Enhanced Cybersecurity for SNAP Act of 2026

This bill amends the Food and Nutrition Act of 2008 to require new cybersecurity and digital service regulations for EBT cards used in the Supplemental Nutrition Assistance Program (SNAP). It mandates chip-enabled cards, user interfaces for account management, and retailer terminal upgrades, among other provisions.

Sec. 2, Enhanced cybersecurity for EBT cards: This section adds a new paragraph to the law defining terms like 'chip-enabled' and 'mobile friendly'. It requires the Secretary to issue cybersecurity and digital service regulations within 2 years, reviewed every 5 years, covering user interfaces (web portal, mobile app, text, phone, nondigital), transaction alerts, historical transaction access, fraud reporting, and chip-enabled card issuance. States must issue chip-enabled cards within 2 years of final regulations, stop issuing magnetic stripe cards within 4 years, and reissue existing magnetic stripe cards within 5 years. The Secretary must reimburse states for reasonable costs of upgrading cards. It prohibits PIN and password rules inconsistent with NIST standards. A grant program is established for chip-compatible payment terminals for eligible retailers. The Secretary must collect and publish data on interface availability and cybersecurity measures, and submit a public report every 2 years on benefit theft trends and cybersecurity effectiveness.

Sec. 3, Online transaction security: This section requires the Secretary, when updating regulations, to mandate security measures for online EBT transactions to detect and prevent theft, establish standard reporting methods for states, and consider cost and feasibility. The Secretary must consult with various agencies and stakeholders, and submit a report every 2 years on theft frequency, measures taken, and recommendations.

Sec. 4, Ensuring no loss of access to benefits due to EBT card damage, loss, or fraud: This section requires the Secretary to issue regulations within 180 days ensuring states provide a replacement EBT card within 3 business days if the card is damaged, stolen, or frozen due to fraud, with the household choosing mail or in-person delivery. States must offer in-person collection as an option, not a requirement.

Sec. 5, No replacement fees for certain EBT cards: This section prohibits states from charging a fee for replacing an EBT card if the replacement is due to malfunction, suspected fraud, expiration, or required compliance with the new chip-enabled card regulations.

Sec. 6, Requirement for retailer use of chip-enabled payment terminals as a condition of SNAP participation: This section requires the Secretary to mandate that retail food stores and wholesale food concerns have a chip-enabled payment terminal at each retail location to be authorized or reauthorized to accept SNAP benefits, starting 180 days after the final regulations.

Sec. 7, Report on EBT cards issued in Puerto Rico: This section requires the Secretary to submit a public report within 1 year on the security of EBT cards in Puerto Rico, including resistance to cloning and recommendations for improvement. A restricted annex may be included.

Sec. 8, Conforming amendments: This section makes technical changes to the Consolidated Appropriations Act, 2023, to remove outdated provisions and align with the new requirements.