If you use MyChart to check test results, message your doctor or manage appointments, a message with the MyChart name and logo probably won’t look suspicious at first. That’s what makes the latest MyChart scam so effective. The emails and text messages are designed to look like ordinary patient-portal notifications, and in some cases they tell you that new laboratory results are available or that you’ve been selected to receive a free Medicare health kit. The goal is to get you to click before you stop and think about where the message actually came from.
I looked into the current warnings because this isn’t simply a case of somebody sending a badly written phishing email. The scammers are copying the appearance of MyChart, creating fake login pages and, in one particularly nasty version, displaying frightening fake medical results before telling the victim to complete a supposed human-verification step. That last part is where the scam can turn from an attempt to steal your login information into an attempt to infect your computer with malware.
MyChart itself is legitimate. The scam is someone impersonating it.
Epic, the company behind MyChart, has warned that scammers are using the MyChart name and logo in emails, texts, websites and other communications to make fraudulent messages appear genuine. Epic’s current security guidance specifically describes two campaigns seen during summer 2026: a fake “Your recent results are ready” notification and a fake Medicare Health Kit promotion.
What Is the MyChart Scam?
The MyChart scam is really a collection of phishing schemes rather than one single message. The details change, but the basic idea remains the same: make you believe that something important has happened in your medical account, then give you a reason to click a link.
That reason might be a new test result, an urgent medical notification, a free Medicare package or another supposed benefit. Once you click, you can be taken to a website that has been designed to resemble MyChart closely enough that you may not notice anything is wrong.
That’s the dangerous part. Most people don’t sit down and inspect the source code of a website before logging into their healthcare account. If the logo looks right, the colors look right and the page asks for the same information you normally use, it is very easy to assume you’re in the right place.
Epic says scammers have copied the actual MyChart site’s code to create fake login pages. Some of the fraudulent web addresses can look convincing at a glance while having nothing to do with the legitimate MyChart website used by your healthcare provider.
The Fake “Your Lab Results Are Ready” MyChart Email
This is probably the version that worries me most because it takes advantage of something people naturally want to check immediately.
You receive an email telling you that recent test results are ready. It contains MyChart branding and a button inviting you to sign in and view them. Nothing about that sounds particularly strange if you regularly use a patient portal.
The problem is the button.
Instead of taking you to the real MyChart website for your healthcare organization, it takes you to a fake site controlled by the scammers. According to MyChart’s own description of the campaign, the fraudulent site can closely imitate the real portal and ask for your email address and password.
This is why clicking the button and checking the address afterward isn’t a great strategy. By then, you may already have given information to the wrong website.
The safer approach is to ignore the link in the email entirely. Open the MyChart app you normally use or type the official address yourself, then check your account from there. If you really have new results, they should be available through your normal portal.
Then the Fake Medical Results Appear
The scammers don’t stop after collecting your login information.
In the documented version of the attack, the fake website can show what looks like a patient’s medical record. It may include a name, birthday and patient number, followed by a frightening message claiming that an AI-powered review has detected critical patterns in the person’s blood work.
Imagine receiving an email saying your results are ready, clicking through, logging in and then seeing a message suggesting that something serious is wrong with your health. Most people aren’t going to calmly close the browser and investigate the URL at that point. They’re going to want to know what is happening.
That urgency is deliberate. MyChart says the fake site uses the alarming medical message to create a sense of urgency and then tries to move the victim into the next stage of the attack. Real critical results come from your healthcare team, not from a random pop-up on a website reached through an unsolicited email.
The “Human Verification” Trick Is Not a CAPTCHA
This is the part I really want people to remember because it can cause much more damage than simply entering your password on a fake login page.
The fraudulent website tells the visitor that they need to prove they are human before they can see the supposed medical results. It then gives instructions involving three keyboard actions: holding the Windows key and pressing R, pressing Ctrl + V, and then pressing Enter.
That isn’t a normal CAPTCHA.
Those instructions open a Windows command box and paste something that the malicious website has secretly placed on the computer’s clipboard. Pressing Enter then runs it. MyChart says this is the attack itself and that following those instructions can result in malware being installed on the computer.
