← Back to Bill Feed
FederalIn Committee
SNAP Payment Security and Fraud Prevention Act of 2026
Introduced Feb 2, 2026 · Last action Mar 20, 2026 — Referred to the Subcommittee on Nutrition and Foreign Agriculture.
Track this bill
Save bills and get alerts when status changes.
Sign in to saved bills.
Summary
This legislation is called the SNAP Payment Security and Fraud Prevention Act of 2026. Referred to the Subcommittee on Nutrition and Foreign Agriculture.
Full bill text
[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[H.R. 7316 Introduced in House (IH)]
<DOC>
119th CONGRESS
2d Session
H. R. 7316
To amend the Food and Nutrition Act of 2008 to require the promulgation
of cybersecurity regulations and implementation of EMV technology
relating to the use of EBT cards under the supplemental nutrition
assistance program, and for other purposes.
_______________________________________________________________________
IN THE HOUSE OF REPRESENTATIVES
February 2, 2026
Ms. Malliotakis introduced the following bill; which was referred to
the Committee on Agriculture
_______________________________________________________________________
A BILL
To amend the Food and Nutrition Act of 2008 to require the promulgation
of cybersecurity regulations and implementation of EMV technology
relating to the use of EBT cards under the supplemental nutrition
assistance program, and for other purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``SNAP Payment Security and Fraud
Prevention Act of 2026''.
SEC. 2. EXPANDED INVESTIGATIVE AUTHORITY OF THE DEPARTMENT OF
AGRICULTURE INSPECTOR GENERAL.
Section 16 of the Food and Nutrition Act of 2008 (7 U.S.C. 2025) is
amended by adding at the end the following:
``(i) Office of Inspector General Coordination Authority.--
``(1) The Inspector General of the Department of
Agriculture shall have full authority to investigate and
coordinate multi-jurisdictional efforts to prevent, detect, and
prosecute theft, misuse, or fraudulent accessing of
supplemental nutrition assistance program benefits, including
authority--
``(A) to investigate cyber-enabled benefit theft,
including skimming, cloning, phishing, spoofing, and
unauthorized access to EBT systems;
``(B) to issue subpoenas, executing warrants, and
initiating civil or criminal referrals;
``(C) to coordinate with the Department of Justice,
the Federal Bureau of Investigation, the Department of
Homeland Security, the Secret Service, State and local
law enforcement, and financial institutions;
``(D) to request and receive data from State EBT
processors and contracted vendors for investigative
purposes; and
``(E) to participate in interagency cyber task
forces or fraud detection initiatives.
``(2) The Secretary of Agriculture may issue rules, and
allocate funds, necessary to support the activities of the
Inspector General under this subsection.''.
SEC. 3. CIVIL PENALTY FOR THEFT OF SNAP BENEFITS.
Section 15 of the Food and Nutrition Act of 2008 (7 U.S.C. 2024) is
amended by adding at the end the following:
``(g) Civil Penalty for Theft of Supplemental Nutrition Assistance
Program Benefits.--
``(1) Any person who knowingly accesses, uses, or transfers
supplemental nutrition assistance program benefits issued to a
household without authorization shall be liable to the United
States for a civil penalty in an amount equal to twice the
value of such benefits lost as a result of such conduct.
``(2) The Secretary may assess and enforce this penalty
through an administrative proceeding under section 14 or
through a civil action in an appropriate district court of the
United States.
``(3) Funds recovered under this subsection shall be used,
as determined by the Secretary to offset--
``(A) the cost of reimbursing households for such
benefits lost as a result of the conduct described in
paragraph (1); and
``(B) the cost of the use of the enhanced
investigatory authority of the Inspector General of the
Department of Agriculture.
``(4) A civil penalty imposed under this subsection shall
be in addition to any other civil or criminal penalty imposed
under any other provision of this Act or under any other
provision of law.''.
SEC. 4. ENHANCED CYBERSECURITY FOR EBT CARDS.
Section 7(h) of the Food and Nutrition Act of 2008 (7 U.S.C.
2016(h)) is amended by adding at the end the following:
``(15) Cybersecurity of ebt cards.--
``(A) Definitions.--In this paragraph:
``(i) Chip-enabled.--
``(I) In general.--The term `chip-
enabled', with respect to a payment
card, means a payment card that uses
industry standard secure payment
technology, as identified by the
Administrator of the Food and Nutrition
Service, in consultation with the
Secretary of the Treasury and the
Director of the National Institute of
Standards and Technology, that--
``(aa) provides for secure
card-based payment; and
``(bb) is resistant to
cloning.
