What should I do if this happened to me?

Do not click the link. Go directly to your health system's website by typing the address yourself or using a saved bookmark • If you already clicked and entered your MyChart password, change it immediately at your health system's real portal • If you entered a verification code, contact your health system's patient portal support line to revoke active sessions • If you provided a card number, contact your bank to dispute the charge and request a new card • Call your health system's main number (found on your insurance card or an old bill) to confirm whether any alert or kit offer is genuine • If you installed any 'support' or 'server' or 'refund app' or remote-access app at the scammer's request (AnyDesk, TeamViewer, Quick Support, etc.), run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it. • Report to the FTC at https://reportfraud.ftc.gov and the FBI's IC3 at https://www.ic3.gov.

Fake "MyChart Medicare Kit" email or text steals your health portal login and card details

Q: Is this a scam?

Yes. This is a documented scam pattern. Scam emails/texts impersonate MyChart with two pretexts: a fake "Medicare Kit" and frightening fake test results. The kit lure harvests credentials or card details; the test-results lure tricks victims into running malware. 41+ health systems warned patients by Sep 2026.

Scam emails/texts impersonate MyChart with two pretexts: a fake "Medicare Kit" and frightening fake test results. The kit lure harvests credentials or card details; the test-results lure tricks victims into running malware. 41+ health systems warned patients by Sep 2026.

Also known as: MyChart Medicare Kit scam, fake Senior Health Package email, MyChart phishing scam, Medicare free kit email scam

Already happened to you? Do this in the next few minutes

1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.

2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.

3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.

! If you installed any "support", "server", "refund", or remote-access app at their request (AnyDesk, TeamViewer, Quick Support, etc.): disconnect the internet now, then run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.

What to do right now

1 Do not click the link. Go directly to your health system's website by typing the address yourself or using a saved bookmark

2 If you already clicked and entered your MyChart password, change it immediately at your health system's real portal

3 If you entered a verification code, contact your health system's patient portal support line to revoke active sessions

4 If you provided a card number, contact your bank to dispute the charge and request a new card

5 Call your health system's main number (found on your insurance card or an old bill) to confirm whether any alert or kit offer is genuine

6 If you installed any 'support' or 'server' or 'refund app' or remote-access app at the scammer's request (AnyDesk, TeamViewer, Quick Support, etc.), run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.

7 Report to the FTC at https://reportfraud.ftc.gov and the FBI's IC3 at https://www.ic3.gov.

Red flags

⚠ The email or text was unsolicited — no one requested a kit, and health systems never mail free supply kits via email or text

⚠ The sender domain does not match your health system's official domain (e.g., not @pennmedicine.org or @uchealth.org)

⚠ The link goes to a URL that is not your health system's actual website — check the address bar before entering anything

⚠ The page asks for your MyChart username and password, or a verification code — MyChart never requests credentials via external links

⚠ The survey or checkout page asks for a credit or debit card 'for a small shipping fee' — the Medicare Kit does not exist; no kit is ever delivered

Scammers chose MyChart because it is the patient portal used by hundreds of U.S. health systems, meaning one convincing template reaches millions of potential victims across dozens of brands. The “Medicare Kit” pretext targets older patients who regularly use the portal to manage prescriptions and test results — and who may not question an unexpected health benefit.

If you entered your credentials: change your MyChart password immediately from your health system’s real website, then call the patient portal support line to check whether any sessions were opened by an unauthorized device.

Known variants

Fake test results malware: email claims alarming lab results await. Clicking 'Unlock Full Report' downloads a Windows .exe, or a ClickFix technique (Win+R + clipboard paste) silently runs a malware installer — typically an infostealer exfiltrating saved passwords and banking credentials.

Last seen: 9/30/2026

Already happened to you? Do this in the next few minutes

What to do right now

Red flags

Known variants

Sources