Texts and email

Is the free MyChart Medicare kit real? How the email and text scam works

Updated 28 September 2026

Since midsummer 2026, emails and texts carrying the MyChart name and logo have told patients they qualify for a free Medicare kit. Epic, which makes the patient portal, warned about scammers using the MyChart name on July 27, and by August 27 the trade publication Becker's Hospital Review had listed 41 health systems that had warned patients or whose patients reported getting the messages. There is no sign MyChart itself was hacked: Epic puts the rise down to scammers exploiting a popular brand, not a security problem. With Medicare Open Enrollment starting on October 15, the timing suits them.

Is the MyChart Medicare kit real?

No. Epic's scam help page on MyChart.org is direct: MyChart is a place for your medical records, and it does not hold giveaways. Any message in which "MyChart" offers you a product, a prize or a package is fake, whatever the offer is called this week.

Nothing public suggests MyChart itself was broken into. Epic's July 27 news post put the rise in scam attempts down to scammers taking advantage of the MyChart brand's popularity, not a security problem, and said patients can keep using MyChart as normal. Virtua Health and GBMC HealthCare told patients there was no sign MyChart had been hacked, and Summa Health said plainly that MyChart itself had not been hacked. The HIPAA Journal reported that the attacker had not been identified and that the email addresses were likely obtained from an earlier data breach. A breach is only one way scammers get contact details. Data brokers and public records supply them too, as our page on how scammers got your number explains.

What does the message say?

The wording changes constantly. Epic says real patients reported several versions within a two-week period, and health systems have quoted others:

• "You've been selected," with congratulations on an exclusive benefit, a "2026 Medicare Health Kit" (Epic).
• A delivery notice for a kit supposedly already on its way, or a thank-you letter to a valued member (Epic).
• The subject line "Your MyChart Medicare Kit Awaits!" (reported by Southeast Health in Alabama and Virtua Health in New Jersey).
• A "2026 MyChart Senior Health Package" (Summa Health in Ohio, Cass Health in Iowa and SGMC Health in Georgia).
• A "unique opportunity" to receive a "completely new Medicare Kit" (UC Davis Health, which separately warns that scam emails may show "MyChartTeams" in the "from" line).
• Buttons labeled "Claim Your Reward," "Start Survey" or "Claim Kit Now" (Baptist Memorial Health Care).
• An email quoted from an FTC complaint and published by Gizmodo, offering the "official MyChart Medicare Home Health Kit" and warning that unclaimed packages expire within 48 hours.

GBMC HealthCare in Baltimore, SGMC Health and Baptist Memorial all say the same offer arrives by text message as well as email. On August 28, the Pennsylvania Attorney General warned that no such program or reward exists.

Two details give the email away if you look. In the example Epic published, the footer names the sender as "MyChart Health Network" of Verona, Wisconsin, a company Epic says does not exist. And a link that displays mychart.org can point somewhere else entirely: hover over it and the real destination appears.

What happens if you click the link?

Epic's security team traced the whole thing from the email to the card form. Here is what you would see, in order:

1. A chain of redirects. The link passes through several unrelated advertising sites before the scam page opens. Each person who gets the email is sent to a different address, which Epic says is part of why these scams are hard to shut down.
2. A survey with a clock. It carries the MyChart logo and today's date, a few simple questions about how you use MyChart, and a banner saying more than $300,000 worth of MyChart products has already been handed out. A countdown gives you six minutes. Epic points out that nothing real expires in six minutes and nobody reads the answers.
3. The reward. The kit is shown as a $149 value, now $0, with only a few left in stock. After you click to claim it, a pop-up says one is reserved for you. Epic warns that the "5 remaining" and "reserved for you" messages are made up, and that they shift each time the page is refreshed.
4. The switch. Now there is a price: $13.77 for shipping. First comes a form for your name, email, phone number and full mailing address, with a badge promising a secure encrypted connection. The encryption only protects your details on their way to the scammer, and Epic says the scammers keep everything typed into this form even if you close the page before paying.
5. The card page. A final page, on yet another unrelated site, asks for your card number, expiration date and three-digit security code, and offers a $2.87 discount for paying with Mastercard.
6. Nothing arrives. No kit ships. Epic says the amount is often set low deliberately, so people tend to overlook it until it comes back or gets bigger.

The amounts vary between versions. One Indiana complaint to the FTC, published by Gizmodo, described a $9.95 shipping charge followed by an attempted $29.95 charge. The shape stays the same: free, then "just cover shipping," as Epic puts it, then your card.

The details you typed are worth something to the scammers even if no card charge ever goes through. Epic says they sell that bundle of name, address, phone and email, and use it for later scam calls and mail. Be ready for a call from someone claiming to be Medicare, and read our page on Medicare card scam calls before it comes.

What is the fake lab results version?

The Medicare kit is after your card. A second MyChart scam that Epic documented is after your computer.

It starts with an email saying "Your recent results are ready," with the MyChart logo and a sign-in button. The button opens a copy of a MyChart sign-in page at a lookalike address, such as mychart-epic[.]com or my-chart[.]org in Epic's examples, which asks for your email and then your password. After you "sign in," a made-up chart appears, and a pop-up claims an "AI-powered review" has spotted something critical in your blood work and urges you to act now.

