Fake MyChart Giveaways Steal Patient Login Details

Scammers are copying MyChart's logos in texts and emails, though the platform itself has not been breached.

Updated on Nov. 5, 2026 in Cybersecurity

Bold flat-color vector editorial illustration of a brass padlock with a steel fishing hook angled toward its keyhole, on a cream background. — The Better Business Bureau warned MyChart patients that scammers are sending fake giveaway texts and emails with copied logos to steal login details, though the platform itself has not been breached. AI Illustration. Upload story photo >

Live Poll

Do you feel confident you could spot a fake text or email from your doctor's portal?

The Better Business Bureau has warned patients about a phishing scheme targeting MyChart users, in which scammers send fake giveaway texts and emails to capture login credentials. The warning is a consumer alert about an active scam, not a confirmed breach of the platform.

Why it matters

The scam exploits trust in a patient-portal brand by copying official logos and pairing them with rewards offers, a common phishing pattern moving into healthcare login flows. Because MyChart has not been breached, the risk sits with users who hand over credentials to spoofed pages.

The alert is a consumer warning rather than a measured incident report, so it provides no quantified loss or reach figures. What it does establish is the attack vector: text and email messages carrying copied MyChart logos that route users to spoofed login pages.

The players

Better Business Bureau

A nonprofit consumer-protection organization that publishes scam alerts and tracks fraud complaints across the United States.

Epic

The healthcare software company that created MyChart, the patient-portal platform used by many U.S. health systems.

The details

The scheme begins with text messages or emails that promise a reward or giveaway and display logos copied from MyChart's official communications. Recipients are directed to spoofed web pages that imitate the MyChart login screen, where they are asked for credentials, insurance information, or a shipping fee payment. Phishing of this kind works by impersonating a trusted sender so that a user supplies login details to a site the attacker controls.

November 5, 2026: Better Business Bureau publishes its warning about the MyChart phishing scam.

The Tech Race

This alert sits within the ongoing contest between phishing operators and platform defenders, where attackers increasingly copy the visual identity of widely used software. Defenders respond with user education and vendor statements, and the MyChart case shows that a platform can be untouched by a breach while its users are still targeted.

Patients who use MyChart should treat unsolicited texts or emails offering giveaways as suspect, since MyChart does not run giveaways or ask for passwords by text or email. Anyone who has already entered credentials on a suspicious page should change their MyChart password and watch for unfamiliar activity on the account.

The takeaway

Epic has stated that MyChart itself has not been hacked, so the defense rests on users recognizing that the platform does not solicit passwords by text or email. Watch for any further Better Business Bureau or Epic guidance that quantifies how many users were targeted.