So if a supposed MyChart page tells you to press Windows + R, paste a verification code and press Enter, stop right there. Don’t continue because the page says you’re only one step away from seeing your medical results.
A legitimate website does not need you to open the Windows command prompt to prove you’re human.
What If the MyChart Scam Asks You to Download a File?
The campaign has also evolved beyond the keyboard-shortcut trick.
MyChart’s current warning says that in an August 2026 version of the fake site, visitors were shown alarming laboratory values and an “Unlock Full Report & See Diagnosis” button. Clicking it downloaded a program called Full_Analysis_Report.exe, after which the page reportedly tried to convince users to bypass a Windows security warning and select “Run anyway.”
This is a particularly important detail because some people have been trained to think that anything coming from a medical portal must be safe.
It isn’t.
Your medical test results are available through your healthcare provider’s legitimate MyChart portal. You should not have to download an executable program to read them. If a website tells you to ignore a Windows security warning so that you can open your lab report, close the page.
The security warning is doing its job.
The Fake MyChart Medicare Kit Scam
There is another version of the scam that takes a completely different approach.
Instead of frightening you with medical results, the message offers something that sounds like a nice free benefit. The current campaign has used phrases such as “2026 Medicare Health Kit,” “Senior Health Package,” and other similar offers. MetroHealth has separately warned patients about fraudulent messages mentioning a “2026 MyChart Senior Health Package,” Medicare wellness benefits and a free health kit.
The email may tell you that you’ve been selected or that a kit is already on its way. You are then encouraged to click a link, confirm your address or answer a few questions.
That sounds harmless enough.
It isn’t.
Epic specifically says MyChart does not run giveaways. Its current scam warning describes a fake survey that displays a countdown timer and eventually tells the victim they have won a supposed kit. The page then asks for a shipping payment and collects personal information before presenting a credit-card form.
The small shipping charge is part of what makes this type of scam effective. Someone might think, “It’s only a few dollars, I’ll just pay it.” But the real objective can be the information being collected during the process, including your name, address, email address and phone number, as well as your payment details.
Why the Free Medicare Kit Story Sounds So Believable
The scam works because it combines two things people already recognize: Medicare and MyChart.
Someone receiving an email about a “Medicare Health Kit” may assume it has something to do with their healthcare provider or insurance benefits. The MyChart logo makes the message feel even more familiar.
But MyChart is primarily a place to access your medical records and communicate with your healthcare organization. It isn’t a company randomly sending patients free products.
MetroHealth’s warning specifically says these Medicare and free-health-kit messages are fraudulent and are not affiliated with MyChart or MetroHealth.
The easiest rule to remember is this: MyChart doesn’t need your credit card to give you access to your medical records.
If someone says you’ve won something through MyChart and then asks you to pay shipping, enter your card number or complete a strange survey, don’t proceed.
How to Tell a Fake MyChart Email From a Real One
One of the biggest mistakes people make with phishing emails is looking only at the logo and the message itself.
The sender’s full email address matters. So does the actual website address behind the button.
MyChart’s own guidance says each healthcare organization has its own MyChart URL and recommends using the search tool on MyChart.org if you’re unsure which official site belongs to your provider. It also points out that scammers use small misspellings and extra words in addresses to make fraudulent websites look legitimate.
Don’t assume that a link is safe because the text displayed in the email says “MyChart.”
The link could lead somewhere completely different.
The safest habit is to avoid clicking the link at all. Open the MyChart app directly, use your usual bookmark or navigate to your healthcare provider’s official website yourself.
Will MyChart Ask for Your Password by Email?
No.
According to Epic’s current security guidance, Epic and your healthcare organization will not ask you for your MyChart password or verification codes by phone, text or email. Those credentials should only be entered through the legitimate MyChart website or app.
That makes this an easy rule to remember when you’re tired, busy or distracted: don’t give your MyChart password or verification code to someone who contacts you.
Even if the message looks professional.
Even if it has the MyChart logo.
