Is the MyChart Medicare Kit Email a Scam? How to Tell

Is the MyChart Medicare Kit email a scam? How to tell and what to do is a protective process for identifying fraudulent phishing emails that impersonate the official MyChart patient portal, avoiding fake shipping fees, and securing your medical and financial information. Navigating health portal alerts safely requires knowing exactly what your provider will and will not send to your inbox.

Is the MyChart Medicare Kit email a scam? How to tell and what to do?

The short answer is yes, this email is a widespread phishing scam designed to steal your credentials and payment information. You can tell it is fake by looking at the sender address, the urgent tone, and the request for payment.

Protecting your medical information starts with recognizing the difference between a routine portal notification and a sophisticated attempt to harvest your personal details. Scammers know that patients trust their healthcare providers, and they exploit that trust by mimicking the branding and language of platforms like Epic's MyChart. When an email arrives offering a free medical product in exchange for a survey or a small shipping fee, it is designed to create a sense of urgency that bypasses your normal caution.

You can protect yourself by never clicking links in unsolicited emails. If you need to check a notification, you should open a new browser window, type in your healthcare provider's website, or use the official MyChart application on your mobile device. Taking these extra steps ensures that you are interacting directly with your health system, rather than a spoofed login page hosted by cybercriminals. You can always run a free verification tool check on unknown sender domains before interacting.

How does the fake MyChart Medicare Kit email actually work?

The scam begins when you receive an email or text message that appears to come from MyChart or your local health system. The message typically offers a free Senior Health Package or medical kit.

According to the Pennsylvania Office of Attorney General, the fraudulent messages use offers such as a free MyChart Medicare Kit or Senior Health Package and direct recipients to complete a survey before requesting personal or payment information. The campaign has been reported through both email and text messages, expanding beyond a single delivery channel. Once a victim clicks the link, they are taken to a webpage that closely resembles the actual MyChart login screen.

After entering their username and password, the victim is often asked to fill out a brief survey about their health or Medicare experience. Finally, the site requests credit card information to cover a small, nominal shipping fee for the nonexistent kit. This is the primary trap. According to a Yahoo report, reported victims entered payment-card information after following the offer, and some reported being charged both the advertised shipping fee and an additional charge from another company.

The Federal Trade Commission had received 166 complaints referencing MyChart over the previous five years, with several complaints associated with the MyChart Medicare Kit phishing campaign. Understanding these mechanics is crucial. If you understand how to verify a financial company or health entity, you can spot these traps before entering any data.

Sources: Official MyChart guidelines, Pennsylvania Office of Attorney General, Becker's Hospital Review.

Why do scammers want your Medicare Beneficiary Identifier?

Scammers want your Medicare number to commit medical identity theft, which can be far more damaging and difficult to resolve than traditional credit card fraud.

Your Medicare Beneficiary Identifier (MBI) is a high-value target on the dark web. Unlike a credit card, which you can easily cancel and replace if you notice unauthorized charges, a compromised Medicare number can be used repeatedly to bill the government for fraudulent services, durable medical equipment, or prescription drugs. This activity exhausts your lifetime medical benefits and clutters your official health record with inaccurate diagnoses and treatments, which can affect the care you receive in the future.

"A compromised Medicare number can lead to thousands of dollars in fraudulent billing, potentially exhausting your benefits and creating dangerous inaccuracies in your permanent medical record."

The fake websites may target MyChart credentials, birth dates, addresses, medical information, and payment-card details. If cybercriminals gain access to your actual MyChart account by stealing your password, they can view your entire medical history, current prescriptions, and upcoming appointments. This wealth of personal data makes it easy for them to impersonate you to other institutions or craft highly targeted secondary scams. This is why knowing identity theft defense is vital for older adults.

Furthermore, medical identity theft can go undetected for months or even years. Many patients only discover the fraud when they receive a Medicare Summary Notice detailing services they never received, or when they are denied a legitimate medical device because their records show they already received one. Protecting your portal login is the first line of defense against this systemic abuse.

What are the key red flags to look for?

The most prominent red flag is an unsolicited offer for a free product. Healthcare portals are used for secure communication, test results, and billing, not for marketing giveaways.

