,i #aaith ,,congress #b;d ,session ,h4 ,r4 #gcaf ,,in ,,the ,,house ,,of ,,representatives ,february #b1 #bjbf,ms4 ,malliotakis introduced the following bill2 which was referred to the ,committee on ,agriculture ,a ,,bill ,to amend the ,food and ,nutrition ,act of #bjjh to require the promulgation of cybersecurity regulations and implementation of ,,emv technology relating to the use of ,,ebt cards under the supplemental nutrition assistance program1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,,snap ,payment ,security and ,fraud ,prevention ,act of #bjbf4 #b4 ,expanded investigative authority of the ,department of ,agriculture ,inspector ,general ,section #af of the ,food and ,nutrition ,act of #bjjh 7#g ,u4,s4,c4 #bjbe7 is amended by adding at the end the following3 7i7 ,office of ,inspector ,general coordination authority 7#a7 ,the ,inspector ,general of the ,department of ,agriculture shall have full authority to investigate and coordinate multi-jurisdictional efforts to prevent1 detect1 and prosecute theft1 misuse1 or fraudulent accessing of supplemental nutrition assistance program benefits1 including authority-- 7,a7 to investigate cyber-enabled benefit theft1 including skimming1 cloning1 phishing1 spoofing1 and unauthorized access to ,,ebt systems2 7,b7 to issue subpoenas1 executing warrants1 and initiating civil or criminal referrals2 7,c7 to coordinate with the ,department of ,justice1 the ,federal ,bureau of ,investigation1 the ,department of ,homeland ,security1 the ,secret ,service1 ,state and local law enforcement1 and financial institutions2 7,d7 to request and receive data from ,state ,,ebt processors and contracted vendors for investigative purposes2 and 7,e7 to participate in interagency cyber task forces or fraud detection initiatives4 7#b7 ,the ,secretary of ,agriculture may issue rules1 and allocate funds1 necessary to support the activities of the ,inspector ,general under this subsection4 4 #c4 ,civil penalty for theft of ,,snap benefits ,section #ae of the ,food and ,nutrition ,act of #bjjh 7#g ,u4,s4,c4 #bjbd7 is amended by adding at the end the following3 7g7 ,civil penalty for theft of supplemental nutrition assistance program benefits 7#a7 ,any person who knowingly accesses1 uses1 or transfers supplemental nutrition assistance program benefits issued to a household without authorization shall be liable to the ,united ,states for a civil penalty in an amount equal to twice the value of such benefits lost as a result of such conduct4 7#b7 ,the ,secretary may assess and enforce this penalty through an administrative proceeding under section #ad or through a civil action in an appropriate district court of the ,united ,states4 7#c7 ,funds recovered under this subsection shall be used1 as determined by the ,secretary to offset-- 7,a7 the cost of reimbursing households for such benefits lost as a result of the conduct described in paragraph 7#a72 and 7,b7 the cost of the use of the enhanced investigatory authority of the ,inspector ,general of the ,department of ,agriculture4 7#d7 ,a civil penalty imposed under this subsection shall be in addition to any other civil or criminal penalty imposed under any other provision of this ,act or under any other provision of law4 4 #d4 ,enhanced cybersecurity for ,,ebt cards ,section #g7;h7 of the ,food and ,nutrition ,act of #bjjh 7#g ,u4,s4,c4 #bjaf7;h77 is amended by adding at the end the following3 7#ae7 ,cybersecurity of ,,ebt cards 7,a7 ,definitions ,in this paragraph3 7i7 ,chip-enabled 7,i7 ,in general ,the term chip-enabled1 with respect to a payment card1 means a payment card that uses industry standard secure payment technology1 as identified by the ,administrator of the ,food and ,nutrition ,service1 in consultation with the ,secretary of the ,treasury and the ,director of the ,national ,institute of ,standards and ,technology1 that-- 7aa7 provides for secure card-based payment2 and 7bb7 is resistant to cloning4 7,,ii7 ,,emv chip ,the ,administrator of the ,food and ,nutrition ,service1 in consultation with the ,secretary of the ,treasury and the ,director of the ,national ,institute of ,standards and ,technology1 shall consider whether the secure payment technology described in subclause 7,i7 should meet the standards published by ,e,m,v,co for contact and contact less payments4 7ii7 ,mobile friendly ,the term #8mobile friendly' has the meaning given the term in section #ceei7;b7 of title #dd1 ,united ,states ,code4 7iii7 ,,nist ,,pin and password standards ,the term ,,nist ,,pin and password standards means the ,,pin and password standards described in ,special ,publication #hjj-fc;,b entitled ,digital ,identity ,guidelines 7or a successor document7 of the ,national ,institute of ,standards and ,technology4 7iv7 ,,pin ,the