MyChart Phishing Scam: How to Spot Fake Health Portal Messages
Scammers impersonate MyChart and health systems to steal patient logins. Learn how the MyChart phishing scam works, the warning signs, and what to do.
MyChart Phishing Scam: How to Spot Fake Health Portal Messages
MyChart is a patient portal used by many US health systems, so messages that appear to come from MyChart feel trustworthy — which is exactly why scammers impersonate it. A MyChart phishing scam sends you a fake text or email claiming there's a problem with your account, a bill, or test results, and directs you to a look-alike login page that steals your username and password.
How the scam works
- You receive a text or email that looks like it's from MyChart or your hospital.
- It claims your account is locked, a payment failed, or there's an urgent message about your health.
- It includes a link to "verify" or "log in."
- The link goes to a fake page that captures your credentials.
Why it's dangerous
A health portal login can expose sensitive medical history, insurance details, and personal information. If you reuse the same password elsewhere, scammers can also try it on your email, bank, and other accounts.
Warning signs
- A link that doesn't point to your health system's real domain (e.g.
mychart.fake-login.cominstead of your hospital's portal). - Urgency — "your account will be closed" or "action required immediately."
- A request for your password, Social Security number, or insurance details by message.
- A message from a health system you're not a patient of.
How to verify safely
- Don't click the link. Open your MyChart app directly or type your hospital's portal address yourself.
- Check the sender of the text or email — does it match your health system's real domain?
- Call the number on the back of your insurance card or your clinic's official number if you're unsure.
- You can also paste the message or link into the GoCheckAI checker for a risk score.
If you clicked or logged in
- Change your MyChart password immediately from a trusted device.
- Change the password on any account that reuses it — especially email and banking.
- Enable two-factor authentication on your portal if available.
- Contact your health system to flag the compromise.
- Report the phishing to the FTC (US) or CAFC (Canada). See country guides.
Get a personalized action plan and read how to recognize a phishing message and phishing scam.
Related guides
Important
This article is for general informational purposes only and is not legal, financial, or professional advice. GoCheckAI is an independent platform and is not affiliated with any government agency. Always report crime to official authorities in your country.
High Risk of Recovery Scam
Scam victims are often targeted again by fake “recovery agents.”
- Anyone claiming “We can recover your money for a small upfront fee” is almost certainly a scammer.
- Recovery is never guaranteed. No legitimate service charges an upfront fee to retrieve stolen funds.
- Scammers buy victim lists — expect fake “hackers”, “officials”, and “lawyers” to contact you.