MyChart states that it does not conduct giveaways and that an email claiming MyChart is giving away a product is fraudulent, according to MyChart. If you see an email with the subject line “Your MyChart Medicare Kit Awaits!” or “Senior Health Package,” you are looking at a scam. Another major warning sign is the sender's email address. Scammers often use addresses that look vaguely official but are actually hosted on free webmail services or domains that mimic the real ones with slight typos (e.g., @mychart-support-team.com instead of @mychart.org).

Urgency is another classic tactic. Scammers try to panic you into acting quickly by claiming the offer expires soon or that your account will be suspended if you do not verify your information. They use this pressure to make you skip your normal verification checks. If an email creates a sense of immediate panic or excitement, slow down. You can learn more about these methods in our guide on high-pressure tactics.

Finally, any request for payment information in exchange for a "free" item is a definitive scam indicator. The scam messages may request a shipping fee even though the advertised Medicare kit does not exist. Legitimate organizations do not ask you to pay shipping on unsolicited free gifts. If you encounter these red flags, do not interact with the message. For more context, read our article on Amazon refund text scams, which use similar psychological tricks.

What to do if you received the email but did not click?

If you received the fraudulent email but did not click any links or download any attachments, your information is currently safe. You simply need to delete the message.

Do not reply to the sender, and do not attempt to click the "unsubscribe" link at the bottom of the email. Clicking unsubscribe often confirms to the scammers that your email address is active and monitored, which will lead to an increase in spam and future phishing attempts. Simply mark the email as spam or junk in your email client, which helps your provider's filters block similar messages in the future, and then move it to your trash folder.

Virtua Health warned patients that messages offering a MyChart Medicare Kit or Senior Health Package were not sent by MyChart, Epic, Virtua, or other health systems, according to Virtua Health. The organization advised deleting the messages without opening attachments, clicking links, or selecting unsubscribe. This is the safest and most effective response.

If you are worried that you might have missed a legitimate communication from your doctor amid the spam, you can always check your status safely. Open your web browser, navigate directly to your healthcare provider's official website, and log into your patient portal from there. If there is a genuine message, test result, or billing notice waiting for you, it will be visible in your secure inbox.

You can also read our guide on Social Security scams to see how government impersonators operate similarly.

What should you do if you clicked a link or shared information?

If you clicked a link and entered your MyChart password, credit card number, or Medicare details, you must take immediate steps to secure your accounts and monitor your credit.

First, if you provided your MyChart password, go directly to the official MyChart app or your provider's website and change your password immediately. If you use that same password for other online accounts—such as your bank, email, or retirement portal—you must change the password on those accounts as well. Cybercriminals often use software to automatically test stolen credentials across thousands of popular websites to see where else they can gain access.

Enabling two-factor authentication on your patient portal will add a crucial layer of security.

Second, if you entered your credit card or debit card information to pay the fake shipping fee, contact your bank or credit card issuer immediately. Use the phone number on the back of your card. Report the fraudulent charge, cancel the compromised card, and request a replacement. As noted earlier, victims often face secondary, unauthorized charges. Acting quickly can prevent the scammers from draining your account. Review our scam recovery steps for a complete checklist of immediate actions.

Finally, if you provided your Medicare Beneficiary Identifier (MBI) or Social Security Number, you are at risk for medical identity theft. Contact Medicare at 1-800-MEDICARE (1-800-633-4227) to report the compromise and request a new card. You should also place a fraud alert on your credit file with one of the three major credit bureaus (Equifax, Experian, or TransUnion) to make it harder for scammers to open new lines of credit in your name.

Read our guide on government agent scams for more details on protecting your identity.

How can you safely verify MyChart messages and notifications?

The safest way to verify a MyChart notification is to ignore the email entirely and log in to your account through the official mobile application or a bookmarked web browser link.

Cybercriminals are exceptionally skilled at creating emails that perfectly mimic the fonts, logos, and formatting of legitimate organizations. They can even spoof the "From" name so that your phone displays "MyChart Notification" or the name of your specific hospital. Because these visual cues are no longer reliable indicators of trust, you must change your behavior. Never rely on an email link to access secure medical or financial information.

"The only way to guarantee you are accessing your real medical portal is to type the web address yourself or use the official mobile app. Never let an email link do the driving for you."

Instead, establish a secure routine. If you receive an alert, close your email client. Open your official MyChart app on your smartphone, or open a web browser and type in your provider's exact web address (such as www.providername.org). If you have a legitimate message waiting for you, a test result to review, or a bill to pay, it will be prominently displayed on your portal dashboard once you log in securely. This simple habit completely neutralizes the threat of phishing links. You can also reference our guidelines on how to slow down before clicking unexpected links.

