Section 1. Short title

This Act may be cited as the SNAP Payment Security and Fraud Prevention Act of 2026.

Sec. 2. Expanded investigative authority of the Department of Agriculture Inspector General

Section 16 of the Food and Nutrition Act of 2008 (7 U.S.C. 2025) is amended by adding at the end the following:

(i) Office of Inspector General coordination authority

(1)

The Inspector General of the Department of Agriculture shall have full authority to investigate and coordinate multi-jurisdictional efforts to prevent, detect, and prosecute theft, misuse, or fraudulent accessing of supplemental nutrition assistance program benefits, including authority—

(A)

to investigate cyber-enabled benefit theft, including skimming, cloning, phishing, spoofing, and unauthorized access to EBT systems;

(B)

to issue subpoenas, executing warrants, and initiating civil or criminal referrals;

(C)

to coordinate with the Department of Justice, the Federal Bureau of Investigation, the Department of Homeland Security, the Secret Service, State and local law enforcement, and financial institutions;

(D)

to request and receive data from State EBT processors and contracted vendors for investigative purposes; and

(E)

to participate in interagency cyber task forces or fraud detection initiatives.

(2)

The Secretary of Agriculture may issue rules, and allocate funds, necessary to support the activities of the Inspector General under this subsection.

Sec. 3. Civil penalty for theft of SNAP benefits

Section 15 of the Food and Nutrition Act of 2008 (7 U.S.C. 2024) is amended by adding at the end the following:

(g) Civil penalty for theft of supplemental nutrition assistance program benefits

(1)

Any person who knowingly accesses, uses, or transfers supplemental nutrition assistance program benefits issued to a household without authorization shall be liable to the United States for a civil penalty in an amount equal to twice the value of such benefits lost as a result of such conduct.

(2)

The Secretary may assess and enforce this penalty through an administrative proceeding under section 14 or through a civil action in an appropriate district court of the United States.

(3)

Funds recovered under this subsection shall be used, as determined by the Secretary to offset—

(A)

the cost of reimbursing households for such benefits lost as a result of the conduct described in paragraph (1); and

(B)

the cost of the use of the enhanced investigatory authority of the Inspector General of the Department of Agriculture.

(4)

A civil penalty imposed under this subsection shall be in addition to any other civil or criminal penalty imposed under any other provision of this Act or under any other provision of law.

Sec. 4. Enhanced cybersecurity for EBT cards

Section 7(h) of the Food and Nutrition Act of 2008 (7 U.S.C. 2016(h)) is amended by adding at the end the following:

(15) Cybersecurity of EBT cards

(A) Definitions

In this paragraph:

(i) Chip-enabled

(I) In general

The term chip-enabled, with respect to a payment card, means a payment card that uses industry standard secure payment technology, as identified by the Administrator of the Food and Nutrition Service, in consultation with the Secretary of the Treasury and the Director of the National Institute of Standards and Technology, that—

(aa)

provides for secure card-based payment; and

(bb)

is resistant to cloning.

(II) EMV chip

The Administrator of the Food and Nutrition Service, in consultation with the Secretary of the Treasury and the Director of the National Institute of Standards and Technology, shall consider whether the secure payment technology described in subclause (I) should meet the standards published by EMVCo for contact and contact less payments.

(ii) Mobile friendly

The term ‘mobile friendly’ has the meaning given the term in section 3559(b) of title 44, United States Code.

(iii) NIST PIN and password standards

The term NIST PIN and password standards means the PIN and password standards described in Special Publication 800–63B entitled Digital Identity Guidelines (or a successor document) of the National Institute of Standards and Technology.

(iv) PIN

The term PIN has the meaning given the term personal identification number (PIN) in section 271.2 of title 7, Code of Federal Regulations (or successor regulations).

