "verify," "fix," or "unlock" your account.

If you suspect you were a victim of fraud

If you clicked but entered nothing, close the page. You are most likely fine.

Report it as junk or phishing in your email app. This is one of the most useful things you can do—it teaches your email provider’s filters to block the one for everybody.

Review the email address, phone number, and other information on file in MyChart. If you entered a password, reset your MyChart password for your healthcare organization or for your Epic ID with MyChart Central . How do I change my email address or phone number on file?

If you entered a password, reset your MyChart password for your healthcare organization or for your Epic ID with MyChart Central .

How do I change my email address or phone number on file?

Check with your healthcare provider. If you’re not sure a message is real, reach out to your healthcare provider's official help desk. Find your MyChart

Check MyChart the normal way. Open the app or your own bookmark. If you’re not sure how to find your organization’s MyChart website, you can for it on MyChart.org.

If you entered credit card details, call your bank and have the card replaced.

If you ran a program or followed keystroke instructions, disconnect the computer from the internet and get it looked at before using to access personal, financial, or work information.

Below are two examples of real scams (phishing campaigns) we’ve seen. Both examples are from Epic security investigations in summer 2026.

Scam 1: The fake MyChart website

1. You receive a "Your recent results are ready" email.

This email includes the MyChart logo and a button to sign in and see your results.

2. The Sign in to MyChart button takes you to a fake sign-in page.

The button from the email opens a page that looks exactly like MyChart because scammers copied the real site’s code. The fake website asks for your email address and then your password.

The “Sign In to MyChart” button does not go to MyChart. It goes to a copy of the MyChart website that the scammers built, at an address like mychart-epic[.]com . Real MyChart emails come from your own healthcare organization or MyChart Central and show the name of the organization. If you are unsure if an email is real, do not click any links or buttons in the email. Instead, open MyChart using the mobile app or the official URL for your organization’s MyChart website.

The web address at the top of the browser is not a real MyChart URL. The address here is my-chart[.]org, not your healthcare organization’s real MyChart address nor the official MyChart Central address ( mychart.org ).

3. After you log in, you see a fake medical record with a scary message.

If you were to log in to the fake site, you’d see something that looks like your chart. The name, birthday, and patient number are made up. A pop-up says an “AI-powered review” found critical patterns in your blood work that need immediate attention.

This step exists to give you a sense of urgency and trick you into installing software on your computer. Real critical results come from your care team, not a website pop-up.

4. You’re asked to verify that you are human.

To see the results, the site says you must pass a human verification check. It tells you a verification code has been copied for you and then walks you through three keystrokes: hold the Windows key and press R, press Ctrl and V, and press Enter.

This is the attack. No website should ever ask you to type keyboard shortcuts to prove you are human. Those three keystrokes open a Windows command box, paste in something the site secretly put on your clipboard, and run it. If a page ever gives you instructions like these, stop immediately and report it.

If you did follow the verification instructions, you wouldn’t see anything else happen, but the scammer has now installed malware on your computer.

In August 2026, we saw the same fake site with the last step changed. This time, the fake chart shows a table of scary lab values, some of them blacked out, with an “Unlock Full Report & See Diagnosis” button. The button downloads a program: Full_Analysis_Report.exe.The page then guides you past your computer’s security warning, telling you to click “More info” and “Run anyway.”

Remember: Lab results are available directly in MyChart, not in a program you download. Any page that tells you to click through a Windows security warning is telling you to ignore the one thing that was trying to protect you.

Scam 2: The free “Medicare Kit”

1. You get an email that says “You’ve been selected.”

You receive a fake email that says congratulations on receiving an exclusive benefit, a 2026 Medicare Health Kit. It might include a delivery notice for a kit already on its way or a plain letter thanking you for being a valued member. These scenarios were reported by real patients within a two-week time period, and the wording changes every time.

Remember: MyChart is a place for your medical records. It does not hold giveaways. An email where “MyChart” is giving you a product is fake. The small print here signs off as “MyChart Health Network” at an address in Verona, Wisconsin. There is no such company, and the address is wrong.

The words you see and where the link takes you might not match. In the third example, the link text reads mychart.org, but resting your cursor on it shows a different web address that scammers use to send you somewhere else.

2. The link in the email does not go to MyChart.

If you click the link, you’ll see several unrelated advertising websites before the page finally opens.

The address is different for every person who gets the email. That is part of why these scams are hard to shut down.

3. You see a “survey” with a countdown clock.

You land on a page with the MyChart logo, today’s date, a banner claiming over $300,000 in MyChart products have already been given away, and a few easy questions your experience with MyChart.

The countdown is the scam working on you. Nothing real expires in six minutes, and the survey answers are never read—the same reward appears no matter what you click. The clock is there for one reason: to stop you from pausing long enough to ask whether any of this makes sense. Whenever a page rushes you, that is the moment to slow down.

4. You see a message that you “win” and are then asked to pay for something.

The page shows the kit as a $149 value, now $0, with only a few left in stock. You click Claim Reward, and a pop-up confirms one has been reserved exclusively for you. Then you see a step that was not mentioned before: pay the shipping fee.

Remember: A prize you have to pay for is not a prize; it is a purchase. This switch from “free” to “just cover shipping” is the whole scam. The “5 remaining” and “reserved for you” lines are fake and they change every time the page loads.

5. You see a form that asks for all your information.

Now a price appears: $13.77. Before you can pay, the form asks for a lot of personal details: your first and last name, email address, phone number, and full mailing address. It shows a reassuring “Secure 256 Bit Encrypted Connection” badge.

The scammers steal everything you type here, even if you close the page before paying. They sell that full set of details—your name, address, phone number, email address—and use it for the round of scam calls and mail. The padlock and the “256 bit encrypted” badge do not help. Encryption only means nobody could read your details on the way to the scammer.

6. You see the payment form, which is what the scammer actually wants.

The final page, on yet another unrelated website, asks for your credit card number, the expiration date, and the three-digit code from the back. It offers you a $2.87 discount for paying with Mastercard.

Every step before this one existed to get you to this form. No kit ships. The charge is often small on purpose, so it is easy to ignore...until it repeats or grows larger.

If you have already entered your credit card information, call your bank, report the charge as fraud, and ask for the card to be replaced. Do not just dispute the one charge.