Help NowStart Practice

Scam alert

An Email About a MyChart Medicare Kit or Test Results

Published · Pennsylvania and nationwide · attorneygeneral.gov · Arrives by an email or a text message

The short answer

There is no MyChart Medicare Kit. An email or text offering one, or announcing test results you were not expecting, is a copy of the patient portal built to collect the sign-in you use for your own medical records. Pennsylvania's Attorney General warned about this campaign in August 2026, and the portal's maker has confirmed the messages are fraudulent while the portal itself has not been broken into. The check that works is the same one for any account message: do not use the link, open the portal through the app you already have or by typing your provider's address yourself, and see whether anything is actually waiting there.

What is happening

The Pennsylvania Office of Attorney General said in August 2026 that people were receiving emails and texts impersonating MyChart, the patient portal many hospitals and clinics use, telling them they could claim a reward in the form of a Medicare kit. No such program exists. September 2026 reporting described the same campaign continuing with a second lure: a notice that new medical test results are ready to view. Both versions lead to a copied sign-in page that collects a portal username and password, and some versions ask for insurance or Medicare details, a Social Security number, or a verification code as well. A portal sign-in is worth taking because it opens a full medical record, and because the same password is often used somewhere else. Health systems and the portal's maker have both said the portal itself was not breached — the messages simply copy how it looks.

How to recognize it

  • The message offers a Medicare kit, a senior health package, or a reward through a patient portal. Portals do not hand out kits.
  • It announces test results or a new message, but you were not expecting either, and your clinic has not mentioned it.
  • The sender address does not belong to your own hospital or clinic, or the wording is slightly off from what the portal normally sends.
  • You are asked for a username and password, a Medicare or insurance number, or a verification code after following the link.
  • There is an attachment or a download described as a medical report.

What to do instead

  1. Do not use the link. Open the portal through the app on your phone or by typing your provider's web address yourself.
  2. If real test results are waiting, they will be there when you sign in the way you normally do.
  3. Call your clinic on the number from a past letter, a bill, or its official website if you want to check whether a message was genuine.
  4. Never share a verification code, a portal password, or a Medicare number in reply to an email or text.
  5. Delete the message rather than using its unsubscribe button, which the Attorney General's office notes can itself be part of the message.

If it already happened

Responding to one of these is common and understandable. These steps are what people usually take next.

  1. Change your patient portal password from the app or the address you type yourself, and change it anywhere else you used the same one.
  2. Turn on two-step verification for the portal if it offers it, and look at recent activity in the account.
  3. If you shared a Medicare number, insurance details, or a Social Security number, use IdentityTheft.gov and tell your plan so they can watch for unfamiliar claims.
  4. Report it at ReportFraud.ftc.gov. In Pennsylvania, the Attorney General's office takes reports at 1-800-441-2555.
Open Help Now

Common questions

Is the MyChart Medicare Kit a real thing?
No. Pennsylvania's Attorney General said plainly that no such program exists. A patient portal is a place to read your records and message your clinic; it does not send out kits, rewards, or benefit packages.
Was the patient portal itself hacked?
The health systems and the portal's maker have said it was not. The messages copy the portal's look and send people to a separate page, which is why the safer step is to open the portal the way you normally do rather than judging the message.
How would I know a test-results notice is not from my clinic?
You often cannot tell from the message alone, and that is the point of copying a familiar one. Instead of deciding from the email, open the portal directly. If results are ready, they are in there, and if nothing is waiting, the message answered itself.

Practice this safely

Practice opening a patient portal through its own app instead of a link in a message about results.

Every story is fictional. There is no timer, no score, and no real message, payment, or account.

Start the four-story practice

Tell someone

Copy a short note you can paste into a text or email. It names the scam, the next step, and this page. Nothing is sent from this site.

An Email About a MyChart Medicare Kit or Test Results

There is no MyChart Medicare Kit. An email or text offering one, or announcing test results you were not expecting, is a copy of the patient portal built to collect the sign-in you use for your own medical records. Pennsylvania's Attorney General warned about this campaign in August 2026, and the portal's maker has confirmed the messages are fraudulent while the portal itself has not been broken into. The check that works is the same one for any account message: do not use the link, open the portal through the app you already have or by typing your provider's address yourself, and see whether anything is actually waiting there.

Read the full alert: https://endscamsproject.com/latest-scams/mychart-medicare-kit-phishing

Where this comes from

These links open the published sources in a new tab. The destination is shown before you open it.

The full guide on this

More recent alerts

This alert provides general educational information drawn from the sources above. It cannot determine whether a specific message you received is genuine, investigate an incident, or promise recovery or reimbursement.