Enhanced Cybersecurity for SNAP Act of 2026
- Sponsor
- Rep. Goldman, Daniel S. [D-NY-10]
- Committees
- Agriculture Committee (primary)
- Last action
- Apr 3, 2026
Bottom line
This bill aims to modernize EBT card security and user accessibility, reducing fraud and improving the user experience for SNAP beneficiaries, while imposing new requirements on states and retailers.
What it actually does
This bill mandates the Secretary of Agriculture to promulgate and regularly update cybersecurity and digital service regulations for EBT cards used in the Supplemental Nutrition Assistance Program (SNAP). It requires states to issue chip-enabled EBT cards, provide various user interfaces for account management, offer electronic transaction notices, and prohibits certain PIN/password requirements. It also establishes a grant program for retailers to upgrade to chip-compatible payment terminals and mandates enhanced security measures for online EBT transactions.
Proponents argue
Proponents argue that the bill is essential to protect vulnerable SNAP beneficiaries from EBT card skimming and fraud, which has led to significant financial losses. They contend that modernizing EBT technology to match private sector standards will enhance security, improve user access to account information, and streamline fraud reporting, ultimately safeguarding benefits and increasing program integrity.
Opponents contend
Potential opponents might argue that the mandates for chip-enabled cards and new digital interfaces impose significant unfunded or underfunded burdens on states and retailers, especially small businesses, potentially disrupting service or increasing administrative costs. Concerns could also be raised about the feasibility of rapid technological upgrades across all states and retailers, and the potential for new digital requirements to exclude beneficiaries without reliable internet access or digital literacy.
The bill is moderately complex, requiring careful reading to understand the phased implementation timelines and technical definitions, but is manageable within a reasonable timeframe.
Section 2, amending 7 U.S.C. 2016(h) by adding paragraph (15)(B)(i)
Mandate for EBT Cybersecurity and Digital Service Regulations
This provision requires the Secretary of Agriculture to issue and regularly update cybersecurity and digital service regulations for EBT cards and mobile technologies within two years of the bill's enactment. These regulations must ensure that EBT security measures keep pace with the security safeguards used by the private sector and required by Federal agencies for credit, debit, and other payment cards and mobile technologies.
Supporters argue
Supporters argue this ensures EBT cards are protected by modern security measures, reducing fraud and aligning with current financial industry practices, which is crucial for program integrity.
Critics contend
Critics might argue that frequent updates could lead to continuous, costly compliance burdens for states, especially if federal funding does not fully cover the expenses associated with these evolving standards.
Tradeoffs
Balancing the need for robust security with the administrative and financial burden on states and EBT contractors to continuously adapt to new regulatory requirements.
Section 2, amending 7 U.S.C. 2016(h) by adding paragraph (15)(B)(ii)(I)
State-Operated User Interfaces for EBT Account Management
This provision mandates that states operate one or more user interfaces, chosen by the household, to manage their EBT accounts. These interfaces, which may include web-based online portals and mobile applications, must be mobile-friendly, provide information in all required languages, and be available at least 99 percent of the time. An application programming interface (API) for third-party software delegation is also required.
Section 2, amending 7 U.S.C. 2016(h) by adding paragraph (15)(B)(ii)(II)
Timely Transaction Notices and Fraud Reporting
States are required to provide SNAP households with opt-in electronic notices of EBT account transactions through digital user interfaces. These notices must be timely and include transaction details such as amount, merchant, and location. States must also offer access to 12 months of historical transactions and provide a mechanism for households to report fraudulent transactions, notifying victims of potential reimbursements.
Section 2, amending 7 U.S.C. 2016(h) by adding paragraph (15)(B)(ii)(IV)-(VI)
Transition to Chip-Enabled EBT Cards
This provision mandates a phased transition to chip-enabled EBT cards. Within two years of the regulations becoming final, states must begin issuing chip-enabled EBT cards. Within four years, states may no longer issue new EBT cards with magnetic stripes. Finally, within five years, all existing valid EBT cards with magnetic stripes must be reissued as chip-enabled cards without magnetic stripes.
Section 2, amending 7 U.S.C. 2016(h) by adding paragraph (15)(C)
Federal Reimbursement for State EBT Upgrade Costs
This provision ensures that states upgrading EBT cards to comply with the new federal regulations will receive reimbursement from the Secretary of Agriculture. This reimbursement will cover all reasonable costs incurred by the state, including one-time upfront costs paid to card vendors, additional annual fees associated with chip-enabled cards, and postage or other delivery-related costs for card distribution.
Section 2, amending 7 U.S.C. 2016(h) by adding paragraph (15)(D)
Alignment of PIN/Password Standards with NIST Guidelines
Beginning 60 days after the bill's enactment, state agencies are prohibited from requiring periodic PIN or password changes for EBT cards or online accounts if such requirements are prohibited by the NIST PIN and password standards (Special Publication 800-63B). Similarly, password complexity requirements that are prohibited by these NIST standards are also disallowed.
