COLUMBUS, Ohio (WOWO) — Ohio patients who use the MyChart online medical records system are being warned about a scam involving fake emails and text messages designed to steal passwords, credit card information and sensitive medical data.
Consumer protection experts say scammers are impersonating MyChart and using legitimate-looking messages to convince patients to click links, complete surveys or log into fraudulent websites.
Judy Dollison, president of the Better Business Bureau of Central Ohio, told WCMH that her organization has been seeing messages claiming to come from MyChart that offer recipients a free reward, such as a Medicare Kit or Senior Health Package.
The messages typically ask the recipient to complete a survey and then pay a small shipping charge to receive the supposed free item.
That small payment can give scammers access to a victim’s credit card information.
“They have your credit card information now,” Dollison said.
She warned that the information could then be used to place unrelated charges on the account or enroll victims in subscription services that can be difficult to cancel.
Another version of the scam is more directly tied to patients’ medical information.
In those messages, recipients are told that new test results are available and can be viewed by clicking a link.
The link may lead to a fraudulent website designed to look like the real MyChart login page.
Once there, a victim could be presented with alarming or concerning medical information designed to create a sense of urgency and pressure the person into entering their login credentials.
The information entered on the fake page can then be used to access the victim’s actual MyChart account.
“That information that you’re providing is actually a password and login that is now compromising your real MyChart account,” Dollison said.
The potential damage can go beyond simply losing access to an online medical account.
Once scammers obtain MyChart credentials, they could potentially gain access to sensitive billing information and other personal details contained in a patient’s account.
That information can also be used to make future scams appear more convincing.
“They know I’m a diabetic, or they know there’s something about me, and that can lead to future scams,” Dollison said. “You believe it because they have this accurate information.”
That is one reason medical information can be particularly valuable to scammers. Details about a person’s health, insurance, medical providers or billing history can make a fraudulent phone call, email or text appear legitimate.
Consumer experts say the safest way to check a MyChart notification is to avoid clicking links contained in unsolicited messages.
Instead, patients should open the official MyChart app directly or navigate independently to their health care provider’s official website and access their account from there.
If there is a genuine test result, billing notice or other account message waiting, it should be visible after logging in through the legitimate service.
Patients should also be cautious about messages offering free products, gift cards, health kits or other rewards in exchange for completing a survey and paying a small shipping fee.
A request for payment — even a relatively small amount — should be treated as a warning sign when the offer arrives unexpectedly.
Anyone who receives a suspicious email or text should avoid interacting with it, including clicking links or responding to the sender.
Experts recommend reporting the message as junk or spam and then deleting it.
Even an apparent “unsubscribe” link can be dangerous, according to consumer experts, because it may redirect users to a malicious website.
The warning comes as scammers increasingly use personal information to make phishing attempts look authentic.
For MyChart users, the basic rule is simple: don’t let an urgent message push you into clicking first and thinking later.
If a notification says test results are ready, a bill needs attention or a reward is waiting, patients can verify the information independently by opening their health care provider’s official website or the MyChart app themselves.
Taking that extra step can help protect not only credit card information and passwords, but also some of the most sensitive personal information a person has — their medical records.