I 

118TH CONGRESS 

2D SESSION H. R. 7585 

To amend the Food and Nutrition Act of 2008 to require the promulgation 

of cybersecurity and digital service regulations relating to the use of 

EBT cards under the supplemental nutrition assistance program, and 

for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

MARCH 7, 2024 

Mr. KIM of New Jersey (for himself and Mr. LAWLER) introduced the 

following bill; which was referred to the Committee on Agriculture 

A BILL 

To amend the Food and Nutrition Act of 2008 to require 

the promulgation of cybersecurity and digital service regulations relating to the use of EBT cards under the 

supplemental nutrition assistance program, and for other 

purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Enhanced Cybersecu5 rity for SNAP Act of 2024’’. 


ssavage on LAPJG3WLY3PROD with BILLS
2 

•HR 7585 IH

1 SEC. 2. ENHANCED CYBERSECURITY FOR EBT CARDS. 

2 Section 7(h) of the Food and Nutrition Act of 2008 

3 (7 U.S.C. 2016(h)) is amended by adding at the end the 

4 following: 

5 ‘‘(15) CYBERSECURITY OF EBT CARDS.— 

6 ‘‘(A) DEFINITIONS.—In this paragraph: 

7 ‘‘(i) CHIP-ENABLED.— 

8 ‘‘(I) IN GENERAL.—The term 

9 ‘chip-enabled’, with respect to a pay10 ment card, means a payment card 

11 that uses industry standard secure 

12 payment technology, as identified by 

13 the Administrator of the Food and 

14 Nutrition Service in consultation with 

15 the Secretary of the Treasury and the 

16 Director of the National Institute of 

17 Standards and Technology, that— 

18 ‘‘(aa) provides for secure 

19 card-based payment; and 

20 ‘‘(bb) is resistant to cloning. 

21 ‘‘(II) EMV CHIP.—The Adminis22 trator of the Food and Nutrition 

23 Service, in consultation with the Sec24 retary of the Treasury and the Direc25 tor of the National Institute of Stand26 ards and Technology, shall consider 


ssavage on LAPJG3WLY3PROD with BILLS
3 

•HR 7585 IH

1 whether the secure payment tech2 nology described in subclause (I) 

3 should meet the standards published 

4 by EMVCo for contact and contactless 

5 payments. 

6 ‘‘(ii) MOBILE FRIENDLY.—The term 

7 ‘mobile friendly’ has the meaning given the 

8 term in section 3559(b) of title 44, United 

9 States Code. 

10 ‘‘(iii) NIST PIN AND PASSWORD

11 STANDARDS.—The term ‘NIST PIN and 

12 password standards’ means the PIN and 

13 password standards described in Special 

14 Publication 800–63B entitled ‘Digital 

15 Identity Guidelines’ (or a successor docu16 ment) of the National Institute of Stand17 ards and Technology. 

18 ‘‘(iv) PIN.—The term ‘PIN’ has the 

19 meaning given the term ‘personal identi20 fication number (PIN)’ in section 271.2 of 

21 title 7, Code of Federal Regulations (or 

22 successor regulations). 

23 ‘‘(B) REGULATIONS.— 

24 ‘‘(i) IN GENERAL.—Not later than 2 

25 years after the date of enactment of this 


ssavage on LAPJG3WLY3PROD with BILLS
4 

•HR 7585 IH

1 paragraph, the Secretary shall promulgate, 

2 and every 5 years thereafter, the Secretary 

3 shall review and update as necessary, cy4 bersecurity and digital service regulations 

5 relating to EBT cards and mobile pay6 ments under the supplemental nutrition as7 sistance program, including, at a min8 imum, to ensure that cybersecurity meas9 ures for EBT cards and mobile payments 

10 keep pace with security safeguards used by 

11 the private sector and required by Federal 

12 agencies for credit, debit, and other pay13 ment cards and mobile payments. 

