Fake patient portal scam can steal your login and infect your PC

If you have ever checked a lab result or sent your doctor a message online, you may already know MyChart. It is a widely used patient portal from Epic that hospitals and medical practices use to give patients online access to health information and care teams.

That growing reliance on patient portals caught the attention of Mary M. She recently wrote to us after hearing from her primary care physician, or PCP, and several specialists about moving more of their patient communication online.

“I just got a lot of updates from my PCP and specialist doctors saying they are moving toward this, but they are already compromised!! I think this is a topic for you!”

Mary raised a concern many patients may share as they hear about scams targeting MyChart users. There is an important point to clear up. The warnings reviewed here describe criminals impersonating MyChart through phishing campaigns. They do not report a breach of the MyChart platform itself.

MEDICARE AND SOCIAL SECURITY SCAMS: WARNING SIGNS AND TIPS

Epic has documented scams that copy the MyChart experience to steal login details. One version can also push malware onto Windows computers. Here’s how the scam works and how to protect yourself before a fake MyChart alert catches you off guard.

Missed CyberGuy LIVE? Watch the Protect Your Money replay

Our free CyberGuy LIVE class, Protect Your Money From Today’s Biggest Threats, has ended, but you can still watch the full replay and download our financial protection checklist. Kurt “CyberGuy” Knutsson walks you through five simple ways to help defend yourself against AI scams, fraud, identity theft and financial hacks. You’ll learn how to set up bank alerts, strengthen your account logins, protect your phone number, freeze your credit and help secure your retirement savings against unauthorized transfers. No technical experience is needed.

Get the free replay and checklist now at CyberGuyLive.com

This one caught my attention because the warnings are coming from several credible sources at nearly the same time. Penn Medicine said on Aug. 26, 2026, that it was seeing a nationwide scam involving emails and text messages made to look like they came from MyChart. Then, on Aug. 28, Pennsylvania Attorney General Dave Sunday warned consumers about another MyChart impersonation scam involving a bogus Medicare Kit.

Epic has also detailed two phishing campaigns its security team investigated this summer. Put all of that together, and you can see why I want you to be especially careful with unexpected MyChart messages right now.

The tricky part is that many of us are already used to getting legitimate emails about appointments or new test results. A fake MyChart alert can land right alongside the real ones, and scammers are counting on you reacting before you take a closer look.

One campaign starts with a message that looks routine. Epic says the email carries MyChart branding and tells the recipient, “Your recent results are ready.”

The button inside the email leads to a fake sign-in page. According to Epic, scammers copied code from the real MyChart site, which helps the page look convincing.

The bogus page asks for an email address and password. If you enter them, the scammers can capture those credentials. Then the attack gets more aggressive.

After the victim signs in, the fake site displays a made-up medical record. Epic says one version shows a pop-up claiming an “AI-powered review” found critical patterns in blood work.

That is a powerful pressure tactic. A warning about your health can be much harder to ignore than an ordinary phishing message.

Epic says real critical results come from your care team rather than a website pop-up. The fake chart then claims you need to complete a human verification step before seeing more information.

This part should stop you immediately. Epic says the site instructs Windows users to press the Windows key and R, paste content from the clipboard and press Enter. Those steps open the Windows Run box and execute a command the website placed on the clipboard. According to Epic, following those instructions installs malware.

Epic also saw an August 2026 version with an “Unlock Full Report & See Diagnosis” button. Clicking it downloaded a Windows file called Full_Analysis_Report.exe. The page then coached the victim through bypassing the computer’s security warning. Your medical results should appear inside MyChart. A patient portal should never require you to download a Windows program to reveal a diagnosis.

FAKE PASSWORD-MANAGER ALERTS COULD PUT YOUR VAULT AT RISK

The second campaign uses a different hook. Epic says scammers sent fake emails telling people they had been selected for a “2026 Medicare Health Kit.” Penn Medicine has also warned about messages advertising a free “MyChart Medicare Kit” or “Senior Health Package.” MyChart does not run giveaways.

After someone clicks, Epic says the link can pass through unrelated advertising sites before reaching a fake MyChart-branded survey. A countdown clock pushes the victim to move quickly. Eventually, the site says the kit costs $0 but asks for a shipping fee. Before payment, it collects personal information. The final page asks for credit card details. Epic says no kit ships.

Patients already expect electronic messages from doctors and hospitals. A real test-result notification may show up on the same day as a fake one. Scammers can copy that familiar routine. They can also use fear to shorten the amount of time you spend checking a message.

