Enhanced Cybersecurity for SNAP Act of 2026
- Sponsor
- Sen. Wyden, Ron [D-OR]
- Committees
- Agriculture, Nutrition, and Forestry Committee (primary)
- Last action
- Feb 26, 2026
Bottom line
This bill aims to modernize EBT card security and digital access for SNAP recipients, addressing fraud and usability, but requires significant state and retailer upgrades with federal financial support.
What it actually does
This bill mandates the U.S. Department of Agriculture (USDA) to promulgate and regularly update cybersecurity and digital service regulations for Electronic Benefit Transfer (EBT) cards used in the Supplemental Nutrition Assistance Program (SNAP). It requires states to transition to chip-enabled EBT cards, offer modern digital user interfaces for account management, provide transaction notifications, and waive replacement fees for certain circumstances. Additionally, it establishes a grant program to help retailers upgrade to chip-compatible payment terminals and requires retailers to have such terminals as a condition of SNAP participation.
Proponents argue
Proponents argue that the bill is essential to protect vulnerable SNAP benefits from rampant fraud, particularly card skimming, by bringing EBT technology up to par with private sector payment systems. They contend that enhanced digital interfaces and timely transaction notifications will significantly improve accessibility, transparency, and user control for SNAP recipients, empowering them to manage their benefits more effectively and detect fraud sooner.
Opponents contend
Opponents may raise concerns about the substantial implementation costs and logistical challenges for states and small retailers, despite the federal reimbursement and grant programs. They might also argue that the aggressive timelines for technological transitions could lead to disruptions in benefit access or administrative burdens that outweigh the security benefits, particularly for states with legacy IT systems or retailers in remote areas.
The bill is moderately complex, requiring careful reading to understand the technical and regulatory details, which may exceed the time typically allotted for quick review.
Section 2, amending 7 U.S.C. 2016(h)(15)(B)(i)
Mandate for Cybersecurity and Digital Service Regulations
This provision requires the Secretary of Agriculture to create and regularly update cybersecurity and digital service regulations for EBT cards and mobile technologies under SNAP. The goal is to ensure these security measures keep pace with those used by the private sector and required by other federal agencies for credit, debit, and other payment cards.
Supporters argue
Proponents argue that these regulations are essential to protect vulnerable SNAP benefits from modern fraud techniques like skimming and to align EBT technology with current industry-standard payment security, which will build trust and program integrity.
Critics contend
States may argue that the process of developing and implementing comprehensive new regulations, especially those requiring alignment with rapidly evolving private sector standards, could be complex and resource-intensive, potentially leading to delays or unforeseen costs.
Tradeoffs
The primary tension is balancing the need for robust, up-to-date security against the practical challenges and costs of developing and implementing complex technical regulations across all state SNAP programs.
Section 2, amending 7 U.S.C. 2016(h)(15)(B)(ii)(I)
Standardized and Accessible Digital User Interfaces
This provision mandates that states operate specific user interfaces, such as web-based portals and mobile applications, for SNAP households to manage their EBT accounts. These interfaces must be mobile-friendly, available in multiple languages, and maintain at least 99% uptime. It also requires an application programming interface (API) to allow third-party software access to account features without charge.
Section 2, amending 7 U.S.C. 2016(h)(15)(B)(ii)(II)
Timely Electronic Transaction Notices and Fraud Reporting
This provision requires states to offer SNAP households the option to receive timely electronic notices of EBT transactions through digital interfaces. It also mandates access to at least 12 months of historical transaction data, including merchant details and location. Furthermore, states must provide a mechanism for households to report fraudulent transactions and notify fraud victims about potential reimbursements.
Section 2, amending 7 U.S.C. 2016(h)(15)(B)(ii)(IV)-(VI)
Transition to Chip-Enabled EBT Cards
This provision mandates a phased transition to chip-enabled EBT cards. States must begin issuing new chip-enabled EBT cards within two years of the regulations becoming final. Within four years, states are prohibited from issuing any new EBT cards with magnetic stripes. Finally, within five years, states must reissue all existing valid EBT cards that still have magnetic stripes as chip-enabled cards without magnetic stripes.
Section 2, amending 7 U.S.C. 2016(h)(15)(C)
Federal Reimbursement for State Upgrade Costs
This provision ensures that states upgrading their EBT cards to comply with the new regulations will receive full reimbursement from the Secretary of Agriculture. This reimbursement covers all reasonable costs incurred by the state, including one-time upfront payments to card vendors, additional annual fees associated with chip-enabled cards, and postage or other delivery-related expenses for card distribution.
Section 2, amending 7 U.S.C. 2016(h)(15)(D)
Alignment of PIN/Password Standards with NIST Guidelines
This provision prohibits state agencies from requiring EBT card PINs or online account passwords to be periodically changed in circumstances forbidden by the NIST PIN and password standards. It also prevents states from enforcing password complexity requirements that are inconsistent with these NIST Digital Identity Guidelines.