14 ‘‘(ii) REQUIREMENTS.—The Secretary 

15 shall ensure that the cybersecurity and dig16 ital service regulations described in clause 

17 (i) require the following: 

18 ‘‘(I)(aa) Each State shall operate 

19 the user interfaces listed on the list of 

20 required user interfaces maintained by 

21 the Secretary under item (dd)(AA), in 

22 accordance with this subclause, 1 or 

23 more user interfaces of which house24 holds in the State may, at the election 

25 of the applicable household, use to 


ssavage on LAPJG3WLY3PROD with BILLS
5 

•HR 7585 IH

1 manage the EBT account of the ap2 plicable household. 

3 ‘‘(bb)(AA) A State may operate 

4 other user interfaces under item (aa) 

5 in addition to the required user inter6 faces on the list maintained by the 

7 Secretary under item (dd)(AA). 

8 ‘‘(BB) Any web-based online por9 tal operated by a State as a user 

10 interface shall be mobile friendly. 

11 ‘‘(cc) Each user interface offered 

12 by a State under items (aa) and (bb), 

13 as applicable, shall— 

14 ‘‘(AA) provide information 

15 in each language in which the 

16 State agency is required to make 

17 material available pursuant to 

18 section 272.4(b) of title 7, Code 

19 of Federal Regulations (or suc20 cessor regulations); 

21 ‘‘(BB) be available to house22 holds at least 99 percent of the 

23 time; and 

24 ‘‘(CC) include any other fea25 tures required by the Secretary. 


ssavage on LAPJG3WLY3PROD with BILLS
6 

•HR 7585 IH

1 ‘‘(dd)(AA) The Secretary shall 

2 maintain a list of required user inter3 faces for purposes of item (aa), which 

4 may include a web-based online portal 

5 and a mobile application. 

6 ‘‘(BB) The list under subitem 

7 (AA) shall include an application pro8 gramming interface through which at 

9 least 1 user interface offered by a 

10 State under item (aa) allows house11 holds to delegate access to some or all 

12 account features identified by the Sec13 retary to third-party provided soft14 ware. No fee shall be charged to any 

15 party for the use of that application 

16 programming interface. 

17 ‘‘(CC) During the 10-year period 

18 following the date on which the regu19 lations promulgated pursuant to 

20 clause (i) become final, unless the 

21 Secretary extends that period, the 

22 Secretary shall maintain on the list 

23 under subitem (AA) the following user 

24 interfaces: text message, voice tele25 phone service, and a nondigital user 


ssavage on LAPJG3WLY3PROD with BILLS
7 

•HR 7585 IH

1 interface that does not require the use 

2 of a phone or computer by the house3 hold. 

4 ‘‘(II)(aa) Each State shall pro5 vide households on an opt-in basis— 

6 ‘‘(AA) through each digital 

7 user interface offered under sub8 clause (I), timely electronic notice 

9 of transactions using the EBT 

10 account of the household; and 

11 ‘‘(BB) through each user 

12 interface offered under subclause 

13 (I), access to, including the abil14 ity to search, historical trans15 actions for not less than the pre16 ceding 12 months. 

17 ‘‘(bb) Transaction information 

18 under subitems (AA) and (BB) of 

19 item (aa) shall include the amount of 

20 the transaction, the merchant for the 

21 transaction, the city and State of the 

22 merchant for an in-person trans23 action, and the delivery address or 

24 collection address for an online trans25 action. 


ssavage on LAPJG3WLY3PROD with BILLS
8 

•HR 7585 IH

1 collection address for an online trans2 action. 

3 ‘‘(cc) Each State shall offer 

4 households the ability, through each 

5 user interface offered under subclause 

6 (I), to report a fraudulent transaction 

7 to the State. 

8 ‘‘(dd) A State shall not require a 

9 household to respond to or acknowl10 edge a notice of transaction delivered 

11 pursuant to item (aa)(AA). 

12 ‘‘(ee) A State shall notify a 

13 household that has received reim14 bursement for EBT card fraud pursu15 ant to section 501(b)(2) of division 

16 HH of the Consolidated Appropria17 tions Act, 2023 (7 U.S.C. 

18 2016a(b)(2)), of the ability of the 

19 household to opt in to restricting the 

20 use of the EBT card as described in 

21 subclause (III) and of the remaining 

22 funds that may be reimbursed if the 

23 household experiences fraud again. 

