S. 3949: Enhanced Cybersecurity for SNAP Act of 2026

This bill, known as the Enhanced Cybersecurity for SNAP Act of 2026, proposes amendments to the Food and Nutrition Act of 2008, specifically targeting the cybersecurity measures for Electronic Benefit Transfer (EBT) cards used in the Supplemental Nutrition Assistance Program (SNAP). Here are the key provisions outlined in the bill:

Cybersecurity Measures for EBT Cards

The bill mandates the creation and periodic updating of regulations focusing on the cybersecurity and digital services related to EBT cards and mobile technologies used in SNAP. The Secretary of Agriculture is required to:

• Develop cybersecurity regulations within two years of the bill's enactment, and update them every five years.
• Ensure that EBT cards include chip-enabled technology to enhance security against fraud, specifically cloning.

Implementation Timeline

The bill lays out specific timelines for the reissuance and upgrading of EBT cards:

• States must start issuing chip-enabled EBT cards within two years after regulations are finalized.
• By four years after the regulations, no new EBT cards with magnetic stripes can be issued.
• States are required to convert existing magnetic stripe cards to chip-enabled cards within five years of the regulations becoming final.

User Interface Requirements

Each State must maintain user interfaces that allow households to manage their EBT accounts. This includes:

• Providing a user-friendly, mobile-friendly online portal.
• Ensuring accessibility in the languages required by federal regulations.
• Maintaining high operational availability (99% uptime) and incorporating features as specified by the Secretary.

Fraud Prevention and Reporting

The bill emphasizes the importance of preventing and addressing fraud related to EBT transactions. It requires States to:

• Notify households of transactions and allow them to report fraudulent activities through their online interfaces.
• Provide access to transaction histories for at least 12 months.
• Notify households about refunds available for fraudulent transactions.

Restrictions on PIN and Password Policies

States are prohibited from enforcing certain PIN and password requirements that conflict with federal cybersecurity standards. This includes:

• Restrictions on how frequently a PIN must be changed.
• Unnecessarily complex password regulations.

Grants and Financial Support for Upgrades

The bill establishes a grant program to support eligible retailers in upgrading their payment terminals to accept chip-enabled cards, particularly in areas with limited grocery access.

Data Collection and Public Reports

The Secretary of Agriculture will be responsible for collecting and publishing data on:

• The frequency of EBT card fraud and theft.
• Measures taken by States to improve cybersecurity.
• Usability issues faced by households using EBT cards.

Accessibility and Replacement of EBT Cards

The bill includes safeguards to ensure that households do not lose access to their benefits due to issues with EBT cards. Specifically, States are required to provide replacement cards within three business days if a card is stolen or damaged.

Impact on Retailers

Retailers participating in the SNAP program are required to have chip-enabled payment terminals within 180 days of the implementation of new regulations, ensuring they meet security standards.

Report on Puerto Rico's EBT Security

The Secretary of Agriculture must submit a report on the security measures for EBT cards in Puerto Rico, specifically focusing on the cards' resistance to cloning.

Conforming Amendments

The bill also includes various conforming amendments to ensure consistency with other legislation regarding EBT card security and administration.

Relevant Companies

• MA (Mastercard) - Likely to be impacted as they provide payment processing technology, including chip-enabled capabilities.
• V (Visa) - Similar to Mastercard, Visa may need to enhance their technology infrastructure to comply with the new regulations regarding EBT card transactions.