Section 2, amending 7 U.S.C. 2016(h)(15)(E)
Grant Program for Retailer Payment Terminal Upgrades
This provision establishes a grant program, administered by the Secretary, to provide subgrants to eligible entities. These eligible entities include SNAP-authorized retailers (especially those in areas with limited grocery access) and other food providers who do not currently have payment terminals that accept chip-enabled EBT cards. The purpose of the subgrants is to help these entities upgrade to chip-compatible payment terminals that support both contact and contactless payment card technology.
Section 2, amending 7 U.S.C. 2016(h)(15)(F)-(G)
Data Collection and Public Reports on EBT Security and Fraud
This provision requires the Secretary to collect and publish data on user interface availability and cybersecurity measures adopted by each state. It also mandates biennial public reports to Congress and the public. These reports must identify trends in benefit theft (frequency, locations, methods), evaluate the effectiveness of existing cybersecurity regulations, describe state efforts in security and reimbursement, and examine usability issues of EBT cards, with a restricted annex for sensitive information.
Section 3, amending 7 U.S.C. 2016(h)(16)
Enhanced Security for Online EBT Transactions
This provision requires the Secretary to include specific security measures in the new cybersecurity regulations for online EBT transactions. These measures must be effective in detecting and preventing benefit theft, including data theft from online merchants, and securely managing sensitive data. It also mandates the establishment of standard reporting methods for states to collect and share data on online transaction fraud. The Secretary must consult with various stakeholders, including state agencies and retailers, and consider cost and implementation feasibility.
Section 4, amending 7 U.S.C. 2016(h)(7)(B)
Timely Replacement of Damaged, Lost, or Fraud-Affected EBT Cards
This provision requires states to ensure that SNAP households receive a replacement EBT card within three business days if their card is damaged, no longer functions, is stolen, or is frozen due to fraud. Households can choose to receive the replacement card either by mail or in person, and states are prohibited from requiring in-person collection.
Section 5, amending 7 U.S.C. 2016(h)(8)(A)(ii)
Waiving Replacement Fees for Fraud, Malfunction, or Required Upgrades
This provision prohibits state agencies from collecting a charge for EBT card replacement if the replacement is due to the card malfunctioning, suspected or reported fraud by an individual outside the household, the card's expiration, or a required replacement to comply with the new chip-enabled card regulations.
Section 6, amending 7 U.S.C. 2018(a)(5)
Mandate for Retailer Chip-Enabled Payment Terminals
This provision requires that, as a condition for authorization or reauthorization to accept and redeem SNAP benefits, retail food stores and wholesale food concerns must have a chip-enabled payment terminal at each of their retail locations. This requirement takes effect 180 days after the regulations for chip-enabled EBT cards become final.
Section 7
Report on EBT Card Security in Puerto Rico
This provision requires the Secretary of Agriculture to submit a report within one year of the bill's enactment on the security of EBT cards issued in the Commonwealth of Puerto Rico. The report must assess the cards' resistance to cloning and, if appropriate, provide recommendations for improving the electronic benefit transfer system's security against cloning-based fraud. A nonpublic annex may be included for sensitive information.
The requirement for all EBT cards (with specific exceptions for disaster and summer EBT) to be chip-enabled sunsets after a 5-year period following the deadline for reissuing magnetic stripe cards, unless the Secretary extends this period.
Section 2, amending 7 U.S.C. 2016(h)(15)(B)(iii)
Why it matters:This is likely standard legislative practice to build in flexibility for future technological advancements. It prevents the program from being permanently locked into chip technology if more secure or efficient payment methods emerge, allowing for re-evaluation without needing new legislation.
Case for: Supporters would argue that this sunset clause provides essential flexibility, allowing the USDA to adapt to future payment technologies and avoid obsolescence, ensuring that SNAP's security measures can evolve with the threat landscape.
Case against: Critics might contend that a sunset clause could create uncertainty about long-term security standards or necessitate another legislative fix if chip technology remains the most effective solution, potentially leading to future policy instability.
Estimated impact: This provision determines the long-term technological trajectory and security standards for EBT cards, influencing future investments and fraud prevention strategies.
This section makes conforming amendments to Section 501 of division HH of the Consolidated Appropriations Act, 2023, by striking and redesignating paragraphs. Specifically, it repeals previous paragraphs related to EBT card security measures and updates cross-references, effectively superseding prior cybersecurity regulations for SNAP.
Section 8
Why it matters:This is standard legislative practice for ensuring that new legislation integrates smoothly with existing law. It's buried because it's a technical cleanup, not a new policy initiative, but it's essential for clarifying which set of regulations governs EBT cybersecurity.
Case for: Supporters would argue that these amendments are necessary to avoid conflicting mandates and ensure that the comprehensive, updated cybersecurity regulations established by this bill are the sole governing framework for EBT security, providing clarity for states and the USDA.
Case against: No direct case against, as these are technical corrections. However, if the new regulations were seen as weaker, then the superseding nature of this section could be criticized indirectly.
Estimated impact: This provision clarifies the legal framework for EBT cybersecurity, ensuring consistency and preventing regulatory confusion between old and new mandates.