24 ‘‘(III) Each State shall provide 

25 households issued an EBT card the 


ssavage on LAPJG3WLY3PROD with BILLS
9 

•HR 7585 IH

1 ability, through each user interface of2 fered under subclause (I)— 

3 ‘‘(aa) to make the use of 

4 that EBT card for online trans5 actions workable only through 

6 virtual card numbers or other 

7 tokenization technology, such as 

8 through a mobile payment serv9 ice, which shall require a dif10 ferent virtual card number for 

11 each individual online merchant; 

12 ‘‘(bb) to freeze and unfreeze 

13 the EBT account of the house14 hold for transactions in which the 

15 card number printed on the EBT 

16 card is manually entered, either 

17 for an in-person transaction or 

18 an online transaction; and 

19 ‘‘(cc) to check the enroll20 ment status of the household, in21 cluding the date on which the 

22 household is required to apply for 

23 recertification. 

24 ‘‘(IV) The requirements de25 scribed in items (aa) and (bb) of subVerDate Sep 11 2014 15:49 Mar 17, 2024 Jkt 049200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H7585.IH H7585

ssavage on LAPJG3WLY3PROD with BILLS
10 

•HR 7585 IH

1 clause (III) shall terminate 5 years 

2 after the date on which the regulation 

3 promulgated pursuant to that sub4 clause becomes final, unless the Sec5 retary extends that period. 

6 ‘‘(V) A State may opt to make 

7 ineffective the use of the card number 

8 printed on the EBT card to complete 

9 an online transaction, and require on10 line transactions to occur only in ac11 cordance with subclause (III)(aa). 

12 ‘‘(VI) Not later than 2 years 

13 after the date on which the regula14 tions promulgated pursuant to clause 

15 (i) become final, States shall begin 

16 issuing chip-enabled EBT cards. 

17 ‘‘(VII) Not later than 4 years 

18 after the date on which the regula19 tions promulgated pursuant to clause 

20 (i) become final, States may not issue 

21 new EBT cards with magnetic stripes. 

22 ‘‘(VIII) Not later than 5 years 

23 after the date on which the regula24 tions promulgated pursuant to clause 

25 (i) become final, States shall be reVerDate Sep 11 2014 15:49 Mar 17, 2024 Jkt 049200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H7585.IH H7585

ssavage on LAPJG3WLY3PROD with BILLS
11 

•HR 7585 IH

1 quired to reissue any existing valid 

2 EBT cards with magnetic stripes as 

3 chip-enabled EBT cards without mag4 netic stripes. 

5 ‘‘(IX) In the case of a chip-en6 abled EBT card reissued pursuant to 

7 any of subclauses (VI) through (VIII), 

8 absent suspicion of fraud, as applica9 ble, a State shall— 

10 ‘‘(aa) reissue a new chip-en11 abled EBT card; and 

12 ‘‘(bb) deactivate the current 

13 chip-enabled EBT card on the 

14 date that is the earlier of— 

15 ‘‘(AA) the date on 

16 which the new chip-enabled 

17 EBT card is activated; and 

18 ‘‘(BB) 30 days after 

19 the date on which the new 

20 chip-enabled EBT card is 

21 sent to the household. 

22 ‘‘(iii) SUNSET FOR REQUIREMENT TO

23 USE CHIP TECHNOLOGY.—Under the cy24 bersecurity regulations described in clause 

25 (i), all EBT cards issued during the 5-year 


ssavage on LAPJG3WLY3PROD with BILLS
12 

•HR 7585 IH

1 out clause (ii)(VIII) shall be chip-enabled, 

2 unless the Secretary extends that period. 

3 ‘‘(C) REIMBURSEMENTS.—Each State up4 grading EBT cards to comply with the regula5 tions promulgated under subparagraph (B)(i) 

6 shall receive reimbursement from the Secretary 

7 in an amount determined by the Secretary to 

8 cover all reasonable costs incurred by the State, 

9 including— 

10 ‘‘(i) the 1-time up-front costs paid by 

11 the State to card vendors; 

12 ‘‘(ii) the additional annual fees associ13 ated with chip-enabled cards paid by 

14 States to card vendors; and 

15 ‘‘(iii) postage or other delivery-related 

16 costs. 

