BBB Warns of Phishing Scam Targeting MyChart Medical Platform Users

How the Scam Works

MyChart is a patient portal operated by Epic, allowing users to schedule appointments, view test results, and manage their medical information. Scammers are exploiting the platform's trusted reputation by sending fraudulent emails and text messages impersonating official MyChart communications.

These deceptive messages offer enticing rewards, such as "exclusive gift card giveaways" or "special rewards programs." Fraudsters copy MyChart's official logos and branding to increase the message's credibility.

The Attack Sequence

1. Recipient receives a fake email or SMS promoting a limited-time giveaway or reward program
2. Clicking the link directs the victim to a spoofed login page designed to mimic the authentic MyChart interface
3. The fake page requests MyChart login credentials (username and password)
4. Alternatively, the page may ask for insurance details, driver's license numbers, or payment for "shipping fees"
5. Once scammers obtain this information, they can access patient medical records or commit identity theft

Red Flags and Warning Signs

Legitimate MyChart NEVER:

• Requests passwords or login credentials via email or text message
• Conducts giveaways or reward promotions
• Asks for insurance details or personal identification through SMS
• Requests payment for shipping or processing fees

Suspicious Indicators:

• Sender email address or phone number doesn't match official MyChart contact information
• The link URL doesn't use MyChart's official domain (e.g., mychart.epic.com)
• Poor grammar, typos, or awkward phrasing
• Urgent language creating pressure to act immediately
• Unusual page design or unfamiliar layout
• Generic greetings ("Dear User" instead of your actual name)

How to Protect Yourself

1. Access MyChart Safely

   • Never click links in unsolicited emails or text messages
   • Type the official MyChart URL directly into your browser
   • Use the official MyChart mobile app downloaded from legitimate app stores

2. Verify Communications Independently

   • If uncertain about a message, contact your healthcare provider directly using a phone number from your insurance card or previous bills—not from the suspicious message
   • Ask the provider's staff whether they sent the communication

3. Strengthen Your Account Security

   • Create a strong, unique password for MyChart
   • Never reuse this password on other accounts
   • Enable two-factor authentication if available
   • Update your password regularly

4. Examine Message Details

   • Check the sender's email domain (the part after the @)
   • Verify the URL in the browser address bar matches the official MyChart domain
   • Hover over links to preview the actual URL before clicking

If You Become a Victim

• Immediately change your MyChart password
• Contact your healthcare provider and notify them of the breach
• Contact your credit card company and bank to monitor for fraudulent charges
• File a complaint with the Better Business Bureau at bbb.org
• Review credit card and bank statements for unauthorized transactions
• Consider enrolling in identity theft protection or credit monitoring services
• Report the scam to the Federal Trade Commission (FTC) at reportfraud.ftc.gov

Important Clarification

MyChart's parent company, Epic, has confirmed that the platform has not been hacked and does not conduct giveaways. The scam exploits users' trust in legitimate platforms and relies on social engineering—convincing people to voluntarily surrender sensitive information.