S. 3949 — Enhanced Cybersecurity for SNAP Act of 2026

This section directs the Secretary of Agriculture, not later than two years after enactment, to promulgate (and review and update every five years thereafter) cybersecurity and digital service regulations for EBT cards and mobile technologies under the Supplemental Nutrition Assistance Program (SNAP), ensuring they align with private-sector and federal standards for payment cards. The regulations require (1) states to operate required user interfaces (per a Secretary-maintained list that includes a web portal, mobile application, application programming interface for third-party access with no fee, and—for 10 years post-regulations—text messaging, voice telephone service, and nondigital options), which must be mobile friendly, multilingual, 99% available, and include other Secretary-specified features; (2) opt-in transaction notices and 12-month searchable history (including merchant details) via those interfaces, fraud reporting, no mandatory responses to notices, and notifications of reimbursement funds for fraud victims; (3) enrollment status checks via those interfaces; and (4) issuance of chip-enabled EBT cards (i.e., using secure, cloning-resistant technology) not later than two years after the regulations are final.

This section establishes security requirements for online transactions using SNAP electronic benefit transfer (EBT) cards. Specifically, it directs the Secretary of Agriculture, when promulgating or updating related regulations, to (1) require measures that detect and prevent benefit theft—including data theft from online merchants that compromises in-person or other uses—and securely manage sensitive data via cybersecurity enhancements for online retailers; (2) establish standard methods for states to report to the Secretary on the scope of online benefit and data theft; and (3) consider state costs, availability, and implementation feasibility. It further requires the Secretary to consult with the Administration for Children and Families, the Attorney General, state agencies, retailers, and EBT vendors on these elements and theft patterns, and to submit a report to the Senate Committee on Agriculture, Nutrition, and Forestry and the House Committee on Agriculture not later than three years after enactment—and every two years thereafter—detailing theft frequency, amounts and retailers affected, actions taken, and prevention recommendations (potentially including a confidential annex on merchants).

This section directs the Secretary of Agriculture to promulgate regulations, not later than 180 days after enactment, to ensure no loss of SNAP benefits due to EBT card damage, loss, theft, or fraud freeze. The regulations require states to (1) provide a replacement EBT card, by mail or in person as selected by the household, within 3 business days of a household's request; and (2) offer but not require in-person collection of new or replacement cards.

This section prohibits state agencies from charging SNAP households a fee for replacement EBT cards if due to (1) card malfunction, (2) suspected or reported fraud by an individual outside the household, (3) card expiration, or (4) required replacement under regulations promulgated pursuant to 7 U.S.C. 2016(h)(15)(B), beginning 60 days after enactment of the Enhanced Cybersecurity for SNAP Act of 2026. (Previously, state agencies generally could impose such fees.)

This section requires retail food stores and wholesale food concerns seeking authorization or reauthorization to accept and redeem Supplemental Nutrition Assistance Program (SNAP) benefits to have a chip-enabled payment terminal (as defined in 7 U.S.C. 7(h)(15)(A)) at each retail location, beginning not later than 180 days after regulations promulgated pursuant to 7 U.S.C. 7(h)(15)(B)(i) become final. (Thus, SNAP-authorized retailers must upgrade to EMV chip card readers to combat benefit fraud via electronic benefit transfer.)

This section directs the Secretary of Agriculture to submit to the Senate and House Committees on Appropriations and Agriculture (Senate Agriculture, Nutrition, and Forestry), and make publicly available on the USDA website, a report on the security of electronic benefit transfer (EBT) cards issued in Puerto Rico—not later than one year after enactment of this Act. The report must address (1) the resistance of those EBT cards to cloning and (2) recommendations, if appropriate, for improving the electronic benefit transfer system against EBT card cloning-based fraud. The report may include a nonpublic annex containing classified or law enforcement-sensitive information.

This section strikes Department of Agriculture (USDA) requirements to issue guidance to states and promulgate regulations mandating implementation of specific security measures to prevent theft of Supplemental Nutrition Assistance Program (SNAP) benefits (i.e., food assistance for low-income households) through electronic benefit transfer (EBT) card skimming, cloning, and similar fraud. It redesignates and retains USDA duties to (1) promulgate regulations by December 1, 2023, requiring states to implement SNAP benefit replacement procedures; (2) coordinate with federal agencies, states, retailers, and EBT vendors to identify theft methods, establish prevention measures (including retailer equipment upgrades), and standardize theft reporting; and (3) submit a report to the Senate and House agriculture committees by December 1, 2024, on theft frequency, coordination outcomes, state plans, and prevention recommendations. The section makes conforming amendments to state plan approval provisions for benefit replacement, removing cross-references to the struck requirements.