Fake patient portal scam can steal your login and infect your PC

If you have ever checked a lab result or sent your doctor a message online, you may already know MyChart. It is a widely used patient portal from Epic that hospitals and medical practices use to give patients online access to health information and care teams.

That growing reliance on patient portals caught the attention of Mary M. She recently wrote to us after hearing from her primary care physician, or PCP, and several specialists about moving more of their patient communication online.

"I just got a lot of updates from my PCP and specialist doctors saying they are moving toward this, but they are already compromised!! I think this is a topic for you!"

Mary raised a concern many patients may share as they hear about scams targeting MyChart users. There is an important point to clear up. The warnings reviewed here describe criminals impersonating MyChart through phishing campaigns. They do not report a breach of the MyChart platform itself.

MEDICARE AND SOCIAL SECURITY SCAMS: WARNING SIGNS AND TIPS

Epic has documented scams that copy the MyChart experience to steal login details. One version can also push malware onto Windows computers. Here's how the scam works and how to protect yourself before a fake MyChart alert catches you off guard.

Missed CyberGuy LIVE? Watch the Protect Your Money replay

Our free CyberGuy LIVE class, Protect Your Money From Todays Biggest Threats, has ended, but you can still watch the full replay and download our financial protection checklist. Kurt "CyberGuy" Knutsson walks you through five simple ways to help defend yourself against AI scams, fraud, identity theft and financial hacks. Youll learn how to set up bank alerts, strengthen your account logins, protect your phone number, freeze your credit and help secure your retirement savings against unauthorized transfers. No technical experience is needed.

Get the free replay and checklist now at CyberGuyLive.com

This one caught my attention because the warnings are coming from several credible sources at nearly the same time. Penn Medicine said on Aug. 26, 2026, that it was seeing a nationwide scam involving emails and text messages made to look like they came from MyChart. Then, on Aug. 28, Pennsylvania Attorney General Dave Sunday warned consumers about another MyChart impersonation scam involving a bogus Medicare Kit.

Epic has also detailed two phishing campaigns its security team investigated this summer. Put all of that together, and you can see why I want you to be especially careful with unexpected MyChart messages right now.

The tricky part is that many of us are already used to getting legitimate emails about appointments or new test results. A fake MyChart alert can land right alongside the real ones, and scammers are counting on you reacting before you take a closer look.

One campaign starts with a message that looks routine. Epic says the email carries MyChart branding and tells the recipient, "Your recent results are ready."

The button inside the email leads to a fake sign-in page. According to Epic, scammers copied code from the real MyChart site, which helps the page look convincing.

The bogus page asks for an email address and password. If you enter them, the scammers can capture those credentials. Then the attack gets more aggressive.

After the victim signs in, the fake site displays a made-up medica