17 ‘‘(D) PROHIBITION ON PASSWORD AND PIN

18 REQUIREMENTS INCONSISTENT WITH FEDERAL

19 CYBERSECURITY STANDARDS.—Beginning 60 

20 days after the date of enactment of this para21 graph, a State agency may not require, with re22 spect to a PIN for use of an EBT card or a 

23 password for access to an online account or mo24 bile application managing the EBT card— 


ssavage on LAPJG3WLY3PROD with BILLS
13 

•HR 7585 IH

1 ‘‘(i) that the PIN or password be peri2 odically changed in circumstances that are 

3 prohibited by the NIST PIN and password 

4 standards; or 

5 ‘‘(ii) that the password meet com6 plexity requirements that are prohibited by 

7 the NIST PIN and password standards. 

8 ‘‘(E) GRANT PROGRAM FOR CHIP-ENABLED

9 EBT CARDS.— 

10 ‘‘(i) DEFINITIONS.—In this subpara11 graph: 

12 ‘‘(I) ADMINISTERING ENTITY.— 

13 The term ‘administering entity’ means 

14 an entity awarded a grant under 

15 clause (ii) to provide subgrants to eli16 gible entities. 

17 ‘‘(II) ELIGIBLE ENTITY.—The 

18 term ‘eligible entity’ means— 

19 ‘‘(aa) an entity described in 

20 paragraph (1) or (3) of section 

21 3(o) that— 

22 ‘‘(AA) is authorized to 

23 participate in the supple24 mental nutrition assistance 

25 program under section 9; 


ssavage on LAPJG3WLY3PROD with BILLS
14 

•HR 7585 IH

1 ‘‘(BB) does not have 

2 payment terminals that ac3 cept chip-enabled EBT 

4 cards; and 

5 ‘‘(CC) is located in an 

6 area with limited grocery ac7 cess, as determined by the 

8 Secretary; and 

9 ‘‘(bb) an entity described in 

10 paragraph (2), (4), or (5) of sec11 tion 3(o) that meets the require12 ments described in subitems 

13 (AA) and (BB) of item (aa). 

14 ‘‘(ii) GRANTS.—The Secretary shall 

15 establish a grant program to award a 

16 grant to an administering entity to provide 

17 subgrants to eligible entities to upgrade to 

18 chip-compatible payment terminals that 

19 support contact and contactless payment 

20 card technology. 

21 ‘‘(F) DATA COLLECTION.—The Secretary 

22 shall— 

23 ‘‘(i) collect, and publish on the website 

24 of the Department of Agriculture, data 

25 on— 


ssavage on LAPJG3WLY3PROD with BILLS
15 

•HR 7585 IH

1 ‘‘(I) the length of time each user 

2 interface offered by each State pursu3 ant to subparagraph (B)(ii)(I) was 

4 unavailable for use, including due to 

5 technical problems or maintenance 

6 needs; and 

7 ‘‘(II) cybersecurity measures 

8 adopted for EBT cards in each State; 

9 and 

10 ‘‘(ii) maintain and annually update 

11 the data collected under clause (i) to sup12 port States in implementing any regula13 tions promulgated pursuant to subpara14 graph (B)(i). 

15 ‘‘(G) PUBLIC REPORT.— 

16 ‘‘(i) IN GENERAL.—Not later than 1 

17 year after the date of enactment of this 

18 paragraph, and every 2 years thereafter, 

19 the Secretary shall submit to the Commit20 tees on Appropriations and Agriculture, 

21 Nutrition, and Forestry of the Senate and 

22 the Committees on Appropriations and Ag23 riculture of the House of Representatives, 

24 and make publicly available on the website 


ssavage on LAPJG3WLY3PROD with BILLS
16 

•HR 7585 IH

1 of the Department of Agriculture, a report 

2 that— 

3 ‘‘(I) identifies trends relating to 

4 the theft of benefits, including the fre5 quency of theft of benefits and the lo6 cation of those thefts; 

7 ‘‘(II) evaluates the effectiveness 

8 of existing cybersecurity regulations 

9 for the supplemental nutrition assist10 ance program, including identifying 

11 ineffective measures and the compli12 ance burden borne by individual ben13 efit recipients; 