``(II) EMV chip.--The Administrator
of the Food and Nutrition Service, in
consultation with the Secretary of the
Treasury and the Director of the
National Institute of Standards and
Technology, shall consider whether the
secure payment technology described in
subclause (I) should meet the standards
published by EMVCo for contact and
contact less payments.
``(ii) Mobile friendly.--The term `mobile
friendly' has the meaning given the term in
section 3559(b) of title 44, United States
Code.
``(iii) NIST pin and password standards.--
The term `NIST PIN and password standards'
means the PIN and password standards described
in Special Publication 800-63B entitled
`Digital Identity Guidelines' (or a successor
document) of the National Institute of
Standards and Technology.
``(iv) PIN.--The term `PIN' has the meaning
given the term `personal identification number
(PIN)' in section 271.2 of title 7, Code of
Federal Regulations (or successor regulations).
``(B) Regulations.--
``(i) In general.--Not later than 2 years
after the date of the effective date of this
paragraph, the Secretary shall promulgate, and
every 5 years thereafter, the Secretary shall
review and update as necessary, cybersecurity
and digital service regulations relating to EBT
cards and mobile payments under the
supplemental nutrition assistance program,
including, at a minimum, to ensure that
cybersecurity measures for EBT cards and mobile
payments keep pace with security safeguards
used by the private sector and required by
Federal agencies for credit, debit, and other
payment cards and mobile payments.
``(ii) Requirements.--The Secretary shall
ensure that the cybersecurity and digital
service regulations described in clause (i)
require the following:
``(I)(aa) Each State shall operate
the user interfaces listed on the list
of required user interfaces maintained
by the Secretary under item (dd)(AA),
in accordance with this subclause, 1 or
more user interfaces of which
households in the State may, at the
election of the applicable household,
use to manage the EBT account of the
applicable household.
``(bb)(AA) A State may operate
other user interfaces under item (aa)
in addition to the required user
interfaces on the list maintained by
the Secretary under item (dd)(AA).
``(BB) Any web-based online portal
operated by a State as a user interface
shall be mobile friendly.
``(cc) Each user interface offered
by a State under items (aa) and (bb),
as applicable, shall--
``(AA) provide information
in each language in which the
State agency is required to
make material available
pursuant to section 272.4(b) of
title 7, Code of Federal
Regulations (or successor
regulations);
``(BB) be available to
households at least 99 percent
of the time; and
``(CC) include any other
features required by the
Secretary.
``(dd)(AA) The Secretary shall
maintain a list of required user
interfaces for purposes of item (aa),
which may include a web-based online
portal and a mobile application.
``(BB) The list under subitem (AA)
shall include an application
programming interface through which at
least 1 user interface offered by a
State under item (aa) allows households
to delegate access to some or all
account features identified by the
Secretary to third-party provided
software. No fee shall be charged to
any party for the use of that
application programming interface.
``(CC) During the 10-year period
following the date on which the
regulations promulgated pursuant to
clause (i) become final, unless the
Secretary extends that period, the
Secretary shall maintain on the list
under subitem (AA) the following user
interfaces: text message, voice
telephone service, and a nondigital
user interface that does not require
the use of a phone or computer by the
household.
``(II)(aa) Each State shall provide
households on an opt-in basis--
``(AA) through each digital
user interface offered under
subclause (I), timely
electronic notice of
transactions using the EBT
account of the household; and
``(BB) through each user
interface offered under
subclause (I), access to,
including the ability to
search, historical transactions
for not less than the preceding
12 months.
``(bb) Transaction information
under subitems (AA) and (BB) of item
(aa) shall include the amount of the
transaction, the merchant for the
transaction, the city and State of the
merchant for an in-person transaction,
and the delivery address or collection
address for an online transaction.
``(cc) Each State shall offer
households the ability, through each
user interface offered under subclause
(I), to report a fraudulent transaction
to the State.
``(dd) A State shall not require a
household to respond to or acknowledge
a notice of transaction delivered
pursuant to item (aa)(AA).
``(ee) A State shall notify a
household that has received
reimbursement for EBT card fraud
pursuant to section 501(b)(2) of
division HH of the Consolidated
Appropriations Act, 2023 (7 U.S.C.
2016a(b)(2)), of the ability of the
household to opt in to restricting the
use of the EBT card as described in
subclause (III) and of the remaining
funds that may be reimbursed if the
household experiences fraud again.
``(III) Each State shall provide
households issued an EBT card the
ability, through each user interface
offered under subclause (I)--
``(aa) to make the use of
that EBT card for online
transactions workable only
through virtual card numbers or
other tokenization technology,
such as through a mobile
payment service, which shall
require a different virtual
card number for each individual
online merchant;
``(bb) to freeze and
unfreeze the EBT account of the
household for transactions in
which the card number printed
on the EBT card is manually
entered, either for an in-
person transaction or an online
transaction; and
``(cc) to check the
enrollment status of the
household, including the date
on which the household is
required to apply for
recertification.
