That “MyChart Medicare Kit” Is A Scam
If you use MyChart to check test results, message your doctor, schedule appointments, or pay medical bills, you’re far from alone. More than 195 million people use MyChart, making it one of the most recognizable names in healthcare.
Scammers have also noticed. This week, hospitals and health systems across the country are warning patients about fraudulent emails and text messages that appear to come from MyChart. Some offer a free “MyChart Medicare Kit,” “Senior Health Package,” or other health-related benefit and urge recipients to click a link to claim it.
The reality? There is no free kit. MyChart doesn’t run giveaways, and it is not a Medicare program. Medicare is the federal health insurance program primarily for people age 65 and older, though some younger people with disabilities or certain medical conditions also qualify. It’s administered by the federal government through the Centers for Medicare & Medicaid Services (CMS). Medicare is not related to MyChart.
These Medicare-themed messages are part of phishing campaigns designed to steal personal information, payment information, or login credentials.
What The Medicare Kit Scam Looks Like
The wording of the Medicare Kit scam varies, but the idea is the same.
Some of the scams were emails claiming that you’ve been selected for an exclusive benefit.
Others appear as texts claiming that your “2026 Medicare Health Kit” is already on its way and asking you to confirm information. The common thread is the MyChart name and the promise of something for free.
Epic, the company behind MyChart, says its security team investigated examples of the scam this summer. In one version, clicking the offer led users to a page displaying the MyChart logo and a short survey. A countdown clock created a sense of urgency, and the offer claimed that more than $300,000 in MyChart products had already been given away.
But the survey answers didn’t matter: everyone “won.” The purported $149 kit was offered for free, but there was a catch since you had to pay shipping costs. In one example, that meant paying $13.77 after providing your name, email address, phone number, mailing address, and, eventually, credit card information. But no kit was ever coming. The point was to collect cash—and your personal information.
There’s Another MyChart Scam, Too
The free Medicare Kit isn’t the only scam Epic has identified. In another phishing campaign this summer, scammers sent emails claiming recipients’ recent medical results were ready. That probably sounds familiar if you’ve ever used a patient portal, which is precisely the problem.
The email included the MyChart logo and a sign-in button. Clicking the button took you not to MyChart but to a fake sign-in page that looked like the real thing. After collecting your login information, the site displayed a fake medical record and alarming health information.
In one version, a pop-up claimed that an “AI-powered review” had identified critical patterns in your blood work requiring immediate attention. The scammers then used that sense of urgency to push further. One version instructed you to follow a series of keyboard commands supposedly to prove you were human (like a CAPTCHA). Following those commands could install malware on your computer. A later version prompted you to download a program to “unlock” a full medical report and then instructed you to bypass your computer’s security warning.
When you see these kinds of warnings or directions, take a breath. MyChart will not ask you to run commands, download a program, or override your computer’s security warnings to see your medical records.
Why MyChart?
Phishing scams work best when the message looks like something you already expect to see. For millions of patients, MyChart fits that description. A legitimate MyChart notification might tell you that test results are available, remind you about an appointment, or let you know that you have a new message from your doctor’s office. Seeing an email from MyChart in your inbox isn’t unusual.
Scammers also have another advantage: emotion. A message suggesting that something is wrong with your blood work or other tests may make you anxious enough to click immediately. A message promising a free Medicare benefit may prompt you to do the same. The goal is to get you to act quickly before you realize it’s a scam.
This Isn’t A MyChart Data Breach
It’s important to distinguish these phishing campaigns from a hack of MyChart itself. Epic says the increase in scam attempts stems from criminals exploiting the popularity of the MyChart brand, not a security issue with the platform. Patients can continue to use MyChart normally.
Healthcare organizations across the country have issued warnings, including systems in New Jersey, Massachusetts, Florida, Texas, Ohio, North Carolina, Iowa, Oregon, Hawaii, and elsewhere.
In the Greater Philadelphia area, Penn Medicine, Jefferson Health, Temple Health, Main Line Health, and Virtua are among the health systems that have issued warnings to patients. Pennsylvania Attorney General Dave Sunday has also urged residents to be on the lookout for the scam.
How To Protect Yourself
One of the most effective ways to protect yourself is also the easiest: don’t use an unexpected email or text message to access MyChart. If you receive a message about test results, a new message, a problem with your account, or another reason to log in, open the MyChart app yourself or go to your healthcare provider’s portal through its official website.
That’s always good advice. If you receive an email or text that you’re not expecting, always go to the source.
Check email and web addresses carefully. Misspellings, added words, or other changes can signal a fake site. But don’t assume a message is legitimate just because the spelling and graphics look good. AI is also making it easier for scammers to produce sophisticated phishing emails, eliminating some of the grammatical mistakes and visual irregularities that once made them easier to spot.
As a rule of thumb, never provide your MyChart password or verification code by phone, text, or email. And that advice extends beyond MyChart. Government impersonation scams—including those pretending to come from the IRS, Social Security, or Medicare—often rely on the same tactics: an unexpected message, a familiar name, and a request for personal or financial information. When in doubt, go directly to the agency’s official website, like IRS.gov, rather than clicking a link in a message.
The same goes for giveaways. MyChart does not offer free first-aid kits, Medicare Kits, or other prizes, and government agencies like the IRS and Medicare won’t randomly contact you about prizes or rewards, either. An unexpected message promising something for free in exchange for your personal or financial information should immediately raise a red flag.
What If You Already Clicked?
If you clicked a suspicious link but didn’t enter any information or follow any instructions, Epic says you’re most likely fine. Close the page.
If you entered your password, reset it through your healthcare organization’s official MyChart website or app, and review the email address, phone number, and other contact information associated with your account.
If you provided credit card information, contact your bank, report the card as compromised, and request a replacement. Don’t simply dispute the individual charge.
If you followed instructions to run a program or use keyboard commands, disconnect the computer from the internet and have it checked before using it again to access personal, financial, or work information.
Finally, don’t click “unsubscribe” in a suspicious email. That link could also be malicious. Instead, mark the message as junk or phishing and delete it.
What You Need To Know
For years, one of the easiest ways to spot a scam was to look for spelling errors, awkward grammar, or amateurish graphics. That’s becoming less reliable.
Rather than rely on what the website or message looks like, think about what it’s asking you to do. An unexpected message offering something for free, asking for your password or verification code, telling you to download something, or pushing you to act immediately should raise suspicion. Urgency is almost always a red flag.
Remember: When in doubt, assume it’s a scam.