Even if it says your medical results are urgent.
And especially if someone is pressuring you to act immediately.
What Happens If You Clicked the MyChart Scam Link?
This depends on what you did after clicking.
If you clicked the link but didn’t enter anything and didn’t download or run anything, close the page. MyChart says you’re most likely fine in that situation. You should still report the message as phishing or junk rather than replying to it.
If you entered your MyChart password, change it through your legitimate healthcare organization’s MyChart site. Don’t use the link from the suspicious email to change it.
If you entered credit-card information, contact your bank or card issuer and explain that the information was entered into a suspected phishing site. MyChart specifically recommends having the card replaced if you entered card details.
And if you followed the Windows shortcut instructions, pasted the supposed verification code or ran a downloaded program, the situation is more serious. MyChart advises disconnecting the computer from the internet and having it examined before using that computer to access personal, financial or work information.
Don’t Reply to the MyChart Scam
Another mistake is replying to the email to ask whether it is real.
I understand why someone would do that. If you’re unsure, it feels natural to respond and ask, “Did you send this?”
Don’t. MyChart recommends not replying to suspected scam messages and not clicking unsubscribe links. Doing so can confirm to the sender that your email address is active, and an unsubscribe link can itself lead to a dangerous website.
If you need to verify something, contact your healthcare provider through a phone number or website you already know is genuine.
Don’t use the contact information contained in the suspicious message.
Is MyChart a Scam?
No. MyChart is a legitimate patient portal.
This distinction matters because people searching “Is MyChart a scam?” may see stories about fraudulent emails and assume the entire platform is fake. MyChart is used by healthcare organizations for things such as viewing medical information, communicating with care teams and accessing test results.
The scam involves criminals impersonating MyChart.
Epic itself is warning users about these phishing campaigns, and healthcare organizations such as MetroHealth have issued their own warnings about fake MyChart messages.
So if you receive a suspicious MyChart message, don’t delete the MyChart app or assume your healthcare provider is involved. Instead, treat the message as a potential phishing attempt and verify everything through your normal healthcare channels.
MyChart Scam Warning: The Biggest Thing to Remember
The most useful lesson from this scam isn’t really about spotting a particular logo or memorizing one suspicious website address. Those details can change.
The trick is understanding the behavior.
A message says your results are ready, so you click. A website says something is seriously wrong, so you panic. The page then says you need to verify yourself, so you follow instructions. Before you realize what happened, you’ve entered your password, handed over personal information or installed malicious software.
The scammers are counting on you being too worried to stop and examine what you’re doing.
That’s why the best response to a suspicious MyChart notification is surprisingly simple: don’t use the link in the message. Open MyChart the way you normally do and check your account yourself.
If there really is a new test result, appointment message or notification, you’ll find it there.
If there isn’t, you just saved yourself from a phishing scam.
Is the MyChart Email or Text Message Legit?
If you’re asking because you received a message claiming to be from MyChart, don’t judge it by how professional it looks. The current scams are specifically designed to imitate the real patient portal, and some even create fake medical records and alarming lab results to make the victim act without thinking.
The fake MyChart lab results scam, MyChart Medicare kit scam, MyChart phishing email scam and MyChart human verification malware scam are all variations of the same basic idea: borrow the trust people have in their healthcare provider and use it to steal information or compromise a device.
Conclusion
MyChart’s official guidance is clear that it does not run giveaways, does not ask users to run keyboard commands to verify their identity and does not ask for passwords or verification codes through email, text or phone.
So if you get an unexpected MyChart email saying your test results are ready, don’t panic and don’t click. If it says you’ve won a free Medicare kit, don’t pay the shipping. If a website tells you to press Windows + R, paste something and press Enter, close it immediately. And if it asks you to download a program to view your medical results, don’t run it.
The safest way to check your health information is still the boring way: open the MyChart app yourself or use the official MyChart website for your healthcare organization. A genuine medical result doesn’t need a mysterious link, a countdown timer, a shipping fee or a Windows command prompt.
Check out, Apollo Project I talked about earlier on.