Driving EBT Security Feature Adoption

Overview#overview

In late 2025, the U.S. Government Accountability Office (GAO) published a report on EBT theft that included a finding that surely resonated with people working inside the social safety net: security features built to protect cardholders such as card locking, or blocking out-of-state and online transactions were “…not widely used." GAO cited three reasons:

1. The safeguards are opt-in by default and require client effort to enable;
2. Awareness is limited and navigation to these features can be cumbersome;
3. Only 5 to 10 percent of EBT recipients use the mobile apps their state EBT processors provide which severely limits the number of recipients with streamlined access to these tools.

Due to our nationwide reach and role in helping millions of SNAP recipients manage their EBT benefits, Propel has been acutely aware of these challenges preceding the report and had already set out to try to close this gap. A set of ongoing interventions in 2025 drove the share of Propel users with at least one security feature enabled from 16% to 56%. Propel users enabling out-of-state transaction blocking and online transaction blocking prevented an estimated $225 million in transactions in 2025 (note: this figure reflects all transactions caught by the features — both suspected theft and other transactions, and does not include theft prevented by card locking).

The shared responsibility to support SNAP participants#the-shared-responsibility-to-support-snap-participants

Features like card locking, blocking out-of-state transactions, and blocking online transactions exist because state human service agencies and their EBT processor partners paid for and built them. That's not a small thing. Each one represents a meaningful institutional commitment: a state agency identifying the need and securing a line item and build hours, an EBT processor building or configuring the feature on the platform, integration with online portals and IVR systems, caseworker training, and outreach to inform cardholders the feature exists. It's months of coordinated work across multiple actors, often under tight budgets and alongside competing priorities.

The work we describe here sits entirely on top of that foundation. Propel's role is the adoption layer: states and vendors invest in features; cardholders need to know they exist and choose to use them. Bridging that gap is where we try to maximize our impact. Fighting EBT theft is an all hands-on-deck challenge that requires contributions from every actor in the EBT ecosystem.

Three interventions that made a difference#three-interventions-that-made-a-difference

When we started this work in early 2025, we hit a barrier the GAO report later mentioned: most cardholders did not perceive EBT theft as a direct, personal threat. A  survey we ran in April 2024 documented this clearly: 27 percent of cardholders had never heard of EBT theft at all even though 86 percent of them were highly online; and more than half had limited or no understanding of how skimming and phishing actually work. As one Propel user put it, she "didn't really believe in EBT theft because it had never happened to anyone she knew." A follow-up survey the next year found awareness was up 46 percent year-over-year, but still only 17 percent of cardholders were locking their cards. Closing that gap meant working on client perception, motivation, and friction at the same time.

1. Reminding cardholders before deposit day#1-reminding-cardholders-before-deposit-day

The data on when EBT theft happens is stark. In our  2026 EBT Theft Survey, 57 percent of victims said their most recent theft occurred on their deposit day. Propel's internal analysis of suspected theft goes further: more than 60 percent of fraudulent transactions occur within 24 hours of a cardholder's deposit, with the highest-risk window in the early morning hours after funds land (12am–7am). Criminals time their operations to maximize opportunity (and subsequently harm).

While exploring EBT theft trends, we looked at our user behavior data and found something surprising: cardholders who did enable card locking often only did so after their deposit had arrived in their account, meaning this security measure was being activated when the riskiest hours had already passed.

So we tried something different. We sent push notifications and emails in the seven days before a cardholder's expected deposit. At this time, balances are typically under $5 and card locking doesn’t create the same perceived obstacle to using benefits as when a higher balance is available. The goal was to get cardholders protected before there was anything on their cards worth stealing.

Overall security feature adoption rose by 4 percentage points among users who received the reminders, against a control group (a 3x increase). More importantly, the timing of enablement shifted: cardholders who responded enabled their card lock before their deposits, not after.

2. Tailoring the recommendation to how people actually shop#2-tailoring-the-recommendation-to-how-people-actually-shop

Card locking is the protection most widely promoted across the EBT field, and for good reason: when a card is locked, fraudulent transactions cannot be executed. But card locking also asks cardholders to form a new habit of locking the card when not in use, unlocking the card before each transaction, and then locking again after. That multi-step habit doesn't form easily for everyone. (In some states served by ConnectEBT, a feature is available that allows for a timed re-lock of the card, as shown in this video from the Pennsylvania Department of Human Services, removing some of the cognitive and behavioral burden associated with card locking.) Set-and-forget protections like out-of-state transaction blocking create a layer of protection for many users, reducing exposure to risk even if they haven’t built a habit around card locking.

