Designing Out SNAP Fraud

The Supplemental Nutrition Assistance Program (SNAP) cost about $100 billion in federal funds in fiscal year 2024 and served an average of 41.7 million people each month. Public debate often treats the program's payment error rate, near 11 percent in recent years, as a fraud rate. That reading is wrong. The error rate counts overpayments and underpayments from all causes, and most of it reflects mistakes by households and state agencies. The most studied fraud, trafficking (selling benefits for cash), diverted an estimated 1.6 to 2.0 percent of benefits from 2015 to 2017, almost all of it through small stores. Card skimming, a newer threat, steals from recipients. This report builds a taxonomy of SNAP fraud and explains why trafficking persists: the payment record carries no item list, and the shopper and the cashier both profit from the lie. It proposes a layered architecture covering eligibility, credentials, transactions, merchant payouts, and analytics. Its central problem is finding price anomalies across millions of daily transactions without human basket review. The answer is store-level scoring, automated graduated responses, and an investigation queue capped by budget. The report closes with harms, a policy alternative, and a phased roadmap.

1. Introduction

SNAP is the largest food assistance program in the United States. The US Department of Agriculture (USDA) funds the benefits and sets the rules. States determine eligibility, issue benefits, and run their own integrity units. USDA's Food and Nutrition Service (FNS) authorizes and polices the retailers that accept benefits. In 2026 USDA renamed FNS the Food and Nutrition Administration (FNA). This report keeps the name FNS because the studies and regulations it cites use that name.

Households receive benefits on an Electronic Benefit Transfer (EBT) card. The card works like a debit card restricted to a closed network of authorized retailers. A state loads the monthly benefit onto the household's account. The household buys eligible food at an authorized store, and the store's EBT processor debits the account. Within a few banking days the store receives the same amount in its bank account. Most EBT cards issued until recently used a magnetic stripe and a PIN. They carried no chip.

The scale is large on both sides of the transaction. USDA's Economic Research Service reports that SNAP served a monthly average of 41.7 million people in fiscal year 2024, about 12 percent of the US population, at a federal cost of $99.8 billion. Federal spending rose to about $102 billion in fiscal year 2025. Retailers number roughly 260,000. Superstores and supermarkets make up a small share of those stores but redeem most of the benefits. Convenience stores, small groceries, and specialty shops make up most of the authorized locations but redeem a small share of the dollars.

Fraud matters for two reasons. The first is budgetary. A benefit dollar that becomes 50 cents of cash for a recipient and 50 cents of profit for a store buys no food. The second is legitimacy. SNAP depends on public support, and that support erodes when voters believe the program leaks. Inflated claims about fraud do their own damage. They lead to controls that cost more than they save and that push eligible families out of the program. A sound design starts from accurate numbers (Figure 1).

2. A taxonomy of SNAP fraud

The Congressional Research Service groups SNAP integrity problems into trafficking, retailer application fraud, household errors and fraud, state agency errors and fraud, and external scams that steal benefits. This report uses a slightly finer grouping because each type calls for a different control (Figure 2).

Trafficking. Trafficking is the exchange of benefits for cash or anything other than eligible food. The typical case involves a recipient who lets a store clerk swipe the card for an amount, say $100, and receives a smaller amount of cash. Prosecutors in federal cases have described rates around 50 cents on the dollar, and some cases report higher or lower rates. Trafficking requires a retailer in almost every case, because only an authorized retailer can turn an EBT debit into a deposit. A recipient can also traffic by selling the card and PIN to a third party, who then shops with it.

Recipient eligibility fraud. An applicant may underreport earnings, omit a working household member, add a person who does not live in the home, or enroll in a second state. Honest mistakes produce the same outcomes, so eligibility problems show up in the error rate and only some of them are fraud.

Retailer ineligible sales and overcharging. A store may let EBT pay for items the law excludes, such as alcohol, tobacco, or paper goods. A store may also charge EBT shoppers more than cash shoppers, or inflate the price of real food items. The second practice can be collusive (the shopper accepts inflated prices in exchange for credit or cash) or predatory (the shopper does not notice).

Card skimming and cloning. Skimming is theft from recipients. A criminal attaches a device to a store's card reader or PIN pad. The device records the magnetic stripe data and the PIN. The criminal writes the data onto a blank card and drains the account, often within hours of the monthly benefit load. The recipient arrives at the store to find a zero balance. Magnetic stripe cards are easy to clone because the stripe carries static data that works on every swipe. A chip card generates a one-time code for each purchase, so copied data does not work for a second purchase.

Insider fraud. State employees with system access can create fictitious cases or issue benefits to accomplices. Cases are rare, and each can be large because the insider controls the record.

Organized rings. Rings combine the other types, for example by running several trafficking stores under nominee owners or skimming crews across states. They leave patterns across many cards and stores that no single transaction shows.

2.1 Fraud versus improper payments

The claim that "11 percent of SNAP is fraud" comes from the national payment error rate. USDA computes that rate each year from a quality control sample of cases. Reviewers check whether each sampled household received the correct benefit. Any difference above a small tolerance counts as an error, in either direction.

Four facts separate this rate from fraud. First, it includes underpayments, which are money the program failed to pay to eligible families. Second, it counts errors regardless of cause, and the largest causes are mistakes in income and household data made by households or caseworkers. USDA's own release for fiscal year 