A phishing email disguised as a free health benefit may be landing in inboxes across the country — and it appears to be using MyChart's name to reel in people who trust the popular medical portal.
Using MyChart's name, the emails dangle a "Medicare Kit" or "Senior Health Package" that appears to be free. Complaints indicate the pitch is really meant to obtain payment details and other personal information.
Here's what to know
FTC complaint data obtained by Gizmodo suggests the fake MyChart offer has become far more common. The outlet said the records, requested under the Freedom of Information Act, included 166 MyChart-related complaints spanning five years, although the filings weren't all about phishing.
Among the messages are emails using phrases like "Senior Health Package" or the subject line "Your MyChart Medicare Kit Awaits!" In one complaint, the message told the recipient they were "eligible to receive the official MyChart Medicare Home Health Kit at no added cost to you" and claimed that "Unclaimed packages will expire within 48 hours of notice."
Part of what may make the email convincing is that Medicare does send new enrollees official materials called the "Welcome to Medicare" package. Even so, that legitimate mailing has nothing to do with a so-called bonus "kit" that asks people to take a survey and pay for shipping.
Several FTC complaints describe a nearly identical pattern: users complete a short survey about MyChart, provide shipping information, and then enter a credit card number to pay a small fee.
TCD Picks » Quince Spotlight
💡These best-sellers from Quince deliver affordable, sustainable luxury for all
More background
Because so many patients use MyChart to manage appointments, medications, test results, and medical records, a message using that name can seem believable. Epic Systems produces the portal, and it is the most widely used patient portal in the United States.
Some complainants said the emails looked polished and legitimate. One FTC complainant wrote, "It looked real, with the MyChart logo, offering me a free and 'completely new' Medicare Kit," according to Gizmodo. Other FTC complainants said they realized too late that the sender address had no connection to MyChart.
The financial damage can start with a small charge and quickly escalate. An Indiana complainant told the FTC, "They then charge you the 9.95 and immediately try charging your card another 29.95 for another scam company."
The fake survey linked to a health portal could expose account credentials, email addresses, and personal information tied to medical identity theft.
What can be done?
After Gizmodo contacted Epic, the company referred readers to guidance on MyChart scams posted on its website. For people who entered payment details, Epic says one of the first moves should be to call the bank and replace the card.
If someone downloaded software from a phishing site — or submitted sensitive information there — Epic also says to take the computer offline and have a professional inspect it before using it again for financial, work, or personal accounts.
The complaints and the sample email Gizmodo reviewed show several warning signs: generic greetings, Gmail or other unrelated sender addresses, pressure tactics, unusual recipient lists, and requests for shipping fees tied to a supposedly free medical item.
One FTC complainant from Minnesota wrote, "I am extremely upset and concerned that I am going to be a victim of medical/personal identity theft and am reaching out here immediately to get protection and assistance with how this horrific incident can be quickly and effectively resolved."
Where can I learn more?
The MyChart emails are part of a wider run of scams and privacy concerns built around familiar brands, time pressure, and personal information. Variations on the same playbook are showing up in fake Google security alerts, inheritance letters the FTC says are making the rounds again, AI-generated utility scam calls, and complaints about how dating companies handled user photos.
• Crypto users also faced phishing emails impersonating Google alerts to hide malicious links.
• The FTC says letters claiming you're heir to millions are lures from scammers.
• In Florida, utility customers heard AI scam calls dangle fake rebates and free AC units.
• The FTC says OkCupid and Match sold millions of users' photos to facial-recognition AI.
They span very different parts of daily life, but the pattern is similar: a message looks credible, pushes for a fast response, and tries to get money, personal information, or both. That's a good reason to treat any email asking you to act quickly with extra skepticism.
Get TCD's free newsletters for easy tips, smart advice, and a chance to earn $5,000 toward home upgrades. To see more stories like this one, change your Google preferences here.
