[Congressional Record Volume 172, Number 48 (Tuesday, March 17, 2026)]
[Senate]
[Pages S1138-S1140]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]
SA 4446. Mr. WYDEN submitted an amendment intended to be proposed by
him to the bill S. 1383, to establish the Veterans Advisory Committee
on Equal Access, and for other purposes; which was ordered to lie on
the table; as follows:
At the appropriate place, insert the following:
SEC. ___. ENHANCED CYBERSECURITY FOR EBT CARDS.
(a) In General.--Section 7(h) of the Food and Nutrition Act
of 2008 (7 U.S.C. 2016(h)) is amended by adding at the end
the following:
``(15) Cybersecurity of ebt cards.--
``(A) Definitions.--In this paragraph:
``(i) Chip-enabled.--
``(I) In general.--The term `chip-enabled', with respect to
a payment card, means a payment card that uses industry
standard secure payment technology, as identified by the
Administrator of the Food and Nutrition Service in
consultation with the Secretary of the Treasury and the
Director of the National Institute of Standards and
Technology, that--
``(aa) provides for secure card-based payment; and
``(bb) is resistant to cloning.
``(II) Chip card technology.--The Administrator of the Food
and Nutrition Service, in consultation with the Secretary of
the Treasury and the Accredited Standards Committee X9, shall
consider whether the secure payment technology described in
subclause (I) should meet the industry standards for contact
and contactless payments.
``(ii) Mobile friendly.--The term `mobile friendly' has the
meaning given the term in section 3559(b) of title 44, United
States Code.
``(iii) NIST pin and password standards.--The term `NIST
PIN and password standards' means the PIN and password
standards described in Special Publication 800-63B entitled
`Digital Identity Guidelines' (or a successor document) of
the National Institute of Standards and Technology.
``(iv) PIN.--The term `PIN' has the meaning given the term
`personal identification number (PIN)' in section 271.2 of
title 7, Code of Federal Regulations (or successor
regulations).
``(B) Regulations.--
``(i) In general.--Not later than 2 years after the date of
enactment of this paragraph, the Secretary shall promulgate,
and every 5 years thereafter, the Secretary shall review and
update as necessary, cybersecurity and digital service
regulations relating to EBT cards and mobile technologies
under the supplemental nutrition assistance program,
including, at a minimum, to ensure that cybersecurity
measures for EBT cards and mobile technologies keep pace with
security safeguards used by the private sector and required
by Federal agencies for credit, debit, and other payment
cards and mobile technologies.
``(ii) Requirements.--The Secretary shall ensure that the
cybersecurity and digital service regulations described in
clause (i) require the following:
``(I)(aa) Each State shall operate the user interfaces
listed on the list of required user interfaces maintained by
the Secretary under item (dd)(AA), in accordance with this
subclause, 1 or more user interfaces of which households in
the State may, at the election of the applicable household,
use to manage the EBT account of the applicable household.
``(bb)(AA) A State may operate other user interfaces under
item (aa) in addition to the required user interfaces on the
list maintained by the Secretary under item (dd)(AA).
``(BB) Any web-based online portal operated by a State as a
user interface shall be mobile friendly.
``(cc) Each user interface offered by a State under items
(aa) and (bb), as applicable, shall--
``(AA) provide information in each language in which the
State agency is required to make material available pursuant
to section 272.4(b) of title 7, Code of Federal Regulations
(or successor regulations);
``(BB) be available to households at least 99 percent of
the time; and
``(CC) include any other features required by the
Secretary.
``(dd)(AA) The Secretary shall maintain a list of required
user interfaces for purposes of item (aa), which may include
a web-based online portal and a mobile application.
``(BB) The list under subitem (AA) shall include an
application programming interface through which at least 1
user interface offered by a State under item (aa) allows
households to delegate access to some or all account features
identified by the Secretary to third-party provided software.
No fee shall be charged to any party for the use of that
application programming interface.
``(CC) During the 10-year period following the date on
which the regulations promulgated pursuant to clause (i)
become final, unless the Secretary extends that period, the
Secretary shall maintain on the list under subitem (AA) the
following user interfaces: text message, voice telephone
service, and a nondigital user interface that does not
require the use of a phone or computer by the household.
``(II)(aa) Each State shall provide households on an opt-in
basis--
``(AA) through each digital user interface offered under
subclause (I), timely electronic notice of transactions using
the EBT account of the household; and
``(BB) through each user interface offered under subclause
(I), access to, including the ability to search, historical
transactions for not less than the preceding 12 months.
