Why EBT cards are still a preferred skimming target
Electronic benefit transfer systems process SNAP and TANF payments using the same magnetic stripe technology that commercial banking moved away from over a decade ago. Magnetic stripe data can be read, copied, and replicated with widely available equipment. Criminal groups install skimmers on ATMs, fuel pumps, and POS terminals at SNAP-authorized retailers, capture card data and PINs, and produce clone cards that work at any terminal that accepts the magnetic stripe. Unlike credit card fraud, where losses fall on issuers and merchants, EBT fraud falls on recipients. GAO reports that federally funded replacement covers only benefits stolen through December 20, 2024, so unless a state funds replacement itself, as California does under AB 161 (CDSS Report to the Legislature), victims now absorb the loss.
The September 2025 GAO report on SNAP EBT card security (GAO-25-107964) identifies the core vulnerability plainly: EBT cards are targets because most lack the theft-prevention features that are standard in commercial payment cards. The same report counts more than $320 million in stolen benefits replaced with federal funds for nearly 679,000 households across the period ending December 20, 2024, and notes that state-reported data understates the full extent.
The legislative and regulatory context
The Consolidated Appropriations Act of 2023 (P.L. 117-328, Division HH, §501) did two things relevant to state IT shops. First, it gave USDA temporary authority to replace SNAP benefits stolen through skimming and cloning with federal funds. Congress extended that authority once, through December 20, 2024, and then let it lapse; GAO states that recipients whose benefits are stolen on or after December 21, 2024, are not eligible for replacement with federal funds. Second, it directed USDA to issue rules requiring state agencies to adopt card security measures (§501(a)(2)). The skimming-data reporting tied to the replacement program also ended: GAO says FNS no longer has authority to require that states submit data on stolen benefits.
GAO's September 2025 report recounts FNS's October 2022 guidance on card security tools (Table 3 of the report) and notes that in August 2024 the Accredited Standards Committee X9 ratified and published revised technical standards for SNAP EBT cards, referred to as ASC X9.58.
As of September 2025, the GAO report noted that FNS was developing a proposed rule, planned for publication in January 2026, that would require card security measures across SNAP jurisdictions. That target slipped. Governing reported in March 2026 that FNS expected to publish requirements by the end of September 2026, and a Federal Register search of FNS proposed rules showed no card-security proposed rule as of this article's publication. State IT teams should confirm current rule status through the FNS website and their FNS regional contacts; a final rule imposing mandatory conversion timelines would change procurement sequencing significantly.
An additional bill, the Enhanced Cybersecurity for SNAP Act of 2026 (S. 3949 / H.R. 7658), was introduced in Congress in 2026 and would require states to replace magnetic-stripe EBT cards with chip-enabled cards and establish a USDA grant program to help eligible small retailers upgrade to chip-capable POS terminals, according to the National Grocers Association's issue brief. Legislative status should be tracked separately from administrative rulemaking.
Where states actually are
As of the USDA's chip card status map last updated August 24, 2026, as reported by Newsweek, seven states had issued chip-enabled EBT cards to at least some participants: Alabama, California, Maryland, Massachusetts, Michigan, New Jersey, and Oklahoma. New Jersey completed a statewide rollout in September 2026. Virginia announced its own rollout the same month, which WDBJ reported as a phased rollout across 21 localities with high benefit theft.
California is the most thoroughly documented case. The state completed its statewide conversion in April 2025, issuing about 4.4 million replacement chip-and-tap cards by April 28, 2025 (CDSS Report to the Legislature). Governor Newsom's office reported in January 2026 that reimbursements for reported EBT theft fell 83% from January 2024 to November 2025, from about $20.9 million a month to roughly $4 million across food and cash benefits (press release). For food benefits alone, Governing reports reimbursements falling from over $8 million in January 2024 to about $1 million by November 2025. These figures credit chip-and-tap cards alongside other measures the state ran at the same time, including a machine-learning theft-detection model, forced PIN resets for compromised cards, app-based card freezing, and restrictions on early cash ATM withdrawals and out-of-state cash withdrawals, as the Governor's release describes them. The chip migration was not the only change in effect.
The other states with active programs are at varying stages: some have completed county-level pilots, others have issued cards to new enrollees while phasing in replacements, and some are mid-statewide rollout. Most remaining SNAP jurisdictions still issue magnetic-stripe-only cards.
The terminal fallback gap
The chip card program's biggest limiting factor is not on the state side of the transaction. It is the point-of-sale terminal network at SNAP-authorized retailers.
An EMV chip transaction requires a chip-capable terminal. When a cardholder inserts a chip card at a terminal that cannot read the chip, the terminal falls back to reading the magnetic stripe — which means the chip provides no fraud protection for that transaction. California's own reporting quantifies the gap. In January through April 2025, 73.3% of approved transactions on the new cards fell back to the magnetic stripe (CDSS Report to the Legislature). In September 2025, five months after every card was replaced, the figure was still 53.3% (CDSS Report to the Legislature). Small stores were not the only laggards. Among California's top SNAP retailers, Kroger was still fallback-only and Costco was in pilot in September 2025, per the same CDSS report. GAO adds that terminals used only for SNAP transactions may lack chip capability, and one EBT processor representative told GAO he observed independent retailers paying $500 to $1,000 to upgrade.
This is the key reason California's fraud results, strong as they are, need to be read carefully. Whether a recipient got chip protection depended on where they shopped, not on the card in their wallet.