If a fake portal hints at a serious health problem, your first instinct may be to find out what happened. That is why opening the portal independently can make such a difference. We recently covered another healthcare scam that uses fake QR codes around medical settings. Those codes can send patients to bogus sites asking for patient portal credentials or Medicare information. The MyChart campaign follows the same basic idea. The scammer borrows trust from a healthcare service you already recognize.

A few simple steps can help you slow things down before an urgent-looking message leads you to the wrong place.

If an email says a new result is waiting, avoid using the button inside the message. Open the MyChart app directly. You can also use a saved bookmark or start from your healthcare provider’s official website. Epic says each healthcare organization can have its own MyChart URL. You can use MyChart.org to find your provider’s official portal.

Do not rely on the sender name alone. An email can display “MyChart” while coming from an unrelated address. Look at the full address and compare it with previous legitimate messages from your healthcare provider. If anything feels off, contact your provider through a phone number or website you already trust.

MyChart says it will never tell you to use keyboard shortcuts or run a command to verify, fix or unlock your account. A website asking you to open the Windows Run box should be an immediate warning sign. Close the page.

MyChart supports two-step verification (2FA). The extra check can help protect your account if someone gets your password. Depending on your setup, you can verify your login through a code or an authenticator app. MyChart also supports passkeys, which can reduce your reliance on a reusable password.

Avoid reusing a password from another important account. A password manager can create and store a strong password for you. If a phishing site captures one password, reuse can turn one stolen login into a much larger problem.

The malware part of this scam shows why strong security protection still has a role. Strong antivirus software can help warn you about malicious downloads or suspicious websites. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.

Keep Windows and your browser updated too. For more ways to recognize suspicious email, see our guide on how to spot and prevent phishing attacks in your inbox.

If a message claims a serious result needs immediate attention, do not let the urgency decide what you click. Open the official MyChart app yourself or call your provider using a number you already trust. Epic specifically warns that real critical results come from your care team rather than a scary website pop-up.

Scammers can make phishing messages more convincing when they already know details such as your phone number, home address, age or family connections. A data removal service can help remove some of that information from people-search sites and data brokers. It will not stop a fake MyChart message from reaching you, but it can give scammers less personal information to work with when they try to make a message feel legitimate. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.

Epic says MyChart does not run giveaways. If an email promises a free Medicare kit or health package under the MyChart name, do not enter personal information or payment details.

FAKE PARTY INVITATION SCAM CAN HIJACK YOUR COMPUTER

Your next move depends on what happened after you opened the page.

Close the page. If you did not enter any information, run a command or download a file, avoid interacting with the site any further. Mark the original message as junk or phishing. Do not click an unsubscribe link inside the suspicious message.

Go to MyChart through the official app or your provider’s trusted website. Change your password right away. Then review the contact information saved in your account, including your email address and phone number. If anything looks unfamiliar, contact your healthcare organization’s MyChart help desk.

Call your bank or card issuer using the number printed on the card. Tell them the card information went to a fraudulent website and ask about replacing the card.

Disconnect the computer from the internet. Have the computer checked before you use it again for sensitive activity. Run a full security scan with strong antivirus software. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com. Then change important passwords from another trusted device if you used those accounts on the affected computer.

Contact your healthcare provider and health insurer. Medical identity theft can create problems beyond a stolen password. Fraudulent activity can end up connected to your health records or insurance. We explain the warning signs and recovery steps in medical identity theft follows you into the doctor’s office.

What gets me about this scam is how naturally it fits into something many of us already do. Doctors want patients using portals because they make it easier to see results and stay connected with a care team. Scammers know those messages already have our attention. I would keep using MyChart if my doctors rely on it. I would simply change how I respond to unexpected notifications. If an email says an important result is waiting, I would open the app myself rather than letting the email choose where I go. The malware trick also deserves extra attention. A website asking you to open the Windows Run box or ignore a security warning has crossed a very clear line. Close it and verify the message through your provider. The hardest part may be resisting the fear factor. A message about an abnormal medical result can make anyone move quickly. Taking a few extra seconds to open the real app could protect your patient account and your computer.

Have you received a suspicious MyChart message, or are you becoming more cautious about how you open patient portal alerts? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

Copyright 2026 CyberGuy.com. All rights reserved.

Read More​Technology News Articles on Fox News c9490a58-2ff5-5745-9510-47cf3080991a, fnc, Fox News, fox-news/tech/topics/cybercrime, fox-news/tech/topics/virus, fox-news/tech/topics/privacy, fox-news/tech/topics/security, fox-news/tech/topics/computers, fox-news/tech, article ​