A fake website designed to resemble the MHS GENESIS Patient Portal may trick users into providing personal information to scammers, the Defense Health Agency (DHA) warned in a recent TRICARE.mil post.

The scam site – the post does not note a specific site, or cite a specific fraud threat – may prompt users to provide their MHS GENESIS username and password, or other sensitive data such as their Social Security number or credit card information. The legitimate portal serves as the main tool for military health system (MHS) beneficiaries who use military hospitals or clinics for most of their care to manage appointments and connect with providers.

“These scams rely on realistic fake websites, trusted branding, and urgency to pressure individuals into sharing personal or health information,” said Ally Armeson, executive director of FightCybercrime.org. “Once information is captured, scammers attempt to reuse it during multiple fraud attempts – identity theft, account takeovers, financial scams, etc. Credential harvesting through impersonation is consistent with broader fraud trends.”

[RELATED: MOAA’s Scam Prevention Resources]

FightCybercrime has not seen a spike in patient-portal complaints, Armeson said, but the warning “mirrors patterns we regularly see in impersonation and confidence frauds.” The organization’s outreach includes a Military and Veteran Program designed to help servicemembers, veterans, and families avoid all manner of online scams and fraud; MOAA has been a partner in the effort since 2021.

Portal Protections

Tips to protect yourself and your MHS GENESIS-related data, from DHA:

• Verify Websites. The full MHS GENESIS Patient Portal URL is https://myaccess.dmdc.osd.mil/identitymanagement/app/login, though users may also access the portal from https://my.mhsgenesis.health.mil or https://patientportal.mhsgenesis.health.mil, which redirect to the main site.
  
  
• Watch Access Points. Do not attempt to access the portal via a link in an unsolicited text or email.
  
  
• Look for Red Flags. Scam sites may have misspellings in text or in the URL, may be missing the “.mil” tag, or may include unexpected pop-ups seeking urgent action.

“The DHA guidance … is exactly the type of verification steps that help disrupt and catch these attacks early,” Armeson said.

‘Second Set of Eyes’

Older retirees who are less familiar with online procedures may be more susceptible to these types of scams. Along with encouraging retirees to “see verification and research as a habit” in their cyber-transactions, Armeson said it’s important to connect with older relatives on these issues “without being dismissive or judgmental.”

“Encourage loved ones to involve a trusted second set of eyes before sharing information or sending money, especially when urgency is involved,” she said. “Helping a loved one establish simple verification routines, such as checking URLs together or confirming requests through official channels, can reduce risk and prevent them from getting overwhelmed.”

[RELATED: Why Young Officers Make Tempting Targets for Identity Theft]

Many successful schemes go beyond tech tactics, Armeson stressed, with scammers taking advantage of a victim’s boredom or loneliness to develop trust.

“Staying socially connected offline can be just as important as practicing good cyber-hygiene,” Armeson said.

Those who believe they’ve been targeted by an MHS GENESIS portal-related scam can contact the TRICARE contactor for their region and report the scam to DHA. Those who may have provided personal data to a scammer through such a site are encouraged to change passwords immediately and file reports with the DHA and the Federal Trade Commission.