Fake MyChart Emails Say Your Test Results Are Ready

An email arrives with the MyChart logo. Your recent results are ready. There is a button to sign in.

If you use a patient portal, you have received that exact message before, legitimately. That is the problem.

As of 27 August 2026, 41 health systems across the United States had warned their patients about phishing emails using the MyChart name and logo. Epic, the company behind MyChart, has published examples from its own security investigations.

One thing worth saying immediately, because it stops unnecessary worry: MyChart itself has not been breached. Trevor Berceau, Epic's vice president of research and development, said the increase is due to scammers taking advantage of the popularity of the MyChart brand rather than any security concern. Your portal is safe to keep using.

Read next: Who calls from (888) 742-1907? 28 people have reported it

What happens when you click

Epic has documented the sequence, and it is worth reading in full, because each step is designed to make the next one feel reasonable.

1. The email. MyChart branding, a message that results are ready, and a sign-in button.
2. The fake login page. It looks exactly right, because the scammers copied the code from the real MyChart site. The address is something like mychart-epic.com, which is not MyChart.
3. Your email, then your password. Asked for on separate screens, exactly as the real portal does it.
4. A fake medical record. After you sign in, the site shows what looks like your chart, with a message saying an "AI-powered review" found critical patterns in your blood work needing immediate attention.
5. The verification step. To see the results, you are told to complete a human verification check. This is where the real damage happens.

Every figure in that fake chart is invented. It exists to frighten you into step five.

The step that installs malware

This is the part that is genuinely new, and it is worth recognising by sight because it appears in other scams too.

The page instructs you to press the Windows key and R together, paste a command, and press Enter. It is presented as a human verification check, the kind of routine box-ticking everyone is used to.

Read next: Rental Scams in 2026: $275 Million Lost and How to Spot One

Windows and R opens the Run box, which executes commands directly on your computer. Pasting something there runs it. Epic says this installs malware.

An August variation dropped the command and instead offered a download called Full_Analysis_Report.exe, with instructions to click past the Windows security warning that appears.

Two rules, and neither has an exception:

• No website has ever needed you to press Windows and R. Not one, for any reason.
• A security warning from Windows is the warning. Instructions telling you to bypass it are telling you what the file is.

The second campaign: the free Medicare kit

The same operation runs a second email, and this one targets money rather than your computer.

Read next: Is ShopVSB.com Legit? Vitamin Sea Boutique Review 2026

It congratulates you on receiving an exclusive benefit, a free 2026 Medicare Health Kit. Sometimes it arrives as a delivery notice for a kit already on its way.

The link passes through unrelated advertising sites, then opens a MyChart-branded survey with a countdown clock and a claim that only a few kits remain. After the survey, the kit is free but there is a small shipping charge. The checkout form collects your name, address, phone number, email and full card details.

No kit arrives. According to MyChart, the small initial charge may be followed by further unauthorised charges.

Epic's own guidance puts the test plainly: MyChart is a place for your medical records. It does not hold giveaways. An email in which MyChart is giving you a product is fake.

One further detail from Epic's warning is useful. The small print signs off as "MyChart Health Network" at an address in Verona, Wisconsin. No such company exists and the address is wrong.

Why health messages work better than bank ones

Most people have learned to pause over a message about money. Very few pause over a message about their health.

An email saying your test results are ready produces a different reaction. If you are waiting on bloodwork, a biopsy, or a scan, the impulse to look is immediate and it overrides caution. The fake chart then escalates that with a warning about critical patterns needing attention.

Fear does the work. By the time the Run command appears, you are not evaluating a website. You are trying to find out whether something is wrong with you.

The one habit that defeats all of it

Never reach your patient portal through a link in a message.

Open the app on your phone, or type your health system's own web address yourself, or use a bookmark you saved. Then sign in and look. If results are genuinely waiting, they will be there.

That single habit works against every version of this, including ones that have not appeared yet, because you are not judging whether an email is real. You are refusing to use the route it offers.

How to tell a real MyChart email from a fake one

If you want to check rather than delete, Epic's own guidance gives the reliable markers.

• Real emails name your healthcare organisation. They come from your own provider or MyChart Central and show that organisation's name. A generic MyChart email with no provider named is a warning sign.
• Check the address after the page loads, not the text of the link. Anything like mychart-epic.com is not MyChart.
• Ask whether it matches your care. One patient spotted a fake because it referenced a health system he had never used. If you do not have an account there, no results can be waiting.
• Nothing genuine has a countdown clock. Medical records do not expire in fifteen minutes.

If you already entered your details

Act in this order. Speed matters most for the first two.

1. Change your MyChart password immediately, from the real app or the real site. Then change it anywhere else you used the same password.
2. Change your email password too. Email is the reset route for every other account you own, so it comes before your bank.
3. Turn on two step login where your health system offers it. Our device settings guide covers how, in a few minutes.
4. Tell your health system. Their privacy or IT team can check for unauthorised access to your record and flag it.

If you ran the command or downloaded the file

1. Disconnect from the internet. Unplug the cable or switch off Wi-Fi.
2. Change your passwords from a different device, not the affected one. Anything typed on a compromised computer can be captured.
3. Run a full scan with Windows Defender or your security software, or take the machine to a technician you found yourself, not one from a pop-up.
4. Watch your bank and card statements for small unfamiliar charges, which are how a card gets tested.

If you paid for a Medicare kit

1. Call your card issuer now and ask them to freeze the card and dispute the charge. Do not wait to see whether more charges appear.
2. Report to the FTC at reportfraud.ftc.gov.
3. If you gave a Medicare number, call 1-800-MEDICARE and tell them it may be compromised, then report it to the Senior Medicare Patrol on 1-877-808-2468.
4. Watch your Medicare statements for the next year for services you never received. Our guide to Medicare card scams covers what to look for.

Anyone aged 60 or over can call the National Elder Fraud Hotline free on 1-833-372-8311. Our page on the first 48 hours covers the bank conversation and the dispute deadlines.

What to tell an older relative

Keep it to one sentence, because that is what survives a frightening email:

Open the app, never the link.

Then add the part that changes behaviour. Tell them that if a message says something urgent about their health, they should call you or their doctor's office rather than clicking anything, and that no real result will disappear while they check.

Check a website before you sign in

If a link or a number came with the message, look it up first.

Check a website or phone number here, free and in about ten seconds.

Related reading

• Fake login pages that steal your one-time code while you watch
• The five scam texts to know in 2026

Sources

• MyChart, Staying safe from scams and fraud, with examples from Epic security investigations, summer 2026
• American Hospital Association, MyChart warns of phishing schemes using fraudulent emails, August 2026
• Healthcare Dive, Health systems warn patients of MyChart phishing scam
• FTC Consumer Advice, How to recognise and avoid phishing scams