BALTIMORE — An email telling you new medical test results are ready could be hiding a sophisticated scam.
Health systems are warning patients about phishing scams using the MyChart name and logo to trick people into clicking malicious links, handing over personal information or even installing malware on their computers.
A WMAR-2 News viewer alerted Matter for Mallory to the scam after receiving a suspicious email that appeared to be connected to a healthcare system he doesn't use.
That mismatch caught his attention. But for someone who does use the healthcare system named in a fraudulent email, the scam could be much harder to spot.
Epic, the company behind MyChart, says it has seen an increase in scammers using the familiar MyChart brand in fraudulent emails, text messages, phone calls and websites.
The company stresses the increase is not the result of a security problem with MyChart itself. Instead, scammers are taking advantage of a name millions of patients recognize and trust.
One of the scams documented during an Epic security investigation this summer begins with an email telling the recipient, "Your recent results are ready."
The email includes MyChart branding and a button to sign in.
But instead of taking the patient to their real MyChart account, the link opens a fake login page built to look nearly identical to the legitimate site.
Epic says scammers copied code from the real MyChart website to make the fake page convincing.
If a victim enters their information, the deception doesn't stop at the login screen.
The fake site can display what appears to be a medical chart and a frightening message claiming an "AI-powered review" identified critical patterns in the patient's blood work requiring immediate attention.
Epic says the information displayed in the fake record is made up.
The warning is designed to create urgency and push the victim into taking another step.
In one version investigated by Epic, the site instructed users to complete a supposed human verification process using several keyboard commands. Following those instructions could secretly run a command that installs malware on the victim's computer.
Epic spotted another version in August in which a fake chart displayed alarming lab values and offered an "Unlock Full Report & See Diagnosis" button.
Clicking it downloaded an executable program. The fraudulent site then instructed victims to bypass their computer's security warning and run the program anyway.
Epic says legitimate MyChart lab results are available directly within the portal and patients will not be required to download a program to see them.
If you believe you fell for a MyChart scam, Epic recommends resetting your MyChart password, reviewing the email address and phone number associated with your account, and contacting your healthcare organization's help desk.