``(IV) The requirements described
in items (aa) and (bb) of subclause
(III) shall terminate 5 years after the
date on which the regulation
promulgated pursuant to that subclause
becomes final, unless the Secretary
extends that period.
``(V) A State may opt to make
ineffective the use of the card number
printed on the EBT card to complete an
online transaction, and require online
transactions to occur only in
accordance with subclause (III)(aa).
``(VI) Not later than 2 years after
the date on which the regulations
promulgated pursuant to clause (i)
become final, States shall begin
issuing chip-enabled EBT cards.
``(VII) Not later than 4 years
after the date on which the regulations
promulgated pursuant to clause (i)
become final, States may not issue new
EBT cards with magnetic stripes.
``(VIII) Not later than 5 years
after the date on which the regulations
promulgated pursuant to clause (i)
become final, States shall be required
to reissue any existing valid EBT cards
with magnetic stripes as chip-enabled
EBT cards without magnetic stripes.
``(IX) In the case of a chip-
enabled EBT card reissued pursuant to
any of subclauses (VI) through (VIII),
absent suspicion of fraud, as
applicable, a State shall--
``(aa) reissue a new chip-
enabled EBT card; and
``(bb) deactivate the
current chip-enabled EBT card
on the date that is the earlier
of--
``(AA) the date on
which the new chip-
enabled EBT card is
activated; and
``(BB) 30 days
after the date on which
the new chip-enabled
EBT card is sent to the
household.
``(iii) Sunset for requirement to use chip
technology.--Under the cybersecurity
regulations described in clause (i), all EBT
cards issued during the 5-year period following
the deadline for carrying out clause (ii)(VIII)
shall be chip-enabled, unless the Secretary
extends that period.
``(C) Prohibition on password and pin requirements
inconsistent with federal cybersecurity standards.--
Beginning 60 days after the date of enactment of this
paragraph, a State agency may not require, with respect
to a PIN for use of an EBT card or a password for
access to an online account or mobile application
managing the EBT card--
``(i) that the PIN or password be
periodically changed in circumstances that are
prohibited by the NIST PIN and password
standards; or
``(ii) that the password meet complexity
requirements that are prohibited by the NIST
PIN and password standards.
``(D) Data collection.--The Secretary shall--
``(i) collect, and publish on the website
of the Department of Agriculture, data on--
``(I) the length of time each user
interface offered by each State
pursuant to subparagraph (B)(ii)(I) was
unavailable for use, including due to
technical problems or maintenance
needs; and
``(II) cybersecurity measures
adopted for EBT cards in each State;
and
``(ii) maintain and annually update the
data collected under clause (i) to support
States in implementing any regulations
promulgated pursuant to subparagraph (B)(i).
``(E) Public report.--
``(i) In general.--Not later than 1 year
after the date of enactment of this paragraph,
and every 2 years thereafter, the Secretary
shall submit to the Committees on
Appropriations and Agriculture, Nutrition, and
Forestry of the Senate and the Committees on
Appropriations and Agriculture of the House of
Representatives, and make publicly available on
the website of the Department of Agriculture, a
report that--
``(I) identifies trends relating to
the theft of benefits, including the
frequency of theft of benefits and the
location of those thefts;
``(II) evaluates the effectiveness
of existing cybersecurity regulations
for the supplemental nutrition
assistance program, including
identifying ineffective measures and
the compliance burden borne by
individual benefit recipients;
``(III) describes the efforts of
States--
``(aa) to update
cybersecurity measures for EBT
cards; and
``(bb) to reimburse stolen
benefits; and
``(IV) examines usability issues of
EBT cards, including issues that
present barriers to households using
benefits or affect fraud prevention
goals.
``(ii) Restricted annex.--The report under
clause (i) may include a non-publicly available
annex containing classified or law enforcement-
sensitive information.''.
SEC. 5. ENSURING NO LOSS OF ACCESS TO BENEFITS DUE TO EBT CARD DAMAGE,
LOSS, OR FRAUD.
Section 7(h)(7) of the Food and Nutrition Act of 2008 (7 U.S.C.
2016(h)(7)) is amended--
(1) by striking ``Regulations'' and inserting the
following:
``(A) In general.--Regulations''; and
(2) by adding at the end the following:
``(B) Ensuring no loss of access to benefits due to
ebt card damage, loss, or fraud.--Not later than 180
days after the effective date of this subparagraph, the
Secretary shall promulgate regulations requiring the
following:
``(i) If an EBT card is damaged, no longer
functions properly, is stolen, or is frozen due
to fraud, the applicable State shall take the
necessary steps to ensure that the household
receives a replacement card, either by mail or
in person, as selected by the household, not
later than 3 business days after the household
submits to the State a request for a
replacement EBT card.