term ,,pin has the meaning given the term personal identification number 7,,pin7 in section #bga4b of title #g1 ,code of ,federal ,regulations 7or successor regulations74 7,b7 ,regulations 7i7 ,in general ,not later than #b years after the date of the effective date of this paragraph1 the ,secretary shall promulgate1 and every #e years thereafter1 the ,secretary shall review and update as necessary1 cybersecurity and digital service regulations relating to ,,ebt cards and mobile payments under the supplemental nutrition assistance program1 including1 at a minimum1 to ensure that cybersecurity measures for ,,ebt cards and mobile payments keep pace with security safeguards used by the private sector and required by ,federal agencies for credit1 debit1 and other payment cards and mobile payments4 7ii7 ,requirements ,the ,secretary shall ensure that the cybersecurity and digital service regulations described in clause 7i7 require the following3 7,i7 7aa7 ,each ,state shall operate the user interfaces listed on the list of required user interfaces maintained by the ,secretary under item 7dd77,,aa71 in accordance with this subclause1 #a or more user interfaces of which households in the ,state may1 at the election of the applicable household1 use to manage the ,,ebt account of the applicable household4 7bb7 7,,aa7 ,a ,state may operate other user interfaces under item 7aa7 in addition to the required user interfaces on the list maintained by the ,secretary under item 7dd77,,aa74 7,,bb7 ,any web-based online portal operated by a ,state as a user interface shall be mobile friendly4 7cc7 ,each user interface offered by a ,state under items 7aa7 and 7bb71 as applicable1 shall-- 7,,aa7 provide information in each language in which the ,state agency is required to make material available pursuant to section #bgb4d7;b7 of title #g1 ,code of ,federal ,regulations 7or successor regulations72 7,,bb7 be available to households at least #ii percent of the time2 and 7,,cc7 include any other features required by the ,secretary4 7dd7 7,,aa7 ,the ,secretary shall maintain a list of required user interfaces for purposes of item 7aa71 which may include a web-based online portal and a mobile application4 7,,bb7 ,the list under subitem 7,,aa7 shall include an application programming interface through which at least #a user interface offered by a ,state under item 7aa7 allows households to delegate access to some or all account features identified by the ,secretary to third-party provided software4 ,no fee shall be charged to any party for the use of that application programming interface4 7,,cc7 ,during the #aj-year period following the date on which the regulations promulgated pursuant to clause 7i7 become final1 unless the ,secretary extends that period1 the ,secretary shall maintain on the list under subitem 7,,aa7 the following user interfaces3 text message1 voice telephone service1 and a nondigital user interface that does not require the use of a phone or computer by the household4 7,,ii7 7aa7 ,each ,state shall provide households on an opt-in basis-- 7,,aa7 through each digital user interface offered under subclause 7,i71 timely electronic notice of transactions using the ,,ebt account of the household2 and 7,,bb7 through each user interface offered under subclause 7,i71 access to1 including the ability to search1 historical transactions for not less than the preceding #ab months4 7bb7 ,transaction information under subitems 7,,aa7 and 7,,bb7 of item 7aa7 shall include the amount of the transaction1 the merchant for the transaction1 the city and ,state of the merchant for an in-person transaction1 and the delivery address or collection address for an online transaction4 7cc7 ,each ,state shall offer households the ability1 through each user interface offered under subclause 7,i71 to report a fraudulent transaction to the ,state4 7dd7 ,a ,state shall not require a household to respond to or acknowledge a notice of transaction delivered pursuant to item 7aa77,,aa74 7ee7 ,a ,state shall notify a household that has received reimbursement for ,,ebt card fraud pursuant to section #eja7;b77#b7 of division ,,hh of the ,consolidated ,appropriations ,act1 #bjbc 7#g ,u4,s4,c4 #bjaf;a7b77#b771 of the ability of the household to opt in to restricting the use of the ,,ebt card as described in subclause 7,,iii7 and of the remaining funds that may be reimbursed if the household experiences fraud again4 7,,iii7 ,each ,state shall provide households issued an ,,ebt card the ability1 through each user interface offered under subclause 7,i7-- 7aa7 to make the use of that ,,ebt card for online transactions workable only through virtual card numbers or other tokenization technology1 such as through a mobile payment service1 which shall require a