Online Threat Alerts (OTA) - Alerting you to scams and frauds.

Mychart Scams - How to Protect Yourself
Mychart Scams - How to Protect Yourself

Scammers are using fake emails and text messages disguised as official MyChart or health system notifications to steal your personal, medical, and financial information. These fraudulent messages often mimic official hospital branding but feature mismatched sender addresses or suspicious links.

Common Scams to Watch For

  • The "Medicare Kit" Email: The most widespread attack involves emails with subject lines like "Your MyChart Medicare Kit Awaits!". These are entirely fake and do not come from your doctor.
  • Fake Urgent Alerts: Messages claiming you have an unpaid bill, an unexpected change to an appointment, or that your account will be locked if you don't log in immediately.
  • Free Offers & Giveaways: Scammers promising free gifts, first aid kits, or weight-loss medication eligibility (like GLP-1/Ozempic) if you fill out a form or provide payment details.

Red Flags of a Fake Message

  • The Sender Address is Wrong: Official communications will explicitly match your healthcare provider's domain (e.g., donotreply@ccmychart.org or myuncchart@unchealth.unc.edu). Fake messages often come from generic addresses or domains with subtle typos.
  • Suspicious Links: Hovering over links reveals web addresses that do not lead to your provider's official portal. Official web lookup can be verified on the main MyChart Official Website.
  • Requests for Codes: The message asks you to reply with, text, or call in your password or two-factor verification codes. Epic and your healthcare organization will never ask for these.

How to Protect Yourself

  • Do Not Click Links: Never click links or unsubscribe buttons inside an unexpected health email or text.
  • Log In Independently: If you get a notification, open your trusted MyChart mobile app directly or type your health provider's known website into your browser to check your messages.
  • Verify by Phone: Call your doctor's office or healthcare help desk using a phone number from their official website—never use the number provided in the suspicious message.
waiting