``(ii) A State shall not require, but shall
offer as an option, in-person collection of a
new or replacement EBT card.''.
SEC. 6. NO REPLACEMENT FEES FOR CERTAIN EBT CARDS.
Section 7(h)(8)(A) of the Food and Nutrition Act of 2008 (7 U.S.C.
2016(h)(8)(A)) is amended--
(1) by striking ``A State agency'' and inserting the
following:
``(i) In general.--Except as provided in
clause (ii), a State agency''; and
(2) by adding at the end the following:
``(ii) Exceptions.--Beginning 60 days after
the effective date of this clause, a State
agency may not collect a charge under clause
(i) if the replacement of the EBT card is due
to--
``(I) the EBT card malfunctioning;
``(II) suspected or reported fraud
relating to that EBT card by an
individual outside of the household to
which the EBT card belongs;
``(III) the expiration of the EBT
card; or
``(IV) required replacement of the
EBT card in compliance with regulations
promulgated pursuant to paragraph
(15)(B).''.
SEC. 7. REQUIREMENT FOR RETAILER USE OF CHIP-ENABLED PAYMENT TERMINALS
AS A CONDITION OF SNAP PARTICIPATION.
Section 9(a) of the Food and Nutrition Act of 2008 (7 U.S.C.
2018(a)) is amended--
(1) in paragraph (2)--
(A) by striking ``(2) The Secretary'' and inserting
the following:
``(2) Regulations.--The Secretary''; and
(B) by indenting the margins of subparagraphs (A)
and (B) appropriately;
(2) by indenting the margin of paragraph (3) appropriately;
and
(3) by adding at the end the following:
``(5) Chip-enabled payment terminals.--Beginning not later
than 180 days after the date on which the regulations
promulgated pursuant to section 7(h)(15)(B)(i) become final,
the Secretary shall require retail food stores and wholesale
food concerns seeking authorization or reauthorization to
accept and redeem benefits under the supplemental nutrition
assistance program to have a chip-enabled (as defined in
section 7(h)(15)(A)) payment terminal at each retail location
of the retail food store or wholesale food concern.''.
SEC. 8. REPORT.
(a) In General.--Not later than 1 year after the date of the
enactment of this Act, the Secretary of Agriculture shall submit to the
Committees on Appropriations and Agriculture, Nutrition, and Forestry
of the Senate and the Committees on Appropriations and Agriculture of
the House of Representatives, and make publicly available on the
website of the Department of Agriculture, a report on the security of
EBT cards (as defined in section 3 of the Food and Nutrition Act of
2008 (7 U.S.C. 2012)) issued in the Commonwealth of Puerto Rico,
including--
(1) the resistance of those EBT cards to cloning; and
(2) if appropriate, recommendations for improving the
security of the electronic benefit transfer system against EBT
card cloning-based fraud.
(b) Restricted Annex.--The report under subsection (a) may include
a non-publicly available annex containing classified or law
enforcement-sensitive information.
SEC. 9. CONFORMING AMENDMENTS.
Section 501 of division HH of the Consolidated Appropriations Act,
2023 (7 U.S.C. 2016a), is amended--
(1) in subsection (a)--
(A) by striking paragraphs (1) and (2);
(B) by redesignating paragraphs (3) through (5) as
paragraphs (1) through (3), respectively; and
(C) in paragraph (3) (as so redesignated)--
(i) in subparagraph (B), by adding ``and''
at the end;
(ii) by striking subparagraph (C); and
(iii) by redesignating subparagraph (D) as
subparagraph (C); and
(2) in subsection (b)--
(A) in paragraph (1)--
(i) in subparagraph (A)(vi), by striking
``measures'' and all that follows through
``(a)(1)'' and inserting ``measures'';
(ii) in subparagraph (B), by adding ``and''
at the end;
(iii) in subparagraph (C), by striking
``and'' at the end; and
(iv) by striking subparagraph (D); and
(B) in paragraph (3), by striking ``subsection
(a)(3)'' and inserting ``subsection (a)(1)''.
<all>Official legislative text sourced from the public record (cached on CivicsHQ).
Official source
View the original bill, actions, and full legislative record on Congress.gov.
Status
In Committee
- 1Introduced
- 2Committee
- 3Floor
- 4Passed
- 5Signed
Timeline reflects current normalized status only. Full action history is not yet stored in the API.
Sponsors
Cosponsors
No cosponsors on record.
Votes
Voting records are not yet available for this bill.