``(bb) Transaction information under subitems (AA) and (BB)
of item (aa) shall include the amount of the transaction, the
merchant for the transaction, the city and State of the
merchant for an in-person transaction, and the delivery
address or collection address for an online transaction.
``(cc) Each State shall offer households the ability,
through each user interface offered under subclause (I), to
report a fraudulent transaction to the State.
``(dd) A State shall not require a household to respond to
or acknowledge a notice of transaction delivered pursuant to
item (aa)(AA).
``(ee) A State shall notify any household that has reported
an instance of EBT card skimming or fraud, or is otherwise
identified as being a victim of EBT card skimming or fraud,
of any State or Federal funds that may be reimbursed if the
household experiences fraud again.
``(III) Each State shall provide households issued an EBT
card the ability, through each user interface offered under
subclause (I) to check the enrollment status of the
household, including the date on which the household is
required to apply for recertification.
``(IV) Not later than 2 years after the date on which the
regulations promulgated pursuant to clause (i) become final,
States shall begin issuing chip-enabled EBT cards.
``(V) Not later than 4 years after the date on which the
regulations promulgated pursuant to clause (i) become final,
States may not issue new EBT cards with magnetic stripes.
``(VI) Not later than 5 years after the date on which the
regulations promulgated pursuant to clause (i) become final,
States shall be required to reissue any existing valid EBT
cards with magnetic stripes as chip-enabled EBT cards without
magnetic stripes.
``(VII) In the case of a chip-enabled EBT card reissued
pursuant to any of subclauses (IV) through (VI), absent
suspicion of fraud, as applicable, a State shall--
``(aa) reissue a new chip-enabled EBT card; and
``(bb) deactivate the current chip-enabled EBT card on the
date that is the earlier of--
[[Page S1139]]
``(AA) the date on which the new chip-enabled EBT card is
activated; and
``(BB) 60 days after the date on which the new chip-enabled
EBT card is sent to the household.
``(iii) Sunset for requirement to use chip technology.--
Under the cybersecurity regulations described in clause (i),
all EBT cards, except EBT cards issued to victims of a
disaster pursuant to section 5(h) or solely for benefits
under the summer electronic benefits transfer for children
program established under section 13A of the Richard B.
Russell National School Lunch Act (42 U.S.C. 1762), issued
during the 5-year period following the deadline for carrying
out clause (ii)(VI) shall be chip-enabled, unless the
Secretary extends that period.
``(iv) Rule of construction.--The cybersecurity and digital
service regulations described in clause (i) shall supersede
any regulations promulgated under paragraph (2) of section
501(a) of division HH of the Consolidated Appropriations Act,
2023 (7 U.S.C. 2016a(a)) (as in effect on the day before the
date of enactment of the Save America Act).
``(C) Reimbursements.--Each State upgrading EBT cards to
comply with the regulations promulgated under subparagraph
(B)(i) shall receive reimbursement from the Secretary in an
amount determined by the Secretary to cover all reasonable
costs incurred by the State, including--
``(i) the 1-time up-front costs paid by the State to card
vendors;
``(ii) the additional annual fees associated with chip-
enabled cards paid by States to card vendors; and
``(iii) postage or other delivery-related costs.
``(D) Prohibition on password and pin requirements
inconsistent with federal cybersecurity standards.--Beginning
60 days after the date of enactment of this paragraph, a
State agency may not require, with respect to a PIN for use
of an EBT card or a password for access to an online account
or mobile application managing the EBT card--
``(i) that the PIN or password be periodically changed in
circumstances that are prohibited by the NIST PIN and
password standards; or
``(ii) that the password meet complexity requirements that
are prohibited by the NIST PIN and password standards.
``(E) Grant program for chip-enabled ebt cards.--
``(i) Definitions.--In this subparagraph:
``(I) Administering entity.--The term `administering
entity' means an entity awarded a grant under clause (ii) to
provide subgrants to eligible entities.
``(II) Eligible entity.--The term `eligible entity' means--
``(aa) an entity described in paragraph (1) or (3) of
section 3(o) that--
``(AA) is authorized to participate in the supplemental
nutrition assistance program under section 9;
``(BB) does not have payment terminals that accept chip-
enabled EBT cards; and
``(CC) is located in an area with limited grocery access,
as determined by the Secretary; and
``(bb) an entity described in paragraph (2), (4), or (5) of
section 3(o) that meets the requirements described in
subitems (AA) and (BB) of item (aa).
``(ii) Grants.--The Secretary shall establish a grant
program to award a grant to an administering entity to
provide subgrants to eligible entities to upgrade to chip-
compatible payment terminals that support contact and
contactless payment card technology.
``(F) Data collection.--The Secretary shall--
``(i) collect, and publish on the website of the Department
of Agriculture, data on--
``(I) the length of time each user interface offered by
each State pursuant to subparagraph (B)(ii)(I) was
unavailable for use, including due to technical problems or
maintenance needs; and
``(II) cybersecurity measures adopted for EBT cards in each
State; and
``(ii) maintain and annually update the data collected
under clause (i) to support States in implementing any
regulations promulgated pursuant to subparagraph (B)(i).
``(G) Public report.--
``(i) In general.--Not later than 1 year after the date of
enactment of this paragraph, and every 2 years thereafter,
the Secretary shall submit to the Committees on
Appropriations and Agriculture, Nutrition, and Forestry of
the Senate and the Committees on Appropriations and
Agriculture of the House of Representatives, and make
publicly available on the website of the Department of
Agriculture, a report that--
``(I) identifies trends relating to the theft of benefits,
including the frequency of theft of benefits, the locations
at which EBT cards are compromised, and the method by which
EBT cards are compromised;
``(II) evaluates the effectiveness of existing
cybersecurity regulations for the supplemental nutrition
assistance program, including identifying ineffective
measures and the compliance burden borne by individual
benefit recipients;
``(III) describes the efforts of States--
``(aa) to update cybersecurity measures for EBT cards; and
``(bb) to reimburse stolen benefits; and
``(IV) examines usability issues of EBT cards, including
issues that present barriers to households using benefits or
affect fraud prevention goals.
``(ii) Restricted annex.--The report under clause (i) may
include a nonpublicly available annex containing classified
or law enforcement-sensitive information and any identifying
merchant information.''.
(b) Online Transaction Security.--Section 7(h) of the Food
and Nutrition Act of 2008 (7 U.S.C. 2016(h)) (as amended by
subsection (a)) is amended by adding at the end the
following:
``(16) Online transaction security.--
``(A) In general.--In promulgating and updating, as
necessary, the regulations under paragraph (15)(B)(i), the
Secretary shall, with respect to online transactions using
EBT cards (or any successor financial product used for a
substantially similar purpose)--
``(i) require security measures that--
``(I) are effective in detecting and preventing theft of
benefits through online transactions, including the theft of
data from online merchants that may compromise the ability of
a household to use benefits in transactions with other
merchants, either online or in-person; and
``(II) prevent sensitive data from being stolen during
online transactions and securely manage sensitive data
generated by online transactions, including through
cybersecurity enhancements for online retailers;
``(ii) establish standard reporting methods for States to
collect and share data with the Secretary on the scope of
benefits and data being stolen through online transactions;
and
``(iii) in carrying out clauses (i) and (ii), take into
consideration the feasibility of cost, availability, and
implementation for States.
``(B) Consultation.--In carrying out subparagraph (A), the
Secretary shall consult with the Director of the
Administration for Children and Families, the Attorney
General of the United States, State agencies, retail food
stores, and EBT contractors--
``(i) on the measures, methods, and considerations under
that subparagraph; and
``(ii) to determine--
``(I) how benefits are being stolen and sensitive data is
being compromised through online transactions; and
``(II) how those stolen benefits and data are being used.
``(C) Report.--
``(i) In general.--Not later than 3 years after the date of
enactment of this paragraph, and every 2 years thereafter,
the Secretary shall submit to the Committee on Agriculture,
Nutrition, and Forestry of the Senate and the Committee on
Agriculture of the House of Representatives a report that
includes--
``(I) to the maximum extent practicable, information on the
frequency of theft of benefits, the number of reported thefts
from online transactions, the amount of benefits stolen
through online transactions, and the online retailers most
commonly compromised;
``(II) a description of the measures and methods developed,
and considerations taken, under subparagraph (A);
``(III) the determinations made under subparagraph (B)(ii);
and
``(IV) recommendations on how to consistently detect,
track, report, and prevent theft of benefits, including the
theft of data described in subparagraph (A)(i)(I).
``(ii) Confidential annex.--The report under clause (i) may
include a nonpublicly available confidential annex containing
any identifying merchant information.''.
(c) Ensuring No Loss of Access to Benefits Due to EBT Card
Damage, Loss, or Fraud.--Section 7(h)(7) of the Food and
Nutrition Act of 2008 (7 U.S.C. 2016(h)(7)) is amended--
(1) by striking ``Regulations'' and inserting the
following:
``(A) In general.--Regulations''; and
(2) by adding at the end the following:
``(B) Ensuring no loss of access to benefits due to ebt
card damage, loss, or fraud.--Not later than 180 days after
the date of enactment of the Save America Act, the Secretary
shall promulgate regulations requiring the following:
``(i) If an EBT card is damaged, no longer functions
properly, is stolen, or is frozen due to fraud, the
applicable State shall take the necessary steps to ensure
that the household receives a replacement card, either by
mail or in person, as selected by the household, not later
than 3 business days after the household submits to the State
a request for a replacement EBT card.
``(ii) A State shall not require, but shall offer as an
option, in-person collection of a new or replacement EBT
card.''.
(d) No Replacement Fees for Certain EBT Cards.--Section
7(h)(8)(A) of the Food and Nutrition Act of 2008 (7 U.S.C.
2016(h)(8)(A)) is amended--
(1) by striking ``A State agency'' and inserting the
following:
``(i) In general.--Except as provided in clause (ii), a
State agency''; and
(2) by adding at the end the following:
``(ii) Exceptions.--Beginning 60 days after the date of
enactment of the Save America Act, a State agency may not
collect a charge under clause (i) if the replacement of the
EBT card is due to--
``(I) the EBT card malfunctioning;
``(II) suspected or reported fraud relating to that EBT
card by an individual outside of the household to which the
EBT card belongs;
``(III) the expiration of the EBT card; or
``(IV) required replacement of the EBT card in compliance
with regulations promulgated pursuant to paragraph
(15)(B).''.
[[Page S1140]]
(e) Requirement for Retailer Use of Chip-enabled Payment
Terminals as a Condition of SNAP Participation.--Section 9(a)
of the Food and Nutrition Act of 2008 (7 U.S.C. 2018(a)) is
amended--
(1) in paragraph (2)--
(A) by striking ``(2) The Secretary'' and inserting the
following:
``(2) Regulations.--The Secretary''; and
(B) by indenting the margins of subparagraphs (A) and (B)
appropriately;
(2) by indenting the margin of paragraph (3) appropriately;
and
(3) by adding at the end the following:
``(5) Chip-enabled payment terminals.--Beginning not later
than 180 days after the date on which the regulations
promulgated pursuant to section 7(h)(15)(B)(i) become final,
the Secretary shall require retail food stores and wholesale
food concerns seeking authorization or reauthorization to
accept and redeem benefits under the supplemental nutrition
assistance program to have a chip-enabled (as defined in
section 7(h)(15)(A)) payment terminal at each retail location
of the retail food store or wholesale food concern.''.
(f) Report on EBT Cards Issued in Puerto Rico.--
(1) In general.--Not later than 1 year after the date of
enactment of this Act, the Secretary of Agriculture shall
submit to the Committees on Appropriations and Agriculture,
Nutrition, and Forestry of the Senate and the Committees on
Appropriations and Agriculture of the House of
Representatives, and make publicly available on the website
of the Department of Agriculture, a report on the security of
EBT cards (as defined in section 3 of the Food and Nutrition
Act of 2008 (7 U.S.C. 2012)) issued in the Commonwealth of
Puerto Rico, including--
(A) the resistance of those EBT cards to cloning; and
(B) if appropriate, recommendations for improving the
security of the electronic benefit transfer system against
EBT card cloning-based fraud.
(2) Restricted annex.--The report under paragraph (1) may
include a nonpublicly available annex containing classified
or law enforcement-sensitive information.
(g) Conforming Amendments.--Section 501 of division HH of
the Consolidated Appropriations Act, 2023 (7 U.S.C. 2016a),
is amended--
(1) in subsection (a)--
(A) by striking paragraphs (1) and (2);
(B) by redesignating paragraphs (3) through (5) as
paragraphs (1) through (3), respectively; and
(C) in paragraph (3) (as so redesignated)--
(i) in subparagraph (B), by adding ``and'' at the end;
(ii) by striking subparagraph (C); and
(iii) by redesignating subparagraph (D) as subparagraph
(C); and
(2) in subsection (b)--
(A) in paragraph (1)--
(i) in subparagraph (A)(vi), by striking ``measures'' and
all that follows through ``(a)(1)'' and inserting
``measures'';
(ii) in subparagraph (B), by adding ``and'' at the end;
(iii) in subparagraph (C), by striking ``and'' at the end;
and
(iv) by striking subparagraph (D); and
(B) in paragraph (3), by striking ``subsection (a)(3)'' and
inserting ``subsection (a)(1)''.
______