Section 2, amending 7 U.S.C. 2016(h) by adding paragraph (15)(E)
Grant Program for Retailer Payment Terminal Upgrades
The Secretary of Agriculture is required to establish a grant program to provide financial assistance to eligible entities, which include SNAP-authorized retailers (especially those in areas with limited grocery access) that do not have chip-compatible payment terminals. These grants will help these retailers upgrade their payment terminals to support both contact and contactless chip card technology, ensuring they can continue to accept EBT cards.
Section 3, amending 7 U.S.C. 2016(h) by adding paragraph (16)
Enhanced Security for Online EBT Transactions
This provision requires the Secretary to include specific security measures in the cybersecurity regulations for online EBT transactions. These measures must be effective in detecting and preventing benefit theft and protecting sensitive data from online merchants. It also mandates standard reporting methods for states to collect and share data on online fraud and requires consultation with various stakeholders, including state agencies and retailers.
Section 4, amending 7 U.S.C. 2016(h)(7)
Timely Replacement of Damaged, Lost, or Fraudulent EBT Cards
This provision requires states to ensure that a household receives a replacement EBT card within three business days after submitting a request, if the card is damaged, no longer functions, is stolen, or is frozen due to fraud. Households can choose to receive the card by mail or in person, and states are prohibited from requiring in-person collection as the only option.
Section 5, amending 7 U.S.C. 2016(h)(8)(A)
Prohibition on EBT Card Replacement Fees for Specific Reasons
This provision amends existing law to prohibit state agencies from collecting a charge for EBT card replacement if the replacement is due to the card malfunctioning, suspected or reported fraud by an individual outside the household, the expiration of the card, or a required replacement in compliance with the new cybersecurity regulations mandated by this Act.
Defines 'chip-enabled' as a payment card that uses industry standard secure payment technology, identified by the Administrator of the Food and Nutrition Service in consultation with the Secretary of the Treasury and the Director of the National Institute of Standards and Technology (NIST), that provides for secure card-based payment and is resistant to cloning. It also requires considering contact and contactless payment standards.
Section 2, amending 7 U.S.C. 2016(h) by adding paragraph (15)(A)(i)
Why it matters:This is standard legislative practice for defining terms that are central to the bill's operative provisions, ensuring clarity and technical precision for implementation.
Case for: Supporters argue that a precise, technically informed definition ensures that states implement truly secure and future-proof EBT card technology, aligning with evolving payment industry standards and maximizing fraud prevention.
Case against: Critics might argue that a highly specific definition, especially one that considers contact/contactless standards, could limit flexibility for states or lead to more expensive technology requirements that are difficult to adapt to future innovations.
Estimated impact: This definition directly shapes the technical requirements for all future EBT cards, impacting millions of cards and billions in transactions by setting the baseline for security technology.
This provision establishes a sunset clause for the requirement to use chip technology, stating that all EBT cards (with exceptions for disaster and summer EBT) issued during the 5-year period following the deadline for reissuing existing cards (i.e., 5-10 years after regulations become final) must be chip-enabled, unless the Secretary extends this period.
Section 2, amending 7 U.S.C. 2016(h) by adding paragraph (15)(B)(iii)
Why it matters:It functions as a long-term policy directive following the initial implementation mandates, ensuring sustained commitment to the technology rather than a one-time upgrade. Its placement is typical for such follow-on requirements.
Case for: Supporters argue this ensures sustained commitment to modern security standards beyond the initial transition period, preventing backsliding and maintaining a high level of protection against fraud for the long term.
Case against: The Secretary's ability to extend the period could introduce uncertainty or allow for delays in maintaining modern security, potentially undermining the long-term intent of the provision if extensions become routine.
Estimated impact: This provision guarantees that EBT cards remain chip-enabled for at least a decade, impacting all new card issuances and ensuring continued enhanced security for SNAP beneficiaries.
This section makes conforming amendments to Section 501 of division HH of the Consolidated Appropriations Act, 2023 (7 U.S.C. 2016a). It strikes and redesignates paragraphs in existing law related to EBT card security and fraud prevention, effectively replacing previous, less comprehensive mandates with the new, more detailed requirements of this bill.
Section 8
Why it matters:This is standard legislative practice to ensure consistency with existing statutes and to avoid conflicting provisions. While technical, its effect is to supersede and strengthen previous federal directives on EBT security.
Case for: Supporters argue this ensures a unified and stronger federal approach to EBT security by consolidating and updating previous, potentially piecemeal, directives into a more comprehensive and effective framework.
Case against: No specific opposition, as it's a technical amendment to align statutes and streamline federal policy, rather than introducing new controversial measures.
Estimated impact: This section replaces existing, less prescriptive EBT security mandates with the bill's detailed and robust framework, fundamentally altering the federal approach to SNAP cybersecurity and fraud prevention.