Patient Portal Phishing Scams: What You Should Urgently Know

Medical patients across the country are being warned about a new phishing scam affecting hundreds of hospitals and major healthcare systems in parts of the United States. Here is what you need to know about patient portal phishing scams that are sweeping the country even as you read this.

How the Scam Works

Some patients who use MyChart, a free electronic health record platform that lets patients securely access medical records and manage health services, have reported receiving phishing emails and text messages designed to steal their login credentials. These reported attacks are part of a broader wave of phishing scams targeting people through familiar services and trusted-looking messages.

What Patients Should Know

Patients are being told that the MyChart system itself has not been breached. But patients who use this and/or other health management systems are at risk of being tricked by scammers into sharing login information.

Here are three examples of common actions scammers take:

1)      Scammers are sending fraudulent messages to patients who use patient portals: These fraudulent messages are designed to look legitimate and may direct recipients to a lookalike website designed to capture usernames and passwords. To be safe, do not log into your account through a received email or text message. Instead, strictly access your MyChart securely from the app that you already have installed on your device, and login as you normally would. Always access your account securely and make it a habit to safeguard your login credentials and personal information by keeping them private.

2)      Scammers are using false identities and promising patient health kits, packages, and rewards that are not real: Fraudulent messages that are purportedly from MyChart (or another health management service provider) may promise a free “Medicare kit” or “Senior Health Package” or rewards. What’s important to know is that MyChart and other health management portals do not offer kits, packages, giveaways or bonuses, so it’s safe to assume it’s a scam. Don’t fall for freebees and giveaways that scammers use to trick people.

3)      Scammers are seeking to download malware: Some fraudulent pages can take you to a fake website or include a security pop-up which instructs you to run commands. Unfortunately, following those commands can download malware (malicious software) onto your device.  Again, don’t access your account from a random email or message, even if it looks legitimate. Go through the official portal that you originally set up on your device to avoid being scammed.

Why It Matters

Your health account information and medical records are best kept private. Should scammers access your sensitive information, it poses serious risks. Let’s explore why: Stolen login information could expose patients’ private health information. In many cases, the danger is not just losing a password; it is giving scammers a doorway into personal health, insurance, and account details that can be misused in several ways.

·         Access private medical information. Scammers may be able to view appointment details, test results, prescriptions, diagnoses, provider messages, or other sensitive records. This stolen info. can be used by scammers, for example, to commit medical identity theft, file false insurance claims, buy prescription drugs or equipment in your name, and sell your information on the dark web.

·         Collect personal identifying details. A patient portal may contain names, dates of birth, addresses, phone numbers, insurance information, or billing details that can help scammers impersonate someone. Go the extra mile to protect your data by never sharing information with someone who messages you, texts, or calls you unexpectedly.

·         Take over or reuse account access. If a patient uses the same password elsewhere, scammers may try it on other accounts, change login settings, conduct business using your stolen credentials, or lock the real user out. Passwords should vary to avoid the domino effect, to prevent automated attacks, and to keep criminals from trading/selling stolen passwords on the dark web.

·         Commit financial or insurance fraud. Stolen billing, insurance, or payment information could be used to make false claims, open new fraud attempts, or pressure or trick patients into paying fake charges. Scammers can potentially file false tax returns using a stolen Social Security Number to claim someone’s refund. Always report identity theft immediately to the appropriate agency.

·         Create more convincing scams later. Health-related details can make future phishing messages feel more personal and credible, increasing the chance that someone will respond or click again and allowing a small scam to grow into a larger or more elaborate one – a term called snowballing.

Additional Steps for Patients: What to Do If Something Feels Off

If a message about your MyChart (or other account) feels off and makes you pause, trust that instinct. Maybe the text claims you won a free Medicare kit, maybe the email urges you to “verify your account today,” or maybe a link takes you to a page that looks almost but not quite like the portal you normally use. In any of those situations, stop. Don’t click, type, or download anything because those are scams! Why stop? Because if something feels off, it usually is! It’s likely you are noticing red flags (classic warning signs) of scams.

A Simple Safety Plan

·         Go straight to the source. If you receive a message asking you to log in, do not follow the link in the email or text. Unsure? To confirm legitimacy, open the MyChart app already installed on your device instead. Or contact your healthcare provider directly using a phone number you have for them (never call phone numbers given to you by a potential scammer).

·         Change your password if you clicked or logged in to a potential scam. For instance, if you entered your username and password on a page that appeared after a suspicious text, assume those credentials may be exposed. Sign in through the real portal and create a new, strong password right away. If you suspect MyChart Fraud, click here for additional information.

·         Watch for financial warning signs. If the scam asked for payment details, insurance information, or credit card numbers, and you gave that information to a scammer, act fast. Check your accounts carefully, reset your passwords, and contact your bank or credit card company to get new cards issued. A quick and immediate call to your financial institution can help prevent bigger problems later.

·         Take device warnings seriously. If a pop-up told you to run a command, install an update, or download a file, disconnect your device from the internet and have it reviewed by a qualified professional. That kind of instruction is a major red flag.

·         Report the message. Forward suspicious emails, texts, or screenshots to the security team connected with your healthcare portal. Reporting helps protect other patients who may receive the same scam. You can also block and/or report unwanted messages from potential scammers.

Conclusion: Stay Alert and Protect Your Health Information from Patient Portal Phishing Scams

Health management apps like MyChart have become a helpful and necessary part of modern healthcare. They allow patients to schedule appointments, manage medications, view records, message providers, pay bills, and stay more involved in their care. That convenience, however, also makes these accounts attractive targets for scammers.

Although hospitals and healthcare systems work to protect patient accounts, and the MyChart platform itself has not been reported as breached, scammers are still trying to reach patients directly through believable emails and text messages. Their goal is to trick people into sharing their own login information, especially those who may be busy, worried, or managing health concerns.

The best defense is to stay alert, keep up with common scam tactics, and use only official apps or websites to access personal health information. Protecting your login details is one of the simplest ways to protect your privacy. This wise action is a total winner in patient portal safety.

Disclosure: This article is for informational purposes only and is not a substitute for professional advice or endorsement of any products or services.