Then comes the trap. A "Human Verification Required" pop-up says a code has been copied for you and tells you to hold the Windows key and press R, press Ctrl and V, then press Enter. Together, those keys open the Windows Run box, drop in a command the page quietly copied to your clipboard, and execute it. Nothing seems to happen on screen, but Epic says malware is installed. It is the same trick we explain on our fake CAPTCHA page, dressed up as a health scare.

In an August 2026 version, the fake chart instead showed a table of alarming lab values, some blacked out, with a button offering the full report and diagnosis. The button downloads a program called Full_Analysis_Report.exe, and the page coaches you to click "More info" and then "Run anyway" when Windows warns you. That warning comes from Microsoft Defender SmartScreen, which, as Microsoft explains, marks downloads with no reputation as higher risk. In this case it is right. Epic's rule is the one to remember: lab results appear in MyChart, not in a program you download.

No public source we found names the malware these pages install, so we won't guess. Treat any computer that ran the command or the file as compromised.

Why is the scam tied to Medicare?

Because the targets are older patients, and the calendar helps. Medicare Open Enrollment runs from October 15 to December 7, the weeks when people on Medicare expect mail, calls and offers about their coverage. Iowa Fraud Fighters, a consumer program of the Iowa Department of Insurance and Financial Services, warned on September 23 that Medicare fraud is abundant in this period and told beneficiaries to refuse all offers of "free" medical goods. The FTC is holding a public roundtable on healthcare scams around Open Enrollment on September 29, with experts from the Centers for Medicare & Medicaid Services, the State Health Insurance Assistance Program and Senior Medicare Patrol.

Medicare's own rules make the kit implausible from the start. Medicare.gov says Medicare will never call you to sell you anything or visit you at home. Its plan marketing rules bar plans from offering cash, or gifts worth more than $15, to get you to join. And the CMS booklet on protecting yourself from fraud tells people never to give their Medicare Number in exchange for free medical equipment or any other free offer.

SSM Health has also warned about phone calls that appear to come from a health organization, claim your Medicare information needs updating and ask for your Medicare number. It is the same play by phone.

How can I check whether a MyChart message is real?

• Know who sends the real ones. Epic says real MyChart emails come from your own healthcare organization or from MyChart Central, and show the organization's name. MyChart.com, MyChart.org and Epic.com are Epic's official websites.
• Go in the usual way. Open the MyChart app or your own bookmark instead of the link. If you don't know your organization's MyChart address, the "Find your MyChart" search on mychart.org looks it up by organization name, state or country.
• Check where the link goes. On a computer, rest the cursor on the link and the real address appears. A MyChart link that leads to a survey site, an ad network or an unfamiliar domain is fake.
• Look for your health system's own markers. Some publish them. Baptist Memorial, for example, says its real MyChart texts come from short code 70517 and its emails end in @baptistonecare.org or @bmhcc.org.
• Know what MyChart never asks. Epic says neither it nor your healthcare organization will ever ask for your password or verification codes, and that MyChart will never tell you to press keyboard shortcuts or run a command to "verify" or "fix" your account.

I clicked, typed or paid. What now?

Go by what you actually did. Epic's own recovery steps are the backbone of this list.

1. You clicked but entered nothing. Close the page. Epic says you are most likely fine. Do not reply and do not click unsubscribe, because both tell the sender your address is real.
2. You typed your name, address, phone or email. There is nothing to cancel, but expect more scam calls, texts and mail. Hang up on anyone claiming to be Medicare or your hospital, and call back on a number from your card, a statement or your health system's website.
3. You entered a card. Call your bank or card issuer on the number on the back of the card. Epic's advice is specific: report the charge as fraud and ask for the card to be replaced, rather than disputing just the one charge. Our page for when you typed a card on a fake site covers the rest.
4. You entered your MyChart password. Reset it through your healthcare organization's MyChart, or through MyChart Central if you use an Epic ID. Review the email address and phone number on file so the account still reaches you. If you used that password anywhere else, change it there too and turn on two-factor authentication, as the FTC advises.
5. You gave your Medicare number or insurance details. Call 1-800-MEDICARE (1-800-633-4227): Medicare.gov says to call if you think someone else is using your Medicare Number, and to contact the FTC if you gave your personal information to someone you shouldn't have. Then watch your Medicare Summary Notices and Explanation of Benefits statements for services you never received. The FTC lists a bill or Explanation of Benefits for services you didn't get as a warning sign of medical identity theft. The Senior Medicare Patrol resource center, at 877-808-2468, can connect you with your local SMP, which helps people on Medicare prevent, detect and report fraud.
6. You pressed the keys or ran the downloaded file. Disconnect the computer from the internet and get it checked before you use it for anything personal, financial or work-related. Change your important passwords from a different device, starting with email and banking. The full steps are on our fake CAPTCHA page.

Where should I report it?

Start in your email app: mark the message as phishing or junk. Epic calls this one of the most useful things you can do, because it teaches the filters to block the next one for everybody. The FTC's phishing guide also asks people to forward phishing emails to reportphishing@apwg.org, forward phishing texts to 7726 (SPAM), and report at ReportFraud.ftc.gov. If you are unsure whether a message is real, Epic suggests contacting your healthcare provider's official help desk. If money or your Medicare number is involved, add the reports on our page about where to report a scam.

One more thing is worth doing: tell the older people in your life. Summa Health asked patients to share the warning with family members on Medicare, and it is good advice. A free kit, a friendly survey and a $13.77 fee is a small ask aimed at people who trust their doctor's portal. A heads-up from someone they know costs nothing.