Are there other MyChart scams to be aware of?

Yes, cybercriminals frequently pivot their tactics, using the MyChart brand to send fake text messages about urgent test results or overdue medical bills.

While the Medicare Kit email is currently a prominent campaign, scammers also use SMS text messages (a tactic known as smishing) to target patients. You might receive a text stating, "MyChart Alert: Your recent lab results require immediate review," followed by a malicious link. The goal is exactly the same: to cause panic and rush you into clicking a link that leads to a fake login page where your credentials will be stolen.

Epic, the company behind MyChart, said the messages are an attempt to trick users into responding to fraudulent communications and that MyChart itself has not been compromised. The underlying software remains secure; the vulnerability lies in human psychology. Scammers rely on your natural anxiety about your health to bypass your logical defenses. If you receive a text message claiming to be from your health portal, do not tap the link.

Just like with email, log in directly via the official app.

Furthermore, be wary of any unexpected phone calls claiming to be from MyChart support or your hospital's IT department asking you to verify your password or Medicare number over the phone. Official support teams will never call you and ask for your password. If you receive such a call, hang up immediately and call your hospital's main switchboard to report the incident. For more examples of phone-based fraud, see our article on Medicare scam calls.

How do you report a MyChart phishing email to authorities?

Reporting phishing emails helps authorities track cybercriminal infrastructure, issue public warnings, and work with internet service providers to take down fraudulent websites.

If you encounter the MyChart Medicare Kit scam, you should report it to several key organizations. First, forward the suspicious email to the Anti-Phishing Working Group at reportphishing@apwg.org. Next, file a report with the Federal Trade Commission (FTC) at ReportFraud.ftc.gov. The FTC uses these reports to track fraud trends and build cases.

If you gave out your Medicare number, also call Medicare at 1-800-MEDICARE (1-800-633-4227) to report it.

You should also notify your healthcare provider. Many hospitals have dedicated security teams that monitor for campaigns targeting their patients. By alerting them, you allow them to send out warnings to other patients and take technical steps to block the malicious domains from reaching their networks. Check your hospital's official website for a designated abuse or security contact email address. For a complete walkthrough of the reporting process, consult our guide on how to report a financial scam.

How does medical identity theft impact your long-term care?

Medical identity theft can corrupt your official health records, leading to incorrect medical decisions by future providers and exhausting your lifetime benefit caps.

When cybercriminals use your stolen Medicare number or MyChart credentials, they aren't just stealing money; they are creating a fictional medical history under your name. A scammer might use your identity to obtain expensive prescription drugs, undergo medical procedures, or secure durable medical equipment like wheelchairs or CPAP machines. The bills for these services are submitted to Medicare or your private insurance.

The long-term consequences are severe. If you legitimately need a specific medical device in the future, Medicare may deny your claim because their records show you already received one. Worse, if the scammer's blood type, allergies, or chronic conditions are inadvertently mixed into your electronic health record, emergency room doctors might make life-threatening treatment decisions based on false information. Protecting your MyChart login is not just about financial security; it is a critical component of your physical safety.

If you suspect you are a victim of medical identity theft, request a complete copy of your medical records from every provider you visit. Review them carefully for any diagnoses, treatments, or prescriptions you do not recognize. If you find errors, you must work with each provider's privacy officer to have the fraudulent entries removed from your permanent file. You can also read our coverage on phantom hacker scams to see how data breaches escalate.

Conclusion

The MyChart Medicare Kit email is a sophisticated phishing attempt designed to exploit the trust patients place in their healthcare providers. By understanding the mechanics of the scam, recognizing the red flags, and knowing how to safely verify your portal notifications, you can protect your medical identity and financial information.

Remember the fundamental rule: legitimate healthcare organizations do not offer unsolicited free gifts in exchange for survey participation or shipping fees. If an email creates a sense of urgency or requests payment information for a reward, it is a scam. Never click links in unexpected emails. Instead, build a habit of logging into your patient portal directly through the official mobile application or a bookmarked web browser link.

If you have already clicked a link or shared information, act quickly. Change your passwords, contact your bank, and notify Medicare to mitigate the damage. Reporting the scam to authorities like the FTC helps protect others from falling victim to the same tactics. Stay vigilant, trust your instincts, and always verify before you share sensitive data.