MyChart Medicare Kit Scam: What Users Should Do

Updated September 1, 2026

The MyChart Medicare Kit scam uses fraudulent emails and text messages to offer a fake health package or reward. Pennsylvania Attorney General Dave Sunday warned consumers on August 28, 2026 that no such MyChart program exists. The phishing links can lead to fake websites designed to collect login credentials, personal information or payment-card details.

What Happened

The Pennsylvania Office of Attorney General warned MyChart users on August 28 about fraudulent emails and text messages offering a “MyChart Medicare Kit.”

The Attorney General’s office said no such program or reward exists. The messages are designed to persuade recipients to click malicious links and surrender passwords or personal information.

MyChart itself has documented similar phishing campaigns, including fake medical-result notices and fake “Medicare Kit” giveaways.

Penn Medicine and Geisinger have separately warned patients about the campaign and described it as affecting MyChart users across the United States.

How the MyChart Medicare Kit Scam Works

The wording can vary. One message may say a Medicare kit is waiting for delivery. Another may advertise a “Senior Health Package” or say the recipient was selected for a special benefit.

The official MyChart fraud guidance documents a version in which the link first redirects through unrelated advertising websites.

The user then reaches a page displaying the MyChart name or logo, a short survey, a countdown timer and claims that only a few kits remain.

After presenting the kit as free, the site asks the victim to pay a shipping charge. In MyChart’s documented example, the page requested $13.77 and asked for a name, email address, phone number, mailing address and payment-card information.

The exact amount, wording and website can change. A different price does not make an offer legitimate.

What MyChart Says About Giveaways and Passwords

MyChart states that it does not run giveaways.

It also says Epic and participating health organizations will not ask users to disclose their MyChart password or verification codes by email, text message or phone.

The safest place to enter MyChart credentials is the known MyChart website or app associated with the user’s healthcare organization.

What the Warning Does — and Does Not — Establish

The MyChart Medicare Kit scam warning confirms an active impersonation campaign. It does not mean every real message mentioning MyChart is fraudulent.

Healthcare providers can send legitimate MyChart notifications. If a message raises concern, avoid its link and instead open the provider’s known app or manually visit the provider’s official website.

The alerts also do not establish that MyChart, Epic or every participating healthcare organization suffered a data breach.

Receiving a phishing email by itself does not prove that a medical record was accessed. The risk depends on what the recipient clicked, entered, downloaded or approved.

What to Do Based on What You Exposed

If you only received the message

Do not reply, click the link or use an unsubscribe button inside the suspicious message.

Mark the email or text as spam or phishing, then delete it. The FTC says suspicious text messages can also be forwarded to 7726, which spells SPAM.

If you clicked but entered nothing

Close the page and access MyChart through the normal app or provider website.

MyChart’s guidance says users who clicked but did not enter information are most likely fine. If a file downloaded or software was run, update security software and scan the device before using it for sensitive accounts.

If you entered a MyChart password or verification code

Open the legitimate MyChart account directly and change the password.

If that password was reused elsewhere, change it on those accounts too. Review the email address and phone number stored in the account and contact the healthcare organization’s official help desk.

Enable two-step verification when available. MyChart supports additional verification to protect accounts even when a password has been exposed.

If you entered card or bank information

Contact the card issuer or bank using the number printed on the card, statement or official banking app.

Tell the institution that payment information was entered on a phishing website and follow its fraud instructions.

MyChart’s own guidance recommends asking for a replacement card when card information was entered into the fake Medicare Kit site rather than focusing only on the first small charge.

If you shared a Medicare Number

Review Medicare claims and statements for equipment or services you did not receive.

The official Medicare fraud and abuse page tells beneficiaries who suspect fraud to call 1-800-MEDICARE (1-800-633-4227) or use Medicare’s reporting options.

If a Social Security number, financial account number or other sensitive identity information was exposed, IdentityTheft.gov can provide recovery steps based on the information involved.

How to Verify a MyChart Message

1. Do not use the message link. Open the MyChart app or type the healthcare organization’s known web address yourself.
2. Check the full sender address. Display names and logos can be copied. Look for misspellings, unrelated domains or added words.
3. Check the authenticated portal. A legitimate appointment, bill, result or provider message should normally be visible after you sign in through the real service.
4. Call the provider independently. Use the phone number on the provider’s official website, statement or insurance information.
5. Reject supposed MyChart giveaways. MyChart says it does not run giveaways. Requests for shipping payments or countdown-driven rewards are major warning signs.

Official Reporting Resources

Pennsylvania residents can use the Pennsylvania Attorney General’s scam complaint service.

Save the message, sender address, phone number, URL and screenshots before deleting the scam. Do not include passwords, complete payment-card numbers or other sensitive credentials in a public complaint.

The FTC’s phishing guidance recommends avoiding unexpected links and independently contacting the organization being impersonated.

Suspected fraud can also be reported through ReportFraud.ftc.gov. Filing a report does not guarantee reimbursement or an individual investigation.

Bottom Line

The MyChart Medicare Kit scam is a phishing campaign built around a nonexistent health giveaway.

Do not use the link, pay a shipping fee or provide login credentials because an email or text uses the MyChart name.

If information was already entered, match the response to what was exposed: secure the MyChart account, contact the financial institution for payment information, review Medicare claims when Medicare data was shared and use official identity-theft recovery tools when necessary.