different virtual card number for each individual online merchant2 7bb7 to freeze and unfreeze the ,,ebt account of the household for transactions in which the card number printed on the ,,ebt card is manually entered1 either for an in-person transaction or an online transaction2 and 7cc7 to check the enrollment status of the household1 including the date on which the household is required to apply for recertification4 7,,iv7 ,the requirements described in items 7aa7 and 7bb7 of subclause 7,,iii7 shall terminate #e years after the date on which the regulation promulgated pursuant to that subclause becomes final1 unless the ,secretary extends that period4 7,v7 ,a ,state may opt to make ineffective the use of the card number printed on the ,,ebt card to complete an online transaction1 and require online transactions to occur only in accordance with subclause 7,,iii77aa74 7,,vi7 ,not later than #b years after the date on which the regulations promulgated pursuant to clause 7i7 become final1 ,states shall begin issuing chip-enabled ,,ebt cards4 7,,vii7 ,not later than #d years after the date on which the regulations promulgated pursuant to clause 7i7 become final1 ,states may not issue new ,,ebt cards with magnetic stripes4 7,,viii7 ,not later than #e years after the date on which the regulations promulgated pursuant to clause 7i7 become final1 ,states shall be required to reissue any existing valid ,,ebt cards with magnetic stripes as chip-enabled ,,ebt cards without magnetic stripes4 7,,ix7 ,in the case of a chip-enabled ,,ebt card reissued pursuant to any of subclauses 7,,vi7 through 7,,viii71 absent suspicion of fraud1 as applicable1 a ,state shall-- 7aa7 reissue a new chip-enabled ,,ebt card2 and 7bb7 deactivate the current chip-enabled ,,ebt card on the date that is the earlier of-- 7,,aa7 the date on which the new chip-enabled ,,ebt card is activated2 and 7,,bb7 #cj days after the date on which the new chip-enabled ,,ebt card is sent to the household4 7iii7 ,sunset for requirement to use chip technology ,under the cybersecurity regulations described in clause 7i71 all ,,ebt cards issued during the #e-year period following the deadline for carrying out clause 7ii77,,viii7 shall be chip-enabled1 unless the ,secretary extends that period4 7,c7 ,prohibition on password and ,,pin requirements inconsistent with federal cybersecurity standards ,beginning #fj days after the date of enactment of this paragraph1 a ,state agency may not require1 with respect to a ,,pin for use of an ,,ebt card or a password for access to an online account or mobile application managing the ,,ebt card-- 7i7 that the ,,pin or password be periodically changed in circumstances that are prohibited by the ,,nist ,,pin and password standards2 or 7ii7 that the password meet complexity requirements that are prohibited by the ,,nist ,,pin and password standards4 7,d7 ,data collection ,the ,secretary shall-- 7i7 collect1 and publish on the website of the ,department of ,agriculture1 data on-- 7,i7 the length of time each user interface offered by each ,state pursuant to subparagraph 7,b77ii77,i7 was unavailable for use1 including due to technical problems or maintenance needs2 and 7,,ii7 cybersecurity measures adopted for ,,ebt cards in each ,state2 and 7ii7 maintain and annually update the data collected under clause 7i7 to support ,states in implementing any regulations promulgated pursuant to subparagraph 7,b77i74 7,e7 ,public report 7i7 ,in general ,not later than #a year after the date of enactment of this paragraph1 and every #b years thereafter1 the ,secretary shall submit to the ,committees on ,appropriations and ,agriculture1 ,nutrition1 and ,forestry of the ,senate and the ,committees on ,appropriations and ,agriculture of the ,house of ,representatives1 and make publicly available on the website of the ,department of ,agriculture1 a report that-- 7,i7 identifies trends relating to the theft of benefits1 including the frequency of theft of benefits and the location of those thefts2 7,,ii7 evaluates the effectiveness of existing cybersecurity regulations for the supplemental nutrition assistance program1 including identifying ineffective measures and the compliance burden borne by individual benefit recipients2 7,,iii7 describes the efforts of ,states-- 7aa7 to update cybersecurity measures for ,,ebt cards2 and 7bb7 to reimburse stolen benefits2 and 7,,iv7 examines usability issues of ,,ebt cards1 including issues that present barriers to households using benefits or affect fraud prevention goals4 7ii7 ,restricted annex ,the report under clause 7i7 may include a non-publicly available annex containing classified or law enforcement-sensitive information4 4 #e4 ,ensuring no loss of access to benefits due to ,,ebt card damage1 loss1 