State IT shops and benefits agencies should request retailer terminal readiness data from their EBT processor and from the USDA FNS SNAP-authorized retailer database before finalizing a chip card deployment timeline. The alternative is a card conversion that counts as completed but leaves a significant share of transactions unprotected.
What the terminal upgrade problem means operationally
State agencies do not control SNAP-authorized retailer terminals. Retailers acquire and maintain their own POS equipment. States have limited direct leverage.
What states can do:
- Ask your EBT processor what it can do on retailer readiness. Third-party processors and terminal vendors, not the state, push the software updates retailers need. Ask the processor for its certification schedule with the largest SNAP retailers in your state, and coordinate the card timeline with it. Treat any retailer-incentive offer as a contract term to negotiate, not an assumed feature.
- Use FNS outreach resources. FNS has released guidance to retailers on using EBT chip cards at checkout. State benefits agencies and FNS regional offices can coordinate outreach that informs retailers of the transition timeline and directs them to upgrade resources.
- Build acceptance tracking into deployment metrics. Count chip-on-chip transactions as the success metric, not cards issued. The transaction data from the EBT processor shows what percentage of chip card transactions are actually using the chip versus falling back. That number should be tracked monthly during rollout.
- Monitor the legislative grant program. If the Enhanced Cybersecurity for SNAP Act or equivalent legislation passes, it would create a USDA grant program for eligible small retailers. States should be ready to help USDA reach retailers in their highest-fallback areas.
The fraud detection and recovery layer
Chip card programs change the nature of fraud rather than eliminating it. In Spartan X's assessment, once skimming becomes harder, remaining fraud is likely to shift toward account takeover (using stolen credentials rather than cloned cards), social engineering, and benefits trafficking. GAO already reports "shimmer" devices emerging and stakeholders expecting thieves to target states that have not converted. State benefits fraud units should plan for this transition proactively, not reactively.
The federal benefit replacement program that ran from October 2022 through December 20, 2024 built claim-intake, validation and reconciliation workflows in the 52 states that replaced stolen benefits with federal funds (GAO-25-107964). Since it lapsed, states either fund replacement themselves, as California does, or leave victims without recourse. States that keep a replacement program, or that expect Congress to restore federal replacement, need that claims infrastructure sized for a transition period in which skimming declines but does not end.
States that have not invested in fraud detection recalibration — updating transaction anomaly models to reflect chip transaction patterns — risk both false positive spikes (legitimate chip transactions flagged as suspicious) and false negative gaps (novel fraud methods not yet modeled). Benefits fraud detection systems that were tuned to catch magnetic stripe-based anomalies need to be retrained on chip transaction data.
Decision sequence for state IT and benefits leadership
If your state has not yet launched a chip EBT card project, the following sequence is Spartan X's recommended order of work, drawn from the issues California and GAO documented:
- Confirm your EBT processor contract terms. Chip card issuance typically requires a contract modification or new RFP. Understand whether your current processor supports chip-and-tap issuance, what the timeline is, and what terminal certification process is required.
- Request terminal readiness data. Ask your processor for the percentage of chip-capable terminals at your SNAP-authorized retail network. Map coverage against recipient demographics to understand where fallback risk is concentrated.
- Confirm FNS rule status and timeline. The security-measures rule required by §501(a)(2) has not yet been proposed (see the Federal Register search of FNS proposed rules). When it is, it is expected to set requirements and timeframes. Knowing what is required avoids both over-building and under-building.
- Design replacement card issuance for the existing recipient population. About 4.4 million replacement cards is California's number; yours will differ. Plan for attrition of unreturned cards, replacement for residents who do not respond to initial mailings, and TTY/accessibility accommodations for recipients who need in-person assistance.
- Establish chip transaction tracking as a deployment metric from day one. Don't wait until rollout is complete to measure terminal fallback. Track it monthly from the start of phased deployment.
- Brief your fraud operations team on expected fraud pattern shifts before chip cards reach saturation. Establish a review checkpoint 90 days into production rollout.
What this is telling state technology buyers
The EBT chip migration is a case study in the difference between completing a technology delivery and achieving the outcome the delivery was meant to produce. A state can issue chip cards on schedule and still leave most transactions running on magnetic stripe for months, as California did through at least September 2025. The gap is not a vendor failure; it is a system boundary problem. The card is one component in a network that includes processors, terminal manufacturers, retailers, and recipients, none of whom are under direct state IT control.
Spartan X helps public-sector programs with this kind of multi-stakeholder transition, where the agency's deliverable is one layer in a larger operational chain: defining outcome metrics such as chip-on-chip share, building the monitoring to track them, and structuring vendor agreements around outcomes rather than outputs.
Sources and further reading
- GAO-25-107964: Nutrition Assistance — USDA Should Comprehensively Assess Benefit Theft Prevention Measures States Are Implementing (September 25, 2025)
- GAO-25-107964 full report (PDF)
- CDSS EBT Theft and EMV Tap Report to the Legislature, January to April 2025
- CDSS EBT Theft and EMV Tap Report to the Legislature, May to September 2025
- California Governor's Office: California reduces theft of food and cash benefits by 83 percent (January 16, 2026)
- National Grocers Association: Enhanced Cybersecurity for SNAP Act issue brief
- NACS: SNAP Modernization & EBT Chip Cards (updated May 2026)
- Alabama joins early state efforts to launch chip-enabled EBT cards, Route Fifty, February 2026
- Newsom touts gains against EBT theft, CalMatters, January 2026
- Governing: States and Feds Consider a Simple Solution to SNAP Fraud
