That message about your patient portal: real or fake?
An email says a new message from your care team is waiting in the portal. This one is genuinely hard, because real hospitals send exactly this email. The fake version copies it well and sends you to a sign-in page that looks right. You do not have to become an expert in spotting the difference. There is one habit that works every time, and it takes about ten seconds.
“A new message from your care team is available in your patient portal. Please sign in to review it: riverbend-health.mychart-secure.example/login”
The wording is perfect, because it was copied. The web address is the only tell, and you should not have to check it.
How to tell
You did not expect it. A message right after an appointment makes sense. One out of nowhere is worth a pause.
The web address is close but not right. Extra words, a dash, or the hospital name sitting before a different site.
It asks you to sign in from the email itself, rather than telling you to check the portal.
There is any urgency at all. Real medical messages wait for you. Scams cannot afford to.
It arrived as a text when your hospital has only ever emailed you, or the other way round.
What to do
1Do not use the link. Not because this one is definitely fake, but because you never need it.
2Open the portal the way you always do: your saved bookmark, the hospital app, or by typing the address you know.
3If a message is really waiting, it is there. If nothing is there, you just learned the email was fake, at no cost.
4Unsure whether the portal address you have is the right one? Call your clinic on the number from your appointment card.
If you already clicked or paid
First: don’t blame yourself, and don’t hide it. Acting quickly matters more than anything else.
If you signed in through the link, change that password now, on the real site. Change it anywhere else you used the same one.
Turn on two-step sign-in for the portal if it is offered. It stops a stolen password on its own.
Call your clinic and tell them. They can watch the record and they will want to know it is going around.
Nothing about your health is at risk from having read an email. This is about a password, and passwords can be changed.
Worth remembering: Never sign in from a link in a message. Open the site the way you normally do, every single time.