or fraud ,section #g7;h77#g7 of the ,food and ,nutrition ,act of #bjjh 7#g ,u4,s4,c4 #bjaf7;h77#g77 is amended-- 7#a7 by striking ,regulations and inserting the following3 7,a7 ,in general ,regulations 2 and 7#b7 by adding at the end the following3 7,b7 ,ensuring no loss of access to benefits due to ,,ebt card damage1 loss1 or fraud ,not later than #ahj days after the effective date of this subparagraph1 the ,secretary shall promulgate regulations requiring the following3 7i7 ,if an ,,ebt card is damaged1 no longer functions properly1 is stolen1 or is frozen due to fraud1 the applicable ,state shall take the necessary steps to ensure that the household receives a replacement card1 either by mail or in person1 as selected by the household1 not later than #c business days after the household submits to the ,state a request for a replacement ,,ebt card4 7ii7 ,a ,state shall not require1 but shall offer as an option1 in-person collection of a new or replacement ,,ebt card4 4 #f4 ,no replacement fees for certain ,,ebt cards ,section #g7;h77#h77;,a7 of the ,food and ,nutrition ,act of #bjjh 7#g ,u4,s4,c4 #bjaf7;h77#h77;,a77 is amended-- 7#a7 by striking ,a ,state agency and inserting the following3 7i7 ,in general ,except as provided in clause 7ii71 a ,state agency 2 and 7#b7 by adding at the end the following3 7ii7 ,exceptions ,beginning #fj days after the effective date of this clause1 a ,state agency may not collect a charge under clause 7i7 if the replacement of the ,,ebt card is due to-- 7,i7 the ,,ebt card malfunctioning2 7,,ii7 suspected or reported fraud relating to that ,,ebt card by an individual outside of the household to which the ,,ebt card belongs2 7,,iii7 the expiration of the ,,ebt card2 or 7,,iv7 required replacement of the ,,ebt card in compliance with regulations promulgated pursuant to paragraph 7#ae77;,b74 4 #g4 ,requirement for retailer use of chip-enabled payment terminals as a condition of ,,snap participation ,section #i7;a7 of the ,food and ,nutrition ,act of #bjjh 7#g ,u4,s4,c4 #bjah7;a77 is amended-- 7#a7 in paragraph 7#b7-- 7,a7 by striking 7#b7 ,the ,secretary and inserting the following3 7#b7 ,regulations ,the ,secretary 2 and 7,b7 by indenting the margins of subparagraphs 7,a7 and 7,b7 appropriately2 7#b7 by indenting the margin of paragraph 7#c7 appropriately2 and 7#c7 by adding at the end the following3 7#e7 ,chip-enabled payment terminals ,beginning not later than #ahj days after the date on which the regulations promulgated pursuant to section #g7;h77#ae77;,b77i7 become final1 the ,secretary shall require retail food stores and wholesale food concerns seeking authorization or reauthorization to accept and redeem benefits under the supplemental nutrition assistance program to have a chip-enabled 7as defined in section #g7;h77#ae77;,a77 payment terminal at each retail location of the retail food store or wholesale food concern4 4 #h4 ,report 7a7 ,in general ,not later than #a year after the date of the enactment of this ,act1 the ,secretary of ,agriculture shall submit to the ,committees on ,appropriations and ,agriculture1 ,nutrition1 and ,forestry of the ,senate and the ,committees on ,appropriations and ,agriculture of the ,house of ,representatives1 and make publicly available on the website of the ,department of ,agriculture1 a report on the security of ,,ebt cards 7as defined in section #c of the ,food and ,nutrition ,act of #bjjh 7#g ,u4,s4,c4 #bjab77 issued in the ,commonwealth of ,puerto ,rico1 including-- 7#a7 the resistance of those ,,ebt cards to cloning2 and 7#b7 if appropriate1 recommendations for improving the security of the electronic benefit transfer system against ,,ebt card cloning-based fraud4 7b7 ,restricted annex ,the report under subsection 7a7 may include a non-publicly available annex containing classified or law enforcement-sensitive information4 #i4 ,conforming amendments ,section #eja of division ,,hh of the ,consolidated ,appropriations ,act1 #bjbc 7#g ,u4,s4,c4 #bjaf;a71 is amended-- 7#a7 in subsection 7a7-- 7,a7 by striking paragraphs 7#a7 and 7#b72 7,b7 by redesignating paragraphs 7#c7 through 7#e7 as paragraphs 7#a7 through 7#c71 respectively2 and 7,c7 in paragraph 7#c7 7as so redesignated7-- 7i7 in subparagraph 7,b71 by adding and at the end2 7ii7 by striking subparagraph 7,c72 and 7iii7 by redesignating subparagraph 7,d7 as subparagraph 7,c72 and 7#b7 in subsection 7b7-- 7,a7 in paragraph 7#a7-- 7i7 in subparagraph 7,a77vi71 by striking measures and all that follows through 7a77#a7 and inserting measures2 7ii7 in subparagraph 7,b71 by adding and at the end2 7iii7 in subparagraph 7,c71 by striking and at the end2 and 7iv7 by striking subparagraph 7,d72 and 7,b7 in paragraph 7#c71 by striking subsection 7a77#c7 and inserting subsection 7a77#a74