Fake emails and texts promising a "MyChart Medicare Kit" are targeting patients across Pennsylvania. Attorney General Dave Sunday is urging residents to delete them immediately.
The scam could affect Doylestown and Buckingham residents who access medical records through Jefferson Health, Penn Medicine or Lower Bucks Hospital, all of which use MyChart, according to the New Hope Free Press. No such program or reward exists, the attorney general's office said.
The scam works by luring recipients into clicking a link and entering passwords or other personal information. That information can give hackers access to a patient's MyChart account, which stores medical records, appointment details and billing data.
"Scammers are always looking for new ways to obtain as much of your personal information as possible," Sunday said in an Aug. 28 statement. "Stay on the lookout for this new scam tactic, and contact your medical office if you're not sure how to access the MyChart website assigned to your providers."
MyChart's developer, Epic, warned that scammers may use the portal's name or logo to make messages and websites look legitimate. Some attempts seek login credentials. Others promise free gifts in exchange for payment information.
How to spot the scam
The attorney general's office and Epic offered several warning signs:
- Check the sender's full email address and website URL before clicking anything. Small misspellings or extra words can signal fraud.
- Epic and health care organizations will never ask for MyChart passwords or verification codes by phone, text or email.
- No legitimate provider will instruct patients to use keyboard shortcuts or run commands to "verify," "fix" or "unlock" an account.
- MyChart does not run giveaways. Any message offering free gifts or prizes in exchange for personal information is suspect.
What to do if you received a message
Patients who got a suspicious message should not reply, open attachments or click any links, including an "unsubscribe" link. Report the message as junk or phishing through the email provider instead.
Those who clicked a link but did not enter information should close the page. Patients who entered a password should change it through their health care organization's MyChart site. Anyone who provided credit card information should contact their bank and have the card replaced.
Patients who ran a program or followed keyboard-command instructions should disconnect the computer from the internet and have it inspected before using it for personal, financial or work accounts.
How to report the scam
Residents who believe they were targeted can file a complaint with the Pennsylvania Office of Attorney General's Bureau of Consumer Protection by emailing [email protected] or calling 1-800-441-2555.
