Enhanced Cybersecurity for SNAP Act of 2026

This bill amends the Food and Nutrition Act of 2008 to require new cybersecurity and digital service regulations for EBT cards used in the Supplemental Nutrition Assistance Program (SNAP). It mandates chip-enabled cards, user interfaces for account management, transaction notifications, and retailer payment terminal upgrades, among other provisions.

Sec. 2, Enhanced cybersecurity for EBT cards: The Secretary of Agriculture must issue regulations within 2 years, reviewed every 5 years, requiring states to provide user interfaces (like online portals and mobile apps) for households to manage EBT accounts, including transaction alerts and fraud reporting. States must issue chip-enabled EBT cards within 2 years of final regulations, phase out magnetic stripes within 4 years, and reissue existing magnetic stripe cards as chip-enabled within 5 years. The Secretary must reimburse states for reasonable costs of upgrading cards. States cannot require PIN or password changes or complexity rules that violate NIST standards. A grant program will help eligible retailers upgrade to chip-compatible payment terminals. The Secretary must collect and publish data on interface availability and cybersecurity measures, and submit a public report every 2 years on benefit theft trends and regulation effectiveness.

Sec. 3, Online transaction security: The regulations must include security measures to detect and prevent theft of benefits through online transactions, establish standard reporting methods for states, and consider feasibility for states. The Secretary must consult with various agencies and stakeholders, and submit a report every 2 years on online theft frequency, measures taken, and recommendations.

Sec. 4, Ensuring no loss of access to benefits due to EBT card damage, loss, or fraud: Within 180 days, the Secretary must issue regulations requiring states to replace damaged, stolen, or fraud-frozen EBT cards within 3 business days of a household request, by mail or in-person as chosen by the household. States cannot require in-person collection but must offer it as an option.

Sec. 5, No replacement fees for certain EBT cards: States cannot charge a fee for replacing an EBT card if the replacement is due to malfunction, suspected or reported fraud by someone outside the household, card expiration, or required replacement under the new cybersecurity regulations.

Sec. 6, Requirement for retailer use of chip-enabled payment terminals as a condition of SNAP participation: Within 180 days after the cybersecurity regulations become final, the Secretary must require retail food stores and wholesale food concerns seeking authorization or reauthorization to accept SNAP benefits to have a chip-enabled payment terminal at each retail location.

Sec. 7, Report on EBT cards issued in Puerto Rico: Within 1 year, the Secretary must submit a public report on the security of EBT cards issued in Puerto Rico, including their resistance to cloning and recommendations for improvement. A restricted annex may include classified or law enforcement-sensitive information.

Sec. 8, Conforming amendments: This section makes technical changes to the Consolidated Appropriations Act, 2023, to remove outdated provisions and align with the new cybersecurity requirements.