Email safety
Fake Pharmacy and Patient Portal Emails: MyChart, CVS, Walgreens
The Medicare scams from the last two weeks are easy to spot once you know the pattern, because most people do not get real email from Medicare. This one is harder. You do get real email from your pharmacy. You do get real messages from your patient portal. So when a fake one arrives, it does not look out of place.
Quick version: Emails pretending to be MyChart, CVS, Walgreens, or your doctor’s office are the fastest-growing scam aimed at older adults this fall. They work because you actually get real emails from those places. The fix is one habit: never open your portal or pharmacy from a link in an email. Open the app, or type the address yourself.
What is happening right now
On September 16, the Association of Health Care Journalists reported a wave of phishing emails using subject lines like “Your MyChart Medicare Kit Awaits,” offering a free “Medicare Home Health Kit” to seniors (AHCJ). The emails say your account is eligible, create a 48-hour deadline before “unclaimed kits are reassigned,” and link to a fake MyChart login page that collects your username, password, and personal details.
About 41 health systems across the country have warned their patients. The FTC had logged 166 MyChart-related phishing complaints. It is timed to Open Enrollment, which started October 15, because that is when older adults expect health-related mail.
MyChart is the portal used by a large share of hospitals and clinics in the US, which is why it was chosen. But the same template is being used with pharmacy names.
The three versions you will see
1. The portal message
“You have a new message from your care team.” “Your test results are ready.” “Action required on your account.”
These are real subject lines that MyChart and other portals use, copied word for word. The difference is the link. The real notification takes you to the app or to your health system’s actual website. The fake one takes you to a page that looks identical and steals your login.
2. The pharmacy refill
“Your prescription is ready for pickup.” “Your refill could not be processed, update your payment.” “Your CVS ExtraCare account has been suspended.”
CVS and Walgreens both send real refill notices, usually by text and sometimes by email. The fakes copy the layout, the logo, and the tone. They add a payment problem, because a payment problem gets you to type a card number.
3. The free kit
The MyChart Medicare Kit email above, and its cousins: a free blood pressure monitor, a free glucose meter, a free “wellness package.” Confirm your Medicare number and address to receive it.
This is the same free-equipment scam from last week’s post, wearing a pharmacy or portal logo instead of a Medicare one.
Why these work on careful people
You have been told to watch for bad spelling, strange addresses, and things that feel off. These emails have none of that. They are copies of real emails, sent to people who really have those accounts, at a time of year when health mail is expected.
The phone makes it worse in a specific way. On a computer, you can hover over a link and see where it goes. On a phone, you tap and you are there. And the fake login page looks exactly like the real one, because it is a copy.
So the usual checks help less here. You need a different rule.
The one habit that stops all of it
Never log in to your portal or pharmacy from an email. Ever. Not even a real one.
Instead:
- Close the email.
- Open the MyChart app (or CVS, or Walgreens) from your home screen. If you do not have the app, type the address into your browser yourself: mychart.com, cvs.com, walgreens.com.
- Log in there.
- If the email was real, the message, the refill, or the account issue will be waiting for you inside. If it is not there, the email was fake.
This works because it does not require you to judge the email at all. The real message is always available inside the real app. The fake one never is.
Health systems are telling their patients the same thing. AHCJ reports the standard advice is to delete suspicious emails without clicking and to access MyChart directly through the official app or website.
If you already logged in through a link
- Change your portal or pharmacy password right now, from the real app.
- If you typed a card number, call the number on the back of the card.
- If you gave your Medicare number, call 1-800-MEDICARE (1-800-633-4227).
- If the page asked you to download something and you did, go to Settings, then Apps, and uninstall anything you do not recognize from today.
A complete walkthrough is coming October 27: I tapped the link. Now what?
How Easy Mail fits in
Easy Mail does not judge your email for you, but it does make the habit above easier to keep. Your pharmacy and portal apps sit on the same home screen as your inbox, so “close the email, open the app” is one swipe instead of a hunt through the app drawer. And with Gmail, Yahoo, and Outlook in one inbox, you apply the rule once instead of three times.
Get Easy Mail Email Launcher on Google Play.
Frequently asked questions
Does MyChart send real emails?
Yes. MyChart sends notifications when you have a new message, result, or appointment. Real ones never ask you to log in through the email. Open the app instead and the same notice will be there.
How can I tell a real CVS or Walgreens email from a fake?
You mostly cannot, by looking. Do not try. Open the app or type the website address yourself and check there.
Should I report these?
Yes. Forward the email to reportphishing@apwg.org, then delete it. If it used your health system’s name, their patient support line would also like to know.
Keep Reading
Unsubscribe or Ignore? And Why “Unsubscribe” Sometimes Doesn’t Work
Still have questions? Read more Easy Mail FAQs, or learn about features like the Unified Inbox.
Sources: AHCJ: MyChart scam: Phishers target seniors’ personal, financial info (Sep 16, 2026)