14 ‘‘(III) describes the efforts of 

15 States— 

16 ‘‘(aa) to update cybersecu17 rity measures for EBT cards; 

18 and 

19 ‘‘(bb) to reimburse stolen 

20 benefits; and 

21 ‘‘(IV) examines usability issues of 

22 EBT cards, including issues that 

23 present barriers to households using 

24 benefits or affect fraud prevention 

25 goals. 


ssavage on LAPJG3WLY3PROD with BILLS
17 

•HR 7585 IH

1 ‘‘(ii) RESTRICTED ANNEX.—The re2 port under clause (i) may include a non3 publicly available annex containing classi4 fied or law enforcement-sensitive informa5 tion.’’. 

6 SEC. 3. ENSURING NO LOSS OF ACCESS TO BENEFITS DUE 

7 TO EBT CARD DAMAGE, LOSS, OR FRAUD. 

8 Section 7(h)(7) of the Food and Nutrition Act of 

9 2008 (7 U.S.C. 2016(h)(7)) is amended— 

10 (1) by striking ‘‘Regulations’’ and inserting the 

11 following: 

12 ‘‘(A) IN GENERAL.—Regulations’’; and 

13 (2) by adding at the end the following: 

14 ‘‘(B) ENSURING NO LOSS OF ACCESS TO

15 BENEFITS DUE TO EBT CARD DAMAGE, LOSS, 

16 OR FRAUD.—Not later than 180 days after the 

17 date of enactment of the Enhanced Cybersecu18 rity for SNAP Act of 2024, the Secretary shall 

19 promulgate regulations requiring the following: 

20 ‘‘(i) If an EBT card is damaged, no 

21 longer functions properly, is stolen, or is 

22 frozen due to fraud, the applicable State 

23 shall take the necessary steps to ensure 

24 that the household receives a replacement 

25 card, either by mail or in person, as seVerDate Sep 11 2014 17:39 Mar 17, 2024 Jkt 049200 PO 00000 Frm 00017 Fmt 6652 Sfmt 6201 E:\BILLS\H7585.IH H7585

ssavage on LAPJG3WLY3PROD with BILLS
18 

•HR 7585 IH

1 lected by the household, not later than 3 

2 business days after the household submits 

3 to the State a request for a replacement 

4 EBT card. 

5 ‘‘(ii) A State shall not require, but 

6 shall offer as an option, in-person collec7 tion of a new or replacement EBT card.’’. 

8 SEC. 4. NO REPLACEMENT FEES FOR CERTAIN EBT CARDS. 

9 Section 7(h)(8)(A) of the Food and Nutrition Act of 

10 2008 (7 U.S.C. 2016(h)(8)(A)) is amended— 

11 (1) by striking ‘‘A State agency’’ and inserting 

12 the following: 

13 ‘‘(i) IN GENERAL.—Except as pro14 vided in clause (ii), a State agency’’; and 

15 (2) by adding at the end the following: 

16 ‘‘(ii) EXCEPTIONS.—Beginning 60 

17 days after the date of enactment of the 

18 Enhanced Cybersecurity for SNAP Act of 

19 2024, a State agency may not collect a 

20 charge under clause (i) if the replacement 

21 of the EBT card is due to— 

22 ‘‘(I) the EBT card malfunc23 tioning; 

24 ‘‘(II) suspected or reported fraud 

25 relating to that EBT card by an indiVerDate Sep 11 2014 17:39 Mar 17, 2024 Jkt 049200 PO 00000 Frm 00018 Fmt 6652 Sfmt 6201 E:\BILLS\H7585.IH H7585

ssavage on LAPJG3WLY3PROD with BILLS
19 

•HR 7585 IH

1 vidual outside of the household to 

2 which the EBT card belongs; 

3 ‘‘(III) the expiration of the EBT 

4 card; or 

5 ‘‘(IV) required replacement of the 

6 EBT card in compliance with regula7 tions promulgated pursuant to para8 graph (15)(B).’’. 

9 SEC. 5. REQUIREMENT FOR RETAILER USE OF CHIP-EN10 ABLED PAYMENT TERMINALS AS A CONDI11 TION OF SNAP PARTICIPATION. 

12 Section 9(a) of the Food and Nutrition Act of 2008 

13 (7 U.S.C. 2018(a)) is amended— 

14 (1) in paragraph (2)— 

15 (A) by striking ‘‘(2) The Secretary’’ and 

16 inserting the following: 

