HR7658-119

What This Bill Does

The Enhanced Cybersecurity for SNAP Act requires USDA within two years to issue EBT cybersecurity and digital-service regulations and review them every five years. States must operate federally required account interfaces, offer at least one household-selected management channel, make web portals mobile friendly, provide required languages, maintain 99 percent availability, and support a free API through which households can delegate selected features to third-party software.

For ten years after final rules, unless extended, required channels include text, voice telephone, and a nondigital option not requiring a phone or computer. Households may opt into transaction alerts, search at least 12 months of history, report fraud through every interface, receive information about possible future fraud reimbursement, and check enrollment and recertification dates.

States must begin issuing chip-enabled, cloning-resistant cards within two years after final rules, stop issuing new magnetic-stripe cards within four years, and replace valid magnetic cards within five years. Except for disaster and Summer EBT cards, cards issued during the next five years must remain chip-enabled unless USDA extends that period, creating a statutory chip-technology sunset window rather than a permanent mandate. Replacement cards generally deactivate at activation or 60 days after mailing.

USDA must reimburse all reasonable state upgrade costs as determined by the Secretary, including vendor charges, annual chip fees, and delivery. Within 60 days of enactment, states cannot impose periodic-change or complexity requirements that NIST standards prohibit. USDA must create a grant-and-subgrant program for authorized retailers in limited-grocery-access areas that lack chip terminals, but the bill states no grant appropriation amount.

Online EBT transactions receive theft-prevention, sensitive-data, retailer-security, and state-reporting standards that account for cost and feasibility. USDA reports on online theft within three years and every two years thereafter. Separate regulations due within 180 days require a household-selected mailed or in-person replacement within three business days after a damaged, failed, stolen, or fraud-frozen card request. In-person pickup cannot be mandatory.

After 60 days, states cannot charge replacement fees for malfunction, outsider fraud, expiration, or mandatory chip conversion. Within 180 days after final cybersecurity rules, SNAP authorization or reauthorization requires a chip-capable terminal at each retailer location. USDA must publish interface uptime and state-security data annually, report benefit-theft and usability trends after one year and biennially, and issue a Puerto Rico cloning-security report within one year.

The bill improves access and security but does not itself reimburse stolen benefits, guarantee a household against every outage, fund a stated grant total, or permanently require chips after the specified window unless USDA extends it.

Who Benefits and How

SNAP households gain safer cards, accessible management channels, alerts, history, fraud reporting, three-day replacement, fee protection, and easier recertification tracking. Fraud victims face lower repeat-loss risk. Small retailers in low-access areas can receive terminal subgrants. States recover reasonable conversion costs, and payment-security vendors gain work.

Who Bears the Burden and How

States must rebuild interfaces, achieve uptime and language standards, issue and replace cards, protect APIs, collect data, and serve households through digital and nondigital channels. Retailers need chip terminals for authorization. USDA, NIST, Treasury, ACF, DOJ, vendors, and contractors face rulemaking and coordination work. Privacy risk grows with detailed transaction and delivery-address data, while outages or premature deactivation can still interrupt food access.

Key Provisions

• Requires federal EBT cybersecurity rules within two years.
• Requires five-year regulatory reviews.
• Requires multilingual, 99-percent-available account interfaces.
• Requires a free third-party software API.
• Preserves text, phone, and nondigital channels for ten years.
• Provides opt-in transaction alerts and 12-month history.
• Provides fraud reporting and enrollment-status tools.
• Establishes a staged magnetic-to-chip card transition.
• Reimburses reasonable state conversion costs.
• Aligns PIN and password rules with NIST.
• Creates retailer terminal subgrants.
• Requires online transaction and retailer security.
• Requires replacement cards within three business days.
• Prohibits mandatory in-person pickup.
• Prohibits specified replacement fees.
• Conditions retailer authorization on chip terminals.
• Requires public uptime and cybersecurity data.
• Requires recurring theft and usability reports.
• Requires a Puerto Rico card-security report.
• Provides no direct statutory stolen-benefit reimbursement.