Fake MyChart messages target patients across Pennsylvania

Thousands of patients who use MyChart are being warned about a growing phishing scam that uses fake healthcare alerts to steal sensitive personal information.

The Pennsylvania Attorney General's Office, Penn Medicine and Epic Systems, the company behind MyChart, say scammers are sending emails and text messages that appear to come from the popular patient portal platform. The messages often use MyChart branding, logos and familiar healthcare notifications to appear legitimate.

What the scam looks like

Some messages claim patients have new test results, an appointment update, an unpaid balance or a new secure message waiting in their account, according to Malware Tips. Others promise a free "MyChart Medicare Kit" or "Senior Health Package."

Attorney General Dave Sunday said the so-called MyChart Medicare Kit does not exist.

"Scammers are always looking for new ways to obtain as much of your personal information as possible," Sunday said in a consumer alert issued Friday.

Officials say the messages are designed to convince recipients to click malicious links and provide usernames, passwords, insurance information, verification codes or payment details.

Why the scam is so convincing

Unlike many phishing attempts, the messages exploit something many people trust: their healthcare provider.

A notification about test results, billing issues or appointment changes can create a sense of urgency, making patients more likely to click before verifying the message's authenticity.

Epic says multiple healthcare organizations have reported phishing attempts using the MyChart name and logo.

However, officials stress there is currently no evidence that MyChart itself has been breached or hacked.

How to protect yourself

Penn Medicine and the attorney general's office recommend several steps to avoid becoming a victim:

• Do not click links in unexpected MyChart emails or text messages.
• Check the sender's email address and website URL carefully.
• Never share passwords or verification codes by text, email or phone.
• Be skeptical of unsolicited offers, giveaways or prizes.
• Do not click "unsubscribe" links in suspicious messages.
• Access MyChart only through the official app or by typing your provider's website directly into your browser.

Penn Medicine also notes that MyChart will never ask users for passwords or verification codes through email, text message or phone.

What to do if you clicked

Anyone who may have entered information into a suspicious site should immediately change their MyChart password through the official portal and contact their healthcare provider. Experts also recommend reviewing account information for unauthorized changes and monitoring insurance and medical records for signs of fraud.

Consumers who believe they have been targeted can file a complaint with the Pennsylvania Office of Attorney General's Bureau of Consumer Protection.