For cardholders who almost exclusively shop in their home state, out-of-state transaction blocking is an intuitive solution. Our internal data show that, in 2025, 78% of stolen benefits were liquidated at retailers purporting to be located in New York, Pennsylvania, or Illinois. For an in-state shopper in any other state, blocking out-of-state transactions reduces their risk of victimization substantially with virtually no day-to-day obstruction of benefit accessibility.

We ran a campaign targeting this user segment. The messaging connected the feature to their existing habits, paired with a streamlined pathway to opt-in. 56 percent of cardholders who saw the campaign enabled out-of-state blocking.

User feedback was clear:

"Finally, a way to protect my funds. I was thankful."

"It's nice to know that things are being done to keep our EBT safe."

3. Reducing the friction of turning on security features#3-reducing-the-friction-of-turning-on-security-features

Multiple factors contribute to low security feature adoption: awareness, motivation, and friction among others. Even among cardholders who indicated interest in features like out-of-state blocking, many dropped off during the multi-step navigation required to actually enable them. Two changes addressed this directly:

One-tap enablement. We collapsed the out-of-state-blocking flow to one tap, a clear loading state, a confirmation banner, and a path back to disable if the user changed their mind. Adoption immediately rose 20 percent. Longer-term opt-out rates held steady, which suggests users found value in the choice they’d made.

Wallet controls on the home screen. We surfaced security feature toggles directly on the cardholder's home page in the Propel app, with icons that made current settings clear at a glance. Cardholder engagement with security features (i.e. turning them on or off) rose by 14 percent, with card locking adoption climbing steadily.

The result#the-result

Across these interventions, the share of Propel users with at least one security feature enabled grew from 16 percent in January 2025 to 56 percent in December 2025. $225 million in EBT transactions were blocked via online transaction and out-of-state transaction blocking protocols.

For broader context, the 2026 EBT Theft Survey found that the share of households reporting theft in the prior year dropped from 27 percent to 18 percent. Obviously, many things contributed to that success (California's chip card rollout, awareness building efforts by states and their EBT processor partners, and growing cardholder awareness driven by news media and word of mouth). The work highlighted here is one positive contribution among many.

What comes next#what-comes-next

EBT security is a dynamic landscape. Available features, their names, and how cardholders access them vary across state agencies and vendor platforms. New features and approaches are being introduced and considered. Propel’s goal is to reduce EBT theft as much as possible. We can achieve that goal by promoting security feature adoption, supporting the EBT ecosystem with learnings and insights, and by being available to develop new partnerships that protect EBT cardholders.

We’re proud of the work we’ve done to promote security feature adoption, and have ideas formed from these efforts about how the field can better fight EBT theft. We’ve shown that opt-in adoption can be a useful tool, but alternate design choices, including opt-out offerings and systematic protections go even further. California's introduction of EBT chip cards is showing promising early results: self-reported theft among California cardholders fell from 19 percent before the rollout to 8 percent afterward. Across the country, 60 percent of cardholders say they'd feel reassured by automatic 24/7 fraud monitoring that blocks suspicious transactions, and 53 percent want to use a chip card.

EBT theft is a crime with many victims: recipient households, the taxpayer, caseworkers, administrators, retailers deprived of sales. All of these EBT stakeholders are victimized by these terrible crimes. Fighting EBT theft requires an all hands on deck effort. Propel will continue to work to promote security feature adoption, share insights with states, EBT processors, and law enforcement. We’re ready to partner with anyone interested in fighting EBT theft.

If you work in state EBT administration, at an EBT processor, or in federal policy, and you want to dig into any of these interventions in more detail we'd love to hear from you. Reach out at gov@propel.app.

The interventions described here were built by Propel's benefits product and security feature teams, with input from cardholders who shared feedback throughout the year.

Theft-blocked analysis by Alice DuCharme, Data Scientist at Propel.

The underlying security features were built by state human service agencies and their EBT processor partners, and we thank them for their efforts and investments.