SNAP Electronic Benefits Transfer Card Security Measures

Summary

The Food and Nutrition Administration (FNA or the Agency), an agency of the U.S. Department of Agriculture (USDA or the Department), is issuing a rule proposing changes to Supplemental Nutrition Assistance Program (SNAP, the program) regulations to modernize Electronic Benefit Transfer (EBT) technology and align EBT with consumer payment processing industry standards, improving both program integrity and convenience for SNAP clients. These proposed changes will protect SNAP benefits from thieves and ensure benefits are accessible by approved households.

Request for Comments

Written comments must be received on or before 60 days after date of publication in the Federal Register to be assured of consideration.

The Food and Nutrition Administration, USDA, invites interested persons to submit written comments on this proposed rule. Comments may be submitted in writing by one of the following methods:

• Federal eRulemaking Portal: Go to Regulations.gov. Follow the online instructions for submitting comments.
• E-Mail: Send comments to [email protected]. Include "Supplemental Nutrition Assistance Program: Electronic Benefits Transfer Card Security Measures" in the subject line of the message.
• Mail: Send comments to Food and Nutrition Administration, SNAP Innovation Policy and Issuance Division, Issuance Support Branch, 5601 Sunnyside Ave, Beltsville MD, 20705.

All written comments submitted in response to this proposed rule will be included in the record and will be made available to the public. Please be advised that the substance of the comments and the identity of the individuals or entities submitting the comments will be subject to public disclosure. FNA will make the written comments, as well as a summary of this proposed rule in accordance with 5 USC 553(b)(4), publicly available on the Internet via Regulations.gov.

Abstract

The Consolidated Appropriations Act, 2023, requires the Department to issue regulations establishing security measures to identify and prevent SNAP benefit theft. The measures must be consistent with industry standards for detecting, identifying, and preventing debit and credit card skimming, card cloning, and other fraudulent methods and must consider implementation feasibility for the states. This proposed rule modernizes Electronic Benefit Transfer (EBT) technology and brings EBT into alignment with consumer payment processing industry standards, improving the experiences of SNAP participants. FNA is requesting a new OMB Control Number for the requirements in this proposed rule.

The proposed rule includes numerous proposals to enhance EBT card security and account usability. Several of these proposals will result in an increase in reporting burdens for state SNAP agencies, individuals/households, business-for-profit such as EBT host processors, and some SNAP retailers. There is no recordkeeping or third-party disclosure associated with this rulemaking.

First, the rule proposes creating SNAP EBT Operating Standards, which would be revised on a regular, ongoing basis. SNAP EBT Operating Standards would allow the Department to revise EBT requirements more dynamically in response to rapidly evolving payment technology and best practices in the consumer payment industry. Some of the SNAP EBT Operating Standards will create an information collection burden, as discussed below.

In this proposed rule, the Department will require state SNAP agencies to upgrade to EBT cards utilizing chip and NFC technology, as well as require that SNAP retailers accept EBT transactions via chip and NFC technology, within a certain time frame. Based on the experience of the consumer payment industry, the Department believes EBT cards utilizing chip and NFC technology will significantly reduce SNAP benefit theft due to the enhanced security features that mitigate skimming and cloning attacks. Households will be required to activate these new chip cards upon receipt, and households experiencing homelessness may need to travel to a local office to obtain their new card.

The proposal will also update the regulations at 7 CFR 274.2(e) on EBT household training requirements for SNAP participants. Under the proposed regulations, the EBT household training will inform households about security best practices that will reduce their chances of being affected by benefit theft, in addition to their rights and responsibilities and how to use their benefits.

The proposal will create new regulations at 7 CFR 274.8(b)(4)(i)(H) and 274.8(b)(4)(i)(I) to specify information that must be made available to all SNAP participants, including transaction dates, times, and amounts; retailer name and location; balance inquiry history; PIN change history; and history of other account management changes including address, email address, and telephone number. These changes will better equip SNAP households to review their account activity and detect potentially fraudulent activity.

The proposal makes two changes regarding balance inquiries. The SNAP EBT Operating Standards (see Appendix A to Part 274) will require verification for all SNAP balance inquiries, and the proposal will update 7 CFR 274.7(d)(1) to permit internet retailers to conduct business without offering balance inquiry, codifying a standard waiver the Department currently issues. Related to this, the Department proposes revising 7 CFR 274.7(d)(3) and 274.8(b)(7) to confirm that transaction receipts may be delivered via electronic means. As transaction receipts are required to be provided, eCommerce providers and Internet retailers that do not use an eCommerce provider will need to modify their website purchasing pages accordingly.

The proposed rule revises 7 CFR 274.3(e)(4) and 274.8(b)(3)(v)(F), to clarify that state SNAP agencies, and by extension their contracted EBT vendors, both play a critical role in denying access to bad actors.

The proposed rule also revises regulations at 7 CFR 274.8(b) and 274.8(b)(10)(ii) to require all participants in the EBT system to update their systems in accordance with the X9.58 technical specification to ensure proper functioning of the system.

Finally, the proposed rule would revise 7 CFR 274.7(d)(3) and 274.8(b)(7) to confirm that transaction receipts for online purchases may be delivered via online cardholder accounts, confirmation invoices, other electronic communications such as email or text messages, or printed invoices upon delivery.

In addition to the changes discussed above, the proposed rule also includes changes that do not have an information collection burden. These include: updates to 7 CFR 274.8(b)(5)(vi) to specify that the primary account number shall be printed on the back of each EBT card; updates to 7 CFR 274.6(b)(3), 274.6(b)(5), and 274.6(b)(6) clarifying that EBT cards replaced as a result of their expiration date must not be counted towards the excessive card replacement threshold; updates at 7 CFR 274.6(b), 274.6(b)(2), and 274.8(b)(3)(ii)(C) to remove references to magnetic stripes and to clarify that card replacement does not apply only to physical cards; updates to 7 CFR 274.3(a)(1)(i) ending the use of manual vouchers as a means to conduct ongoing business, except in certain limited circumstances; updates to 7 CFR 274.3(a)(2) to codify the 2014 Farm Bill amendment regarding non-exempt retailers' financial responsibility for EBT equipment, supplies, and related services; updates to 7 CFR 274.3(b) to remove outdated requirements regarding EBT terminal deployment; removal of 7 CFR 274.1(b) and updates to 7 CFR 271.2 "Electronic Benefit Transfer (EBT) system" to remove the option of offline EBT systems; updates to 7 CFR 274.3(a)(4) to clarify that interchange fees shall not apply to any EBT transaction; the creation of 7 CFR 274.2(f)(3) to require that EBT cards are issued in an inactive state; and updates to 7 CFR 274.8(b)(5)(vii) to require EBT cards to contain card security codes (CSCs). The proposed SNAP EBT Operating Standards and regulations at 274.7(k) will also require that all state SNAP agencies offer certain specific card security services provided by EBT vendors. States will be required to prohibit use of common PINs and offer participant-selected account options to manage and monitor their own account usage. Relatedly, the proposal creates new regulations at 7 CFR 274.8(a)(1)(ii) and modifies regulations at 7 CFR 274.3(f)(2)(i) to require PINs to comply with the specifications of the SNAP EBT Operating Standards.

View the Full Preview (.pdf)