Center for Federal Accountability

SNAP chip cards and account controls: what USDA proposes, and what it leaves open on location data and privacy records

USDA proposes moving SNAP benefits to chip cards and requiring every State to offer card locks, purchase alerts and 12 months of transaction history showing where each purchase was made. The two-year chip deadline appears only in the preamble, an option to hide location data from abusers is only under consideration, the rule does not address the agency's privacy records for transaction data, and several of its burden figures do not add up. Comments close December 22, 2026.

2026-10-24 · Food and Nutrition Administration, Agriculture Department · Information · Docket FNA-2026-0496

On October 23, 2026, the Agriculture Department's Food and Nutrition Administration proposed moving Supplemental Nutrition Assistance Program (SNAP) benefits onto chip cards and requiring a common set of account security tools in every State (91 FR 66958, RIN 0584-AE99). The proposal answers section 501 of the Consolidated Appropriations Act, 2023, which directed the Secretary to require State agencies, through notice-and-comment rulemaking, to take measures against theft of benefits by card skimming, card cloning and similar methods. Comments are due December 22, 2026, on regulations.gov docket FNA-2026-0496. The notice's own heading carries an older identifier, FNS-2025-0137, which uses the agency's former initials. Two comments had been posted as of October 24. The rule was reviewed by the Office of Management and Budget as economically significant and is designated a major rule (91 FR 66967–68).

## What would change

About 42 million people a month received SNAP in fiscal year 2025, on electronic benefit transfer (EBT) cards that still use magnetic stripes secured by a personal identification number (PIN) (91 FR 66958–59). As of August 2026, seven States had issued chip cards (91 FR 66961).

Cards. States would issue cards with a chip that can be inserted or tapped. The magnetic stripe could stay only as a fallback, used after a chip attempt fails (91 FR 66991). Cards would arrive inactive until the household activates them, carry an expiration date and a three-digit card security code for online purchases, and show the account number on the back (91 FR 66962, 66966–67). The preamble proposes two years after a final rule for the chip change (91 FR 66961).

Account controls. Every State would have to let households freeze their card, block out-of-State or online purchases, set a per-purchase limit and receive email or text alerts for purchases, PIN changes, balance checks and changes to contact details. Households must be able to turn these on and off online, by app, by phone or in person (91 FR 66966, 66977, 66988–89). States would have to reject easy PINs, such as repeated or sequential digits or any PIN beginning with 19 or 20 (91 FR 66965–66).

Account information. Cardholder websites and apps would show 12 months of transactions instead of two, "in real time," with each retailer's name and location, whether the purchase was online or in person, and a log of balance checks, PIN changes and changes to address, email or phone (91 FR 66963–64, 66977, 66979, 66989).

System rules. Processors would have to cut off unauthorized terminals, paper vouchers would be limited to outages and disasters, and States would have 180 days to adopt each new version of the industry message standard, ANSI X9.58 (91 FR 66962–66). Much of the detail sits in a new appendix, the "SNAP EBT Operating Standards," which the Department proposes to revise "on a regular, ongoing basis" (91 FR 66961).

## The numbers

The rule reports 753,929 approved claims for stolen benefits worth $360,441,561 through the second quarter of fiscal year 2025, about $478 a claim (91 FR 66960). Those claims were paid under the 2023 law, which as enacted covered thefts from October 1, 2022, through September 30, 2024. The rule says that replacement authority expired on December 20, 2024, and that States are "once again no longer required to report EBT fraud statistics." The Department says it "does not have data that can conclusively and accurately track" long-term theft (91 FR 66959–60).

The summary of the impact analysis puts one-time costs at about $283 million in fiscal years 2028 and 2029, shared by States, the federal government, households and businesses, then $12 million in fiscal 2030 and about $152 million over 2028 to 2037 (91 FR 66968). The full analysis is a separate document in the docket, which CFA could not open.

CFA recomputed the paperwork-burden estimates (91 FR 66969–72), and several do not reconcile. Five-minute tasks are multiplied by 0.10 hour, which is six minutes. The stated household total, 4,704,463.72 hours, is in fact the total for all respondents; its listed parts add to 7,332,596.60, including a 4,453,409.20-hour item that appears nowhere else, and the household table shows 4,678,679.72. The business table omits 480 hours of processor updates described in the text. The ongoing household burden is 1,799,492 hours in the text and 1,002,980.64 in the table.

