WeVote
Log In

Bill

Bill

HR 7658

Enhanced Cybersecurity for SNAP Act of 2026

119th Congress Introduced by Brian Fitzpatrick and 6 co-sponsors

The bill would modernize SNAP EBT security by moving to chip-enabled cards, strengthen online/offline protections, expand user transparency, and fund upgrades.

Referred to the Subcommittee on Nutrition and Foreign Agriculture.
0
WeVote Research Nonpartisan
Bill Summary · HR 7658

Summary of HR 7658 — Enhanced Cybersecurity for SNAP Act of 2026

  • Purpose and intent

    • Proposes to amend the Food and Nutrition Act of 2008 to strengthen cybersecurity and digital service regulations governing Electronic Benefit Transfer (EBT) cards used in the Supplemental Nutrition Assistance Program (SNAP).
    • Aims to modernize security standards, upgrade EBT technology to chip-enabled (and eventually mobile-friendly) systems, improve online transaction security, and enhance consumer protections and data reporting.

  • Key provisions and changes

    • Cybersecurity regulations for EBT cards (section added to 7(h))
    • Defines key terms and standards for chip-enabled "HIP-enabled" payment technology, mobile-friendliness, NIST PIN/password standards, and related concepts.
    • Requires the Secretary of Agriculture (in consultation with the Treasury Secretary and NIST) to promulgate cybersecurity and digital service regulations within 2 years of enactment, with updates every 5 years.
    • Regulations must ensure:
      • State-operated user interfaces to manage EBT accounts: States may choose among listed or additional interfaces; web portals must be mobile-friendly; interfaces must be multilingual and high-availability (available at least 99% of the time); include features required by the Secretary.
      • A maintained list of required user interfaces, including an API (an API allows third-party software access) with no fees for API use.
      • Inclusion of legacy interfaces (text, voice, non-digital options) for at least a 10-year period after initial regulations.
      • Opt-in disclosure: households must receive timely electronic notices of transactions; access to transaction history for at least 12 months; detailed transaction data (amount, merchant, location, delivery/collection address). Ability for households to report fraudulent transactions; households cannot be obliged to acknowledge notices of transactions.
      • Enrollment status checks for recertification dates.
      • A phased transition to chip-enabled EBT cards:
      • By not later than 2 years after final regulations, States must begin issuing chip-enabled EBT cards.
      • By not later than 4 years, states may not issue magnetic-stripe cards for new EBTs.
      • By not later than 5 years, all existing magnetic-stripe cards must be reissued as chip-enabled cards.
      • In reissuance, the replacement should occur on or before the activation date or within 60 days, whichever is earlier; if no fraud suspicion, require reissuance.
      • Any transition period to avoid requiring chip technology for certain disasters or exemptions, but with a general mandate to move toward chip-enabled cards.
      • The chip-enabled requirement would supersede preexisting regulations.
    • Reimbursements for states (section on chip-enabled upgrades)
    • States upgrading to chip-enabled EBT cards may receive reimbursement from the federal government to cover up-front card vendor costs, ongoing chip-enabled card fees, and postage/delivery costs.
    • Prohibition on incompatible PIN/password requirements (to align with federal standards)
    • States may not require frequent PIN/password changes or overly complex password requirements not in line with NIST PIN/password standards.
    • Grant program for chip-enabled upgrades (section 15)
    • Establishes a grant program to fund subgrants to eligible entities that assist in upgrading payment terminals to chip-enabled technology, prioritizing areas with limited grocery access and those lacking current chip-enabled terminals.
    • Data collection and public reporting (sections 6 and 3)
    • The Secretary must collect and publish state-level data on:
      • Availability of user interfaces and cybersecurity measures.
      • Trends in theft of benefits and effectiveness of cybersecurity measures.
      • State efforts to update cybersecurity measures and reimburse stolen benefits.
      • Usability issues and barriers to program access.
    • Regular public reporting (biennially; initial report within 1 year of enactment).
    • Online transaction security (new section 16)
    • For online EBT transactions, the Secretary must require security measures to detect and prevent online benefit theft and data breaches, and to securely manage data from online transactions.
    • Establish standard reporting methods for online theft data and ensure costs feasibility for states.
    • Requires interagency and stakeholder consultation on measures and theft dynamics.
    • A federal report to Congress every 3 years (biennially thereafter) detailing theft frequency, affected retailers, and effectiveness of measures; may include a confidential annex with sensitive information.
    • Ensuring no loss of access due to damage, loss, or fraud (section 4)
    • Requires prompt replacement of damaged, stolen, or fraud-affected EBT cards (replacement within 3 business days after household request; option for in-person pickup).
    • No replacement fees for certain EBT card replacements (section 5)
    • Beginning 60 days after enactment, states may not charge replacement fees for replacements due to malfunction, fraud by an external party, expiration, or compliance with chip regulations.
    • Retailer use of chip-enabled terminals as a condition of SNAP participation (section 6)
    • Within 180 days after final regulations, retailers seeking SNAP authorization or recertification must have chip-enabled payment terminals at all retail locations.
    • Puerto Rico EBT card security report (section 7)
    • Within 1 year, a report on the security and cloning resistance of EBT cards issued in Puerto Rico, with possible recommendations for improvement.
    • Conforming amendments (section 8)
    • Adjusts related provisions in the Consolidated Appropriations Act, 2023 to align with the new cybersecurity framework.

  • Who and what would be affected

    • Federal and State SNAP agencies administering EBT programs
    • State EBT card issuers, card vendors, and retailers participating in SNAP
    • Households receiving SNAP benefits (EBT users)
    • Online retailers and EFT/EBT contractors involved in online SNAP transactions
    • Regions with limited grocery access, eligible entities in grant program

  • Procedural and timeline aspects

    • Short title: Enhanced Cybersecurity for SNAP Act of 2026
    • Regulations: Secretary must promulgate cybersecurity and digital service regulations within 2 years of enactment; updates every 5 years.
    • Chip-enabled transition milestones:
    • Begin issuing chip-enabled cards within 2 years of final regulations
    • No new magnetic-stripe cards within 4 years
    • Reissue all existing magnetic-stripe cards within 5 years
    • Replacement and fee provisions for cards enacted within 60 days
    • Retailer readiness: chip-enabled terminals required 180 days after final regulations
    • Periodic reporting: initial public report within 1 year; subsequent reports every 2 years; online transaction security report first due 3 years after enactment, then biennially
    • Puerto Rico EBT security report due within 1 year

  • Overall impact

    • Substantial modernization of SNAP EBT security, including hardware upgrades, improved online and offline security, expanded user-interface protections, enhanced consumer transparency, and targeted funding to advance chip-enabled technology, with a focus on reducing fraud and protecting benefits.

Compiled from official sources — confirm details with the bill’s official record.

Sign in to ask a question.