SNAP benefit theft: why an EBT card can be skimmed like any other card, and what a new USDA rule would change

On October 23, 2026, USDA’s Food and Nutrition Administration published a proposed rule — 91 Fed. Reg. 66958, docket FNS-2025-0137 — that would modernize the payment card SNAP households use to: chip and tap-to-pay EBT cards, self-service transaction blocks and alerts, and tighter PIN rules. Comments close December 22, 2026. Nothing in it binds anyone yet, but the document is also the clearest recent accounting of how SNAP benefits get stolen and what households can and cannot get back.

The theft problem in one paragraph

EBT cards today are essentially magnetic-stripe cards secured by a PIN, and the proposed rule states the consequence plainly: the dominant form of benefit theft is skimming of card data from the stripe, paired with a PIN captured by a hidden camera or overlay at a tampered reader, plus phishing — texts or fake sites that trick a household into handing over the card number and PIN. Because the card is PIN-only, a thief who has both pieces does not need the plastic. The numbers USDA cites: through the second quarter of FY2025, 753,929 claims for replacement of stolen benefits had been approved nationwide, worth $360,441,561 — and USDA notes that figure only counts households that filed claims.

What happened to replacement

This is the part most people do not know. Congress created a time-limited federal authority in the Consolidated Appropriations Act, 2023 (Public Law 117-328) requiring states to replace electronically stolen benefits with federal funds. That authority expired on December 20, 2024. USDA states that states are “once again no longer required” to report theft statistics — the federal replacement mandate is gone. Some states continue to replace stolen benefits under their own policies or state laws, and the terms vary by state; a household in one state may be made whole while a household across the river is not. That patchwork is exactly the problem the proposed rule is trying to shrink from the other end: stop the theft rather than fund the reimbursement.

What the proposed rule would change

Three things matter most for a household.

Chip cards. The definition of an EBT card would explicitly include cards with an EMV chip and NFC (contactless) capability — the technology bank cards have used since 2015, which the rule credits with large fraud reductions when the broader payment industry shifted. States would have two years from publication of a final rule to transition. USDA notes that as of August 2026, seven states have already issued chip-capable EBT cards; its modernization page tracks progress.

Self-service controls. State agencies would have to offer every household, without restriction, the ability to turn on or off: a block on out-of-state transactions, a block on card-not-present (online) transactions, a block on all transactions, alerts by email or text for purchases (including rejected ones and purchases over a user-selected limit), alerts for account activity such as PIN changes and balance inquiries, and a user-selected maximum transaction limit. Some states already offer versions of these. USDA also asks for comment on whether any block should be on by default.

PIN hygiene. States would be required to bar weak PINs — a repeated single digit, the card’s own last digits, alternating patterns like 1212, sequences starting with 19 or 20 (birth-year patterns), and the on-keypad walks 2580/8520/0852/0258. The rule also tightens how PINs may be set or changed, including closing unencrypted telephone PIN entry.

What to do now

• Check the reader and shield the keypad. Until your state issues a chip card, the stripe is the attack surface. A loose or bulky overlay on the card slot is the classic skim rig.
• Change your PIN regularly, and never to a pattern on the barred list. Do it at a state office terminal or a device you trust, not in response to a message.
• Turn on the controls your state already offers. Many states have card-lock features, out-of-state blocks, and transaction alerts in their official EBT app or portal. If you are unsure what your state offers, its SNAP agency’s EBT page lists it; USDA’s skimming-prevention page collects the guidance.
• Never give your card number or PIN to anyone who contacts you. No state agency asks for a PIN by phone, text, or email to “verify eligibility” or “release benefits.” That is the phishing script.
• Check your balance before you shop, in your state’s official app or by phone, so a zero balance is noticed the day it happens rather than at the register.
• If benefits are stolen, report immediately to your state SNAP agency and file a police report if asked; whether you are made whole depends on your state’s current policy, since the federal fund has lapsed.

The scam angle

A rule change is a pretext factory. Expect texts like “Your SNAP benefits are on hold — verify your EBT card here” and callers claiming a new USDA program requires re-enrollment. The real rule asks nothing of households: no application, no fee, no deadline, no card number. A genuine state EBT notice comes through your state agency’s own channels, and the only place to comment on the rule is the federal docket, which takes comments, not card numbers. Suspicious messages can be reported to your state agency and to the FTC at reportfraud.ftc.gov; our scam checklist for federal services covers the broader pattern.

Status and what to watch

This is a proposed rule. The chip transition clock — two years — starts at a final rule, not this document, and USDA has invited comment on whether two years is even feasible. The replacement gap is the open question the rule does not answer: it prevents better than it restores. We will update this article if the final rule lands or if Congress revives federal replacement funding.

This article is general information about SNAP EBT security and a proposed federal rule, not legal or benefits advice for your case. Replacement of stolen benefits and card features vary by state; confirm current terms with your state SNAP agency before relying on any statement here.