LEHIGH VALLEY, Pa. — Emails and text messages promising a free “MyChart Medicare Kit” are reaching Lehigh Valley inboxes as part of a nationwide phishing campaign, and St. Luke’s University Health Network and the state attorney general are warning patients to delete them.
The messages use the MyChart name and logo to appear to come from a patient’s health system. They do not. According to Epic Systems Corp., the Verona, Wis., company that makes MyChart, the scam is designed to collect a victim’s name, home address, phone number and credit card number under the cover of a “shipping fee” for a kit that never ships.
Both of the region’s major health networks run their patient portals on MyChart: St. Luke’s under the MyChart name and Lehigh Valley Health Network as MyLVHN, which LVHN says is powered by Epic’s MyChart.
What St. Luke’s and the state are saying
St. Luke’s said in a news release that it is aware of scam emails, texts, and phone calls falsely claiming to be from MyChart and offering a free health package, a Medicare-related benefit, a gift, or another promotion in exchange for clicking a link or providing personal information.
“Cybercriminals are simply misusing the MyChart name and branding in an attempt to trick patients into sharing personal information,” St. Luke’s said. The network said there is no indication the MyChart platform itself has been compromised and that the campaign is affecting health care organizations across the country.
Stay informed on Lehigh Valley crime
Get the latest crime news and updates from across the Valley.
By subscribing, you agree to our Privacy Policy and consent to receive updates.
Pennsylvania Attorney General Dave Sunday issued a consumer alert Friday, stating that no “MyChart Medicare Kit” program or reward exists. The messages are an attempt to obtain passwords and personal information that could give hackers access to a patient’s portal, Sunday said.
“Scammers are always looking for new ways to obtain as much of your personal information as possible,” Sunday said. “Stay on the lookout for this new scam tactic, and contact your medical office if you’re not sure how to access the MyChart website assigned to your providers.”
What the email looks like
One of the emails reached a Lehigh Daily inbox, where a spam filter caught it. Lehigh Daily opened the message to document how the scam works and entered no information.
The subject line used the first part of the recipient’s email address as a name, followed by “Your MyChart Medicare Kit Awaits.” The sender address was a string of random letters at a “.us” domain, relayed through a long chain of random-looking subdomains. Nothing in it resembled a St. Luke’s or MyChart address.
The body opened with “Dear MyChart Customer,” and described a “premium first-aid and medical-grade preparation kit” offered free to patients who complete a short survey. “START SURVEY” and “CLAIM KIT NOW” buttons led to an outside website.
Stay informed on Lehigh Valley crime
Get the latest crime news and updates from across the Valley.
By subscribing, you agree to our Privacy Policy and consent to receive updates.
The fine print at the bottom contradicted the branding above it. Small gray text said the site is not affiliated with MyChart and that participation “does not guarantee any prize,” directly beneath a line reading “© 2026 MyChart. All rights reserved.”
What happens after the click
The link opened a website with a spam “.store” address unrelated to MyChart or St. Luke’s. A long tracking code was attached to the end of the address, and the page would not load without it.
The page displayed a MyChart logo, the day’s date, a red banner claiming that more than $300,000 in MyChart products had already been given away, and a countdown clock starting at about 6 minutes. A red line warned that the offer “expires today.”
A fraudulent website that mimics the MyChart portal prompts users to complete a survey for a fake Medicare kit, targeting Lehigh Valley residents in a scam.
The survey consisted of eight multiple-choice questions, beginning with “How familiar are you with MyChart?” After the final question, the page said it was checking the visitor’s IP address. Lehigh Daily closed the browser at that point.
Epic, which published a step-by-step breakdown of the scam based on its security investigations this summer, describes what comes next.
The survey answers are never read, and the same “reward” appears no matter what a visitor clicks, Epic said. The page then shows the kit as a $149 value marked down to $0, with only a few left in stock, followed by a step the email never mentioned: a shipping fee.
A form then asks for first and last name, email, phone number, and full mailing address, and the scammers capture everything typed there even if the visitor closes the page before paying, Epic said. A final page on yet another website asks for a credit card number, expiration date, and security code for a $13.77 charge.
“A prize you have to pay for is not a prize; it is a purchase,” Epic wrote. No kit ships, and the small charge is easy to overlook until it repeats or grows, the company said.
The web address is different for every person who receives the email, which is part of why the campaign is hard to shut down, Epic said.
Epic has also documented a related version of the scam. A fake “your results are ready” email leads to a counterfeit MyChart login page, then instructs the visitor to press keyboard shortcuts or download a file to “verify” their identity. Those steps install malware, Epic said.
What to do
St. Luke’s and MyChart will not contact patients unexpectedly to request passwords, financial information, or other sensitive personal information, St. Luke’s said. Patients unsure whether a message is real should not respond; instead, they should log in through the MyChart app or the St. Luke’s website.
Do not click the “unsubscribe” link in these messages, the attorney general’s office and Epic said. The link can lead to a malicious site and confirms to the sender that the address is active. Epic recommends reporting the message as junk or phishing in the email app, which helps train spam filters for other users.
Anyone who believes they interacted with a suspicious message should change their MyChart password immediately, monitor their accounts for unusual activity and contact the St. Luke’s MyChart Patient Support Line at 866-785-8537, option 5, St. Luke’s said.
Anyone who entered credit card details should call their bank, report the charge as fraud and ask for the card to be replaced rather than disputing a single charge, Epic said.
Pennsylvania residents can file a complaint with the Office of Attorney General’s Bureau of Consumer Protection by emailing [email protected] or calling 1-800-441-2555.
Stay informed on Lehigh Valley crime
Get the latest crime news and updates from across the Valley.
By subscribing, you agree to our Privacy Policy and consent to receive updates.
