It’s a SNAP – And it Can Be Hacked A Number of Ways

The program was known for years as food stamps.

It was meant to provide assistance to people in need, making sure they had at least enough to eat and it literally distributed books of stamps to be used at grocery stores.

About a decade or so ago – depending upon which state you lived in – the stamps were phased out and recipients instead started to receive the equivalent of debit cards. A family that got, say, $500 a month in stamps instead had that money put on a card that could be used for food and, in theory, food alone.

The cards were introduced for a number of reasons, the main one it seems being that making people rummage through actual stamps in the grocery store was rather demeaning as it was a clear signal to anyone within eyeshot that they were poor.

It was also done to help other shoppers – everyone at some point in the past was stuck behind trying to figure out what could be paid for with food stamps and what had to be paid for with cash when you were just trying to buy a bottle of milk, or wine, or whatever.

Finally, as the tech was already in the stores to handle debit cards, it seemed to make sense and seemed to be simpler and secure.

(By the way, the program in California is technically called CalFresh but it is much more widely known as EBT, short for electronic benefits transfer.  You don’t see a bunch of stores with “We take CalFresh” signs in the windows, do you?)

So what could possibly go wrong in a national program involving $110 billion dollars, 42 million recipients (5 million people and $14.5 billion in California), and a whole bunch of chipless “debit” cards?

A lot – really, a lot a lot.

While the federal government estimates that only about one-tenth of one percent of the benefits are obtained fraudulently, security experts scoff at the number, putting it in the 15% range, or about $17 billion a year.

And how is that done?  Actually, there are number of ways the program (the feds call is SNAP – Supplemental Nutrition Assistance Program) can be hacked.

First, there is “recipient” fraud. That can involve straight up lying to get on the program, including lying about how many people are in the household, income, etc. That matters because the amount is based on the number of people, typically expected to be children. A single person now gets $292 a month and it goes up a couple hundred bucks or so for each extra person, hitting $1,756 for a family of eight.

To be eligible, households generally must earn less than 200% of the federal poverty level which means that if you make less than $30,000 or so a year as an individual or up to about $100,000 for that family of eight.

Additionally, California has its own non-federally related program to provide a similar benefits schedule for illegal aliens of a certain age.

Claiming extra kids is relatively common as is claiming less income that actually made.

A second type of recipient fraud is selling your “food stamps” for cash. This can be done in a few ways:

• Joe says to Jane “I’ll give you $60 if you buy me a $100 worth of stuff at the store.” This is very common and – even the experts say – very difficult to prevent. But it is not a large portion of the overall fraud issue, they add.
• Jane goes to a store she knows – well, everyone in the neighborhood knows – that will take food stamps for things the program is not meant to cover, like cigarettes and booze.  The store will give Jane $60 worth of whatever and then bill the card $100 (by the way, the fraud value is about 60% of the actual value pretty much everywhere, hence the $100 gets you $60 example.)
• Or Jane could go the same store and just straight up sell her credits, again, typically, at that $100 gets you $60 cash rate. The store then completely fabricates the purchase.
• Or Jane could claim her benefits were stolen and have the card refilled. That really does happen (more on that in a moment) but, as the feds mandate that a person can claim that occurrence twice a year and neither California nor the counties that directly administer the program tend to check, it is abused. Speaking of counties, Sacramento County lets a person do that waaay more than twice a year. The state estimates that “reimbursements” paid in the first year of being able to that – 2021-  were about $9  million. That is now up to about $40 million a year.

Separate from recipient fraud is organized fraud and that also takes many forms.

First there is skimming. That’s when a criminal puts a device into a “point of sale (POS)” machine that you find at every store; it’s where you insert the card. 

But CalFresh cards do not have chips – yet – so they are swiped. The skimming device then records all of the information from the incredibly insecure (DO NOT swipe any card ever if you can help it) magnetic stripe on the card, the criminal checks to see what the balance is, and can then drain the account.

It’s important to note that the cards do not carry food stamps alone but also other benefit programs like CalWorks (once known as welfare.) That issue will be more closely addressed in a subsequent article.

Sounds complicated and/or that the store must be in on it? No and typically no.

A criminal can install a skimmer on an unsecured POS machine in literally seconds.

“Oh, I meant to get Camels and not Marlboros – can you switch them out?” the criminal tells the clerk and in just that tiny amount of time when they are looking away a skimmer can be added.

That is also why gas stations are such popular targets – a skimmer can be added to the “pay at the pump” device even before you’ve filled up your tank and there are fewer worries about being spotted.

Hint – there are new skimmers that can even grab information from the chip showing up so try to make sure that the POS is locked. Almost all big stores have something that does that, including the big red brackets you may have noticed appearing on POS’s across the state.  Those almost certainly do not have a skimmer.

It should also be noted that when the criminals have the information they can look through it to find the highest balances and thefts in the $10,000 range are not uncommon.  Of course, a person who theoretically needs help buying food would have $10K on their EBT card would seem not to really need it and that it could be a “red flag” that something is not quite kosher. But that is not something the government tracks;  in fact it specifically does not allow for a high balance to trigger an investigation – a person can have as much as they want on the card and still have it filled every month, no questions asked.

Another way to scam the system is most likely the most direct – fake people. The SNAP program – depending upon the state and that includes California – is notoriously easy to get on.

In fact, if you want to know exactly how cyber criminals do it, here’s a handy tutorial to take you through the process:

It really is that easy.

For background, Brett Johnson is a former cyber criminal turned security consultant. While the entire video is fascinating, the detailed SNAP fraud stuff starts at about minute 26.

So what is California doing about it?

According to the Department of Social Services, EBT cards should have chips in them next year.

Specifically, a department spokesperson said this:

In partnership with our EBT vendor, federal partners, and other stakeholders, the Department is actively working to develop and deploy the use of chip/tap technology on EBT cards. It’s important to note that other states do not use chip/tap EBT cards, as there are complex technological changes required to accomplish this effort, both in California and nationwide. Due to the complex technological changes required to implement the use of EBT chip/tap cards, the timeline for card replacement is currently expected to begin in early 2025. California continues to work closely with federal oversight agencies, retail and consumer advocacy organizations, and key third-party processors to develop an implementation timeline that ensures Supplemental Nutrition Assistance Program (SNAP) retailers, financial institutions, and other EBT merchants are able to successfully process chip/tap transactions..    

 Additionally, the Department continues to work with local, state, and federal law enforcement authorities to mitigate the theft of EBT benefits. Multiple investigations are ongoing and arrests have been made. The Department is also advancing a consumer education campaign for cardholders, counties, and retailers to help educate the public and provide best practices on how to avoid, mitigate, and report EBT theft. For example, the following Public Service Announcement provides viewers with an overview on skimming, how to identify skimming devices, and who to contact if a skimming device or activity is found: https://www.youtube.com/watch?v=opg52FxKoSo&feature=youtu.be         .

 Also, in November 2023, the Department launched ebtEDGE, a mobile application and online web portal which provides EBT cardholders with card management features to help protect against EBT benefit theft. With ebtEDGE, cardholders can freeze their card when it’s not in use, block all online and/or out-of-state transactions, change PINs, and request a replacement card directly through the app. Additional information on ebtEDGE implementation can be found here.

Staying ahead of cyber fraud is difficult for any organization; as Johnson said “all the criminals have is time to figure things out.”

This is the first piece in a series on benefit fraud. CalWorks – the welfare program – is next, followed by a larger overview look of the problem and what can be done to solve it.