## CFA's observations

These are CFA's readings of the published record.

The chip deadline is not in the rule text. Proposed section 274.1(a) says issuance systems "shall not rely on EBT cards which conduct transactions solely with magnetic stripes" but sets no date (91 FR 66974). The two-year period appears only in the preamble.

Location history and domestic violence. The Department acknowledges that a person who has fled domestic violence could be tracked by another household member through the purchase locations in a cardholder portal or app. It says it "is considering" requiring States to let households disable location information on a verified request, and asks for comment (91 FR 66964). The proposed text does not contain that option. Its one domestic-violence change concerns replacement cards that cannot be mailed (91 FR 66977).

Two standards for verifying callers. Phone balance checks would have to be verified with information only the household has, such as the card security code, and "must not use personally identifiable information," because several people may share one account (91 FR 66964, 66984). Choosing a PIN by phone would instead be confirmed with two items of personal information, such as birth date, last four digits of the Social Security number, ZIP code or case number (91 FR 66975, 66989). The Department calls phone PIN selection "not as secure" as an in-office device, requires it to be fully automated and makes States fully liable for losses from it.

Privacy records. The rule does not mention the Privacy Act, a system of records notice (the public notice describing a federal record system) or a privacy impact assessment; its E-Government Act section is one sentence (91 FR 66974). Its appendix says EBT processors send transaction data to the agency and that the agency "has access to all SNAP EBT transaction records" (91 FR 66982–83). The agency's notice for its National SNAP Information Database, now USDA/FNA-15 and first published as USDA/FNS-15 on June 23, 2025, lists EBT card numbers and "information derived from and associated with EBT transactions," and says records will be kept indefinitely until the National Archives approves a schedule (90 FR 26522–23). The June 15, 2026 changes to that notice did not alter those sections (91 FR 35948). The proposal does not say whether the new data it requires, such as purchase locations, balance-check and PIN-change logs and the email addresses and phone numbers used for alerts, will stay with State processors or reach the federal database.

Small-business analysis. The rule states that "it has been certified that this rule would have a significant impact on a substantial number of small entities" (91 FR 66968). Under the Regulatory Flexibility Act, a certification is used for a rule that would not have such an impact; a rule that would must be accompanied by an initial regulatory flexibility analysis. The published text contains no such analysis. It may be in the separate impact analysis.

## CFA's records on USDA

The Agriculture Department holds a "Minor" grade on CFA's agency scoreboard, with a composite score of 81.22 based on 2 areas, the third lowest of the ten agencies CFA grades. The government-wide composite is 83.38 across 8 areas. The grade does not measure EBT security, which States and their contracted processors operate. CFA's privacy-notice linkage report lists 28 Federal Register documents for the Food and Nutrition Administration as of the October 23, 2026 refresh, but only three are Privacy Act notices (the June 2026 changes to USDA/FNA-15 and USDA/FNA-5 and a rescission of USDA/FNS-7); the rest, including this proposed rule, are other notices. CFA's crawl has collected no privacy impact assessment pages for the agency.

## What to watch

Whether the final rule puts a chip deadline in the regulatory text, and what it says about removing magnetic stripes, on which the Department asked four specific questions.

Whether the final rule lets households hide purchase locations on request, and how a request would be verified.

Whether the agency publishes a privacy impact assessment or an updated USDA/FNA-15 notice that says which of the new account data reach federal systems, and whether States are again required to report theft data.

Corrected burden figures, the full impact analysis, and how future changes to the Operating Standards will be made: by new rulemaking, or by revising the appendix as the preamble suggests.

## How to comment

Comments can be filed on regulations.gov under docket FNA-2026-0496 (document FNA-2026-0496-0001), by email to the address in the notice, or by mail to Food and Nutrition Administration, SNAP Innovation Policy and Issuance Division, Issuance Support Branch, 5601 Sunnyside Ave., Beltsville, MD 20705. Comments, including those on the information collection (OMB number 0584-NEW), are due December 22, 2026. The agency will make commenters' names and comments public.

Authorities