(B) Regulations

(i) In general

Not later than 2 years after the date of the effective date of this paragraph, the Secretary shall promulgate, and every 5 years thereafter, the Secretary shall review and update as necessary, cybersecurity and digital service regulations relating to EBT cards and mobile payments under the supplemental nutrition assistance program, including, at a minimum, to ensure that cybersecurity measures for EBT cards and mobile payments keep pace with security safeguards used by the private sector and required by Federal agencies for credit, debit, and other payment cards and mobile payments.

(ii) Requirements

The Secretary shall ensure that the cybersecurity and digital service regulations described in clause (i) require the following:

(I)

(aa)

Each State shall operate the user interfaces listed on the list of required user interfaces maintained by the Secretary under item (dd)(AA), in accordance with this subclause, 1 or more user interfaces of which households in the State may, at the election of the applicable household, use to manage the EBT account of the applicable household.

(bb)

(AA)

A State may operate other user interfaces under item (aa) in addition to the required user interfaces on the list maintained by the Secretary under item (dd)(AA).

(BB)

Any web-based online portal operated by a State as a user interface shall be mobile friendly.

(cc)

Each user interface offered by a State under items (aa) and (bb), as applicable, shall—

(AA)

provide information in each language in which the State agency is required to make material available pursuant to section 272.4(b) of title 7, Code of Federal Regulations (or successor regulations);

(BB)

be available to households at least 99 percent of the time; and

(CC)

include any other features required by the Secretary.

(dd)

(AA)

The Secretary shall maintain a list of required user interfaces for purposes of item (aa), which may include a web-based online portal and a mobile application.

(BB)

The list under subitem (AA) shall include an application programming interface through which at least 1 user interface offered by a State under item (aa) allows households to delegate access to some or all account features identified by the Secretary to third-party provided software. No fee shall be charged to any party for the use of that application programming interface.

(CC)

During the 10-year period following the date on which the regulations promulgated pursuant to clause (i) become final, unless the Secretary extends that period, the Secretary shall maintain on the list under subitem (AA) the following user interfaces: text message, voice telephone service, and a nondigital user interface that does not require the use of a phone or computer by the household.

(II)

(aa)

Each State shall provide households on an opt-in basis—

(AA)

through each digital user interface offered under subclause (I), timely electronic notice of transactions using the EBT account of the household; and

(BB)

through each user interface offered under subclause (I), access to, including the ability to search, historical transactions for not less than the preceding 12 months.

(bb)

Transaction information under subitems (AA) and (BB) of item (aa) shall include the amount of the transaction, the merchant for the transaction, the city and State of the merchant for an in-person transaction, and the delivery address or collection address for an online transaction.

(cc)

Each State shall offer households the ability, through each user interface offered under subclause (I), to report a fraudulent transaction to the State.

(dd)

A State shall not require a household to respond to or acknowledge a notice of transaction delivered pursuant to item (aa)(AA).

(ee)

A State shall notify a household that has received reimbursement for EBT card fraud pursuant to section 501(b)(2) of division HH of the Consolidated Appropriations Act, 2023 (7 U.S.C. 2016a(b)(2)), of the ability of the household to opt in to restricting the use of the EBT card as described in subclause (III) and of the remaining funds that may be reimbursed if the household experiences fraud again.

(III)

Each State shall provide households issued an EBT card the ability, through each user interface offered under subclause (I)—

(aa)

to make the use of that EBT card for online transactions workable only through virtual card numbers or other tokenization technology, such as through a mobile payment service, which shall require a different virtual card number for each individual online merchant;

(bb)

to freeze and unfreeze the EBT account of the household for transactions in which the card number printed on the EBT card is manually entered, either for an in-person transaction or an online transaction; and

(cc)

to check the enrollment status of the household, including the date on which the household is required to apply for recertification.

(IV)

The requirements described in items (aa) and (bb) of subclause (III) shall terminate 5 years after the date on which the regulation promulgated pursuant to that subclause becomes final, unless the Secretary extends that period.

(V)

A State may opt to make ineffective the use of the card number printed on the EBT card to complete an online transaction, and require online transactions to occur only in accordance with subclause (III)(aa).

