The Free Medicare Kit That Isn't
At least seven health systems are warning patients about the same fake email — a "MyChart Medicare Kit" that asks for your address and your Medicare number. Why this one works so well on people who are careful, and the one habit that beats it.
The free Medicare kit that isn't
Over the past two weeks, health systems across the country have been publishing the same warning to their patients. Sentara. Cleveland's MetroHealth. UMass Memorial in Worcester. Methodist Health System in Dallas. Southeast Health in Alabama. Reliant Medical Group. Cass Health in Atlantic, Iowa. Seven and counting, in states that have nothing to do with each other, all describing one email.
It arrives wearing the MyChart name and logo — the patient portal tens of millions of Americans genuinely use to check lab results and message their doctor. The subject line is some version of "Your MyChart Medicare Kit Awaits!" Inside, you've been approved for a complimentary 2026 MyChart Senior Health Package: a free wellness kit, Medicare benefits, yours to claim. All you have to do is click a button and confirm a few details.
Why this one is good
Most phishing tries to frighten you. Your account is suspended, your payment failed, unusual activity detected — panic first, think later. This one doesn't. It offers you something mildly nice and asks for something that doesn't feel precious.
That's a deliberate choice, and it's a smart one. People have been trained to be suspicious of alarming emails. Almost nobody has been trained to be suspicious of a boring one.
Look at what it's actually asking for: your mailing address, your insurance details, your Medicare number. To a person who's just been told a box of health supplies is coming, that's shipping information. It's the same thing you'd type into any online order.
Except a Medicare number is worth considerably more than a credit card number. A stolen card gets cancelled in an afternoon; you notice, you call, it's over. A stolen Medicare number gets used to bill fraudulent equipment and services against your name for years, and most people find out only when a bill or a denial shows up in the mail long after the trail is cold. It is also, unlike a card number, extremely difficult to replace.
How it actually runs
The mechanics are unglamorous, which is why it scales:
- Blast the brand, not the clinic. The sender doesn't need your health system's real name — MyChart is the brand patients recognize, and it's used by thousands of providers. One template works everywhere.
- Land in the inbox. The email comes from a lookalike domain, something like
mychart-medicare-kit.com. It has never sent spam before, so filters have no history to judge it by. - Offer, don't threaten. A free kit, a senior benefit, an approval you didn't apply for.
- Add a clock. Forty-eight hours, or the kit goes to another member. The deadline exists for exactly one reason: to stop you from asking someone first.
- Collect. The button opens a form — sometimes a convincing copy of a portal login, sometimes just a plain shipping form. Either way, what you type goes to them.
There's one more detail worth knowing, and several health systems call it out explicitly: don't click "unsubscribe" either. On a legitimate newsletter, unsubscribe is the polite exit. On this, it's just a different button that confirms a real person read the message — which makes your address more valuable, not less.
What to actually do this week
- Say the plain version out loud to whoever in your family is on Medicare. Not a lecture about phishing — one sentence: Medicare never emails you a free kit, and MyChart never asks for your Medicare number by email.
- Replace the judgment call with a habit. Never reach the portal through a link; always through the bookmark or the app. This works even on the day the fake is flawless, because it doesn't require anyone to spot anything.
- Know the two phone numbers. Your clinic, at the number on the insurance card — not one from the email. And 1-800-MEDICARE to report a stolen or misused Medicare number.
- If it was already clicked, skip the shame. Nobody has ever regretted an unnecessary phone call. Plenty of people have regretted waiting a week to be sure.
Where SAFE Portal fits
The click is the part we cover. SAFE Portal screens links and flags a lookalike domain before the page loads, so mychart-medicare-kit.com doesn't get to render a convincing copy of anything. And the password manager checks where a page actually lives before it fills a credential — so a pixel-perfect fake MyChart login simply stays empty. That silence is the alarm, and noticing it doesn't require any expertise at all.
The advisor tools matter here too. If you're the person your family calls about this sort of thing, you can approve sites and downloads for them from your own dashboard — which means they don't have to make the call alone at nine at night, which is precisely when these decisions get made badly.
What it won't do
SAFE Portal can't stop the email from arriving. That's a spam filter's job, and on this campaign the filters are plainly not catching it. We also can't tell you whether a Medicare benefit is real — that's a phone call to 1-800-MEDICARE, and no software substitutes for it. And if someone types their Medicare number into a form by hand, no browser can un-send it.
What software can do is take away the moment where a careful person has to be clever about a URL. The rest — the phone call, the habit, the conversation with your mom — is on us. That's what this blog is for.
SAFE Portal is free to try, takes about two minutes to set up, and doesn't ask for a credit card. Get it at SAFEPortal.to.