17 ‘‘(2) REGULATIONS.—The Secretary’’; and 

18 (B) by indenting the margins of subpara19 graphs (A) and (B) appropriately; 

20 (2) by indenting the margin of paragraph (3) 

21 appropriately; and 

22 (3) by adding at the end the following: 

23 ‘‘(5) CHIP-ENABLED PAYMENT TERMINALS.— 

24 Beginning not later than 180 days after the date on 

25 which the regulations promulgated pursuant to secVerDate Sep 11 2014 17:39 Mar 17, 2024 Jkt 049200 PO 00000 Frm 00019 Fmt 6652 Sfmt 6201 E:\BILLS\H7585.IH H7585

ssavage on LAPJG3WLY3PROD with BILLS
20 

•HR 7585 IH

1 tion 7(h)(15)(B)(i) become final, the Secretary shall 

2 require retail food stores and wholesale food con3 cerns seeking authorization or reauthorization to ac4 cept and redeem benefits under the supplemental 

5 nutrition assistance program to have a chip-enabled 

6 (as defined in section 7(h)(15)(A)) payment terminal 

7 at each retail location of the retail food store or 

8 wholesale food concern.’’. 

9 SEC. 6. REPORT. 

10 (a) IN GENERAL.—Not later than 1 year after the 

11 date of enactment of this Act, the Secretary of Agriculture 

12 shall submit to the Committees on Appropriations and Ag13 riculture, Nutrition, and Forestry of the Senate and the 

14 Committees on Appropriations and Agriculture of the 

15 House of Representatives, and make publicly available on 

16 the website of the Department of Agriculture, a report on 

17 the security of EBT cards (as defined in section 3 of the 

18 Food and Nutrition Act of 2008 (7 U.S.C. 2012)) issued 

19 in the Commonwealth of Puerto Rico, including— 

20 (1) the resistance of those EBT cards to 

21 cloning; and 

22 (2) if appropriate, recommendations for improv23 ing the security of the electronic benefit transfer sys24 tem against EBT card cloning-based fraud. 


ssavage on LAPJG3WLY3PROD with BILLS
21 

•HR 7585 IH

1 (b) RESTRICTED ANNEX.—The report under sub2 section (a) may include a nonpublicly available annex con3 taining classified or law enforcement-sensitive informa4 tion. 

5 SEC. 7. CONFORMING AMENDMENTS. 

6 Section 501 of division HH of the Consolidated Ap7 propriations Act, 2023 (7 U.S.C. 2016a), is amended— 

8 (1) in subsection (a)— 

9 (A) by striking paragraphs (1) and (2); 

10 (B) by redesignating paragraphs (3) 

11 through (5) as paragraphs (1) through (3), re12 spectively; and 

13 (C) in paragraph (3) (as so redesig14 nated)— 

15 (i) in subparagraph (B), by adding 

16 ‘‘and’’ at the end; 

17 (ii) by striking subparagraph (C); and 

18 (iii) by redesignating subparagraph 

19 (D) as subparagraph (C); and 

20 (2) in subsection (b)— 

21 (A) in paragraph (1)— 

22 (i) in subparagraph (A)(vi), by strik23 ing ‘‘measures’’ and all that follows 

24 through ‘‘(a)(1)’’ and inserting ‘‘meas25 ures’’; 


ssavage on LAPJG3WLY3PROD with BILLS
22 

•HR 7585 IH

1 (ii) in subparagraph (B), by adding 

2 ‘‘and’’ at the end; 

3 (iii) in subparagraph (C), by striking 

4 ‘‘and’’ at the end; and 

5 (iv) by striking subparagraph (D); 

6 and 

7 (B) in paragraph (3), by striking ‘‘sub8 section (a)(3)’’ and inserting ‘‘subsection 

9 (a)(1)’’. 

Æ 


ssavage on LAPJG3WLY3PROD with BILLS