(VI)

Not later than 2 years after the date on which the regulations promulgated pursuant to clause (i) become final, States shall begin issuing chip-enabled EBT cards.

(VII)

Not later than 4 years after the date on which the regulations promulgated pursuant to clause (i) become final, States may not issue new EBT cards with magnetic stripes.

(VIII)

Not later than 5 years after the date on which the regulations promulgated pursuant to clause (i) become final, States shall be required to reissue any existing valid EBT cards with magnetic stripes as chip-enabled EBT cards without magnetic stripes.

(IX)

In the case of a chip-enabled EBT card reissued pursuant to any of subclauses (VI) through (VIII), absent suspicion of fraud, as applicable, a State shall—

(aa)

reissue a new chip-enabled EBT card; and

(bb)

deactivate the current chip-enabled EBT card on the date that is the earlier of—

(AA)

the date on which the new chip-enabled EBT card is activated; and

(BB)

30 days after the date on which the new chip-enabled EBT card is sent to the household.

(iii) Sunset for requirement to use chip technology

Under the cybersecurity regulations described in clause (i), all EBT cards issued during the 5-year period following the deadline for carrying out clause (ii)(VIII) shall be chip-enabled, unless the Secretary extends that period.

(C) Prohibition on password and PIN requirements inconsistent with federal cybersecurity standards

Beginning 60 days after the date of enactment of this paragraph, a State agency may not require, with respect to a PIN for use of an EBT card or a password for access to an online account or mobile application managing the EBT card—

(i)

that the PIN or password be periodically changed in circumstances that are prohibited by the NIST PIN and password standards; or

(ii)

that the password meet complexity requirements that are prohibited by the NIST PIN and password standards.

(D) Data collection

The Secretary shall—

(i)

collect, and publish on the website of the Department of Agriculture, data on—

(I)

the length of time each user interface offered by each State pursuant to subparagraph (B)(ii)(I) was unavailable for use, including due to technical problems or maintenance needs; and

(II)

cybersecurity measures adopted for EBT cards in each State; and

(ii)

maintain and annually update the data collected under clause (i) to support States in implementing any regulations promulgated pursuant to subparagraph (B)(i).

(E) Public report

(i) In general

Not later than 1 year after the date of enactment of this paragraph, and every 2 years thereafter, the Secretary shall submit to the Committees on Appropriations and Agriculture, Nutrition, and Forestry of the Senate and the Committees on Appropriations and Agriculture of the House of Representatives, and make publicly available on the website of the Department of Agriculture, a report that—

(I)

identifies trends relating to the theft of benefits, including the frequency of theft of benefits and the location of those thefts;

(II)

evaluates the effectiveness of existing cybersecurity regulations for the supplemental nutrition assistance program, including identifying ineffective measures and the compliance burden borne by individual benefit recipients;

(III)

describes the efforts of States—

(aa)

to update cybersecurity measures for EBT cards; and

(bb)

to reimburse stolen benefits; and

(IV)

examines usability issues of EBT cards, including issues that present barriers to households using benefits or affect fraud prevention goals.

(ii) Restricted annex

The report under clause (i) may include a non-publicly available annex containing classified or law enforcement-sensitive information.

Sec. 5. Ensuring no loss of access to benefits due to EBT card damage, loss, or fraud

Section 7(h)(7) of the Food and Nutrition Act of 2008 (7 U.S.C. 2016(h)(7)) is amended—

Sec. 6. No replacement fees for certain EBT cards

Section 7(h)(8)(A) of the Food and Nutrition Act of 2008 (7 U.S.C. 2016(h)(8)(A)) is amended—

Sec. 7. Requirement for retailer use of chip-enabled payment terminals as a condition of SNAP participation

Section 9(a) of the Food and Nutrition Act of 2008 (7 U.S.C. 2018(a)) is amended—

Sec. 8. Report

Sec. 9. Conforming amendments

Section 501 of division HH of the Consolidated Appropriations Act, 2023 (7 U.S.C. 2016a), is amended—