USDA inches ahead in plan to secure EBT cards from skimming

The U.S. Department of Agriculture says it's making progress in moving federal food assistance to more secure cards — which could help tamp down yearslong problems with scammers stealing millions in benefits — but the agency doesn’t have a timeline for a full transition to new cards nationwide.

The Supplemental Nutrition Assistance Program, or SNAP, is delivered on electronic benefit transfer payment cards. Unlike most common credit and debit cards, EBT cards don’t have chips.

Instead, SNAP is still delivered on cards with magnetic stripes that are more vulnerable to skimming, where criminals install devices on card readers to steal the card data and PIN entries, make fake cards and steal the money.

The department now has technical standards, published in August, that it says are a necessary step to moving to chip-enabled cards.

Problems with skimming and card cloning have been ongoing since at least 2021. 

The government has replaced nearly $95 million in stolen SNAP benefits since January 2023, according to USDA data, and that number likely doesn’t even capture the full scope of the problem, as some people might not report that their benefits are stolen. 

There’s also a twice per year cap on the number of times your benefits can be replaced, said Rebecca Piazza, the chief of staff of USDA's Food and Nutrition Service. And each reimbursement is capped at two months or the amount that was stolen, whichever is less.

The new technical standard may be “behind the scenes,” but it gives states and vendors the information they need to move to the more secure cards, said Piazza.

“It can also look like potentially on the outside that progress isn't being made,” she acknowledged. “But it was an investment where we needed to take time, work deliberately, ensure all of the stakeholders were aligned, so then we can all move much more quickly together in the future.”

For Charisma, a recipient of SNAP benefits, the issue is personal. She asked that her last name not be shared for privacy reasons.

Last year, she was shopping for her two-year-old son’s birthday when she stopped at the ATM only to find that her $250 in cash benefits were gone. 

In New York, where Charisma lives, the same EBT cards are used for both SNAP and cash benefits, as they are in most states, according to USDA. The new standard supports EBT cards used for SNAP as well as cash benefit programs.

Charisma tried another ATM only to get denied again. Although her SNAP benefits were untouched, her cash benefits had been taken by someone in California.

“I was devastated,” she said. 

It was money she had been planning on using for household expenses, like laundry. Charisma got a new card, but she never got her benefits refunded, despite filling out the online form several times, only to be denied. 

Now, she checks her balances on an app on her phone often, withdraws her benefits as soon as they hit her account and changes her pin every time she uses her card. She can also now lock her card to out-of-state purchases, which she does.

But more secure cards would likely go further to stop the problem.

California and Oklahoma have been working on the transition to chip cards in parallel with the development of the standard. 

California will deploy chip and tap technology in early 2025, a spokesperson for the California Department of Social Services told Nextgov/FCW. The lack of these new technical standards had previously been a barrier for the state’s work, which is behind by six months, as CalMatters reported last month.

Oklahoma plans to move to the new chip cards in the summer, according to a spokesperson for Oklahoma Human Services.

New York’s Office of Temporary and Disability Assistance has said that it is in the early stages of moving to chip cards.

As far as when people across all states can expect more secure cards, however, “we don't have an anticipated timeline for migration at this time,” said Piazza. 

It took the commercial sector years to move to chip cards, she said, and the department is “really encouraging states to adopt this technology and trying to support them in any way that we can.”

Even as SNAP is trying to catch up on chip cards, the private sector is already moving on to tap-to-pay and mobile pay, adding cards to digital wallets. The new technical standards do have information for enabling mobile pay and tap-to-pay in addition to chip cards, but it's not clear when states will pick up the technology. 

Illinois, Louisiana, Massachusetts, Missouri and Oklahoma have been piloting mobile pay after Congress authorized the testing in the 2018 Farm Bill.

“The standards are available, and so states can start planning towards moving towards adoption of chip cards and mobile pay technologies,” said Piazza.

Long-term, both mobile pay and chip cards are important, given that some people won’t want or be able to use mobile pay, she said.

Remaining hurdles

Although the new standards give those administering the program the technical information they need to make the switch to new cards, other challenges remain.

One is the cost. The SNAP system doesn’t have any interchange fees to fund updates, unlike the commercial credit ecosystem, said Piazza. 

USDA will reimburse states for half of the cost of the move to the new cards, as it does for all administrative costs for state SNAP implementation. It is also fielding a fraud working group for states, providing technical resources and a grant program for retailers updating their technology.

Still, “the money factor is huge,” said Chloe Green, the manager of the Food and Nutrition Services portfolio at the American Public Human Services Association, a bipartisan national membership association for state, county and city human services agencies. 

“You have to get approval from your legislature and your government to allocate that in your state budget to even be able to move it forward,” she said of the outlook for states.

Retailers will also have to update their own equipment to take the new cards.

“Currently, Congress has not provided any specific funding streams available for these investments” in updated cards or equipment upgrades at retailers, a USDA spokesperson told Nextgov/FCW.

States are also still waiting for more directions from the feds. USDA is working on regulations, expected this fiscal year, to “require state agencies to implement new card security measures to protect against card skimming,” as required by the 2023 appropriations law.

But even if they get past these hurdles, the capacity of EBT vendors to help all of the states and territories that deliver these benefits move to the new cards in close succession or simultaneously may be a problem, said Green. 

Fraudsters also might intensify their efforts in the states that are slowest to move to the new cards. 

That has equity implications, especially if more well-funded states are able to transition more quickly, said Nicole Tisdale, a former White House and U.S. Congress official focused on cyber equity policy. She’s also the founder and principal of a training and consulting firm, Advocacy Blueprints.

“When you do this phased kind of rollout,” she said, “it doesn't mean that people are going to stop attacking the system. They are going to just go to the cards that have the least protections. So when you do a phased rollout, you are not solving the problem for everyone.”

And finally, some may argue that another government agency, the Consumer Financial Protection Bureau, recently forfeited an opportunity to help EBT users in a newly finalized rule shoring up the rights of consumers over their financial data.

Banks and other financial services providers are now required to share and transfer account information to third-party services like financial management apps without charging fees. But although CFPB sought out comments on whether it should offer EBT users the same protections in the rule, it declined to do so.

The inclusion of public benefits while EBT cards are upgraded would have ensured “that these and future initiatives are in line with wider consumer technology practices,” Ariel Kennan of the Beeck Center at Georgetown University noted in comments filed in December 2023. 

“Ultimately, EBT users deserve the same class of service and protection as users of other consumer financial products,” she continued. “EBT users should have access to their data and the ability to utilize third-party services to view and analyze their financial data, whether to check their balance, scan for fraudulent transactions or manage their financial outlook.”

View from Capitol Hill 

The skimming problem has captured the attention of some on Capitol Hill. Sen. Ron Wyden, D-Ore., is behind a proposal to phase out magnetic stripe cards within five years and require enhanced regulations for cards to have anti-fraud technology. 

He raised concerns about the source of the new technical standard in a statement to Nextgov/FCW. 

A standards association called the X9 Card Industry Forum led the creation of the new technical specifications. The department, states, EBT host processors, retailers and other stakeholders participated, a USDA spokesperson told Nextgov/FCW.

“While I appreciate USDA is now working to upgrade SNAP cybersecurity, I’m concerned about its decision to let industry effectively write its own cybersecurity standards,” Wyden said. “Furthermore, it appears the industry coalition that created the new standards lacked anyone with cybersecurity expertise, or any input from the government’s cybersecurity experts, to make sure that it meets our nation’s best practices.”

The new standard “provides a structured way of exchanging data for financial transactions,” the department spokesperson said, but “does not contain any information or requirements about how that data is transmitted nor how the network is secured.”

Rep. Dutch Ruppersberger, D-Md., has been focused on the issue of reimbursements, introducing a bill to permanently give reimbursements of skimmed benefits, although he noted that “there are common sense security features that can prevent this crime from happening in the first place.” 

For cash benefits from the Temporary Assistance for Needy Families program, states can replace benefits using their block grants, but aren’t required to do so.

For SNAP, the 2023 appropriations law required skimmed SNAP benefits to be replaced by states and allowed states to use federal money for those reimbursements. Lawmakers recently averted a sudden end to those SNAP replacement powers by extending that provision, which would have expired last month, to Dec. 20. 

The department wants the reimbursements to be offered beyond then, too. 

“We believe it's important for that replacement authority to be extended… so that SNAP participants are not impacted by the timelines that states can move,” said Piazza. “It's going to take time for states to roll out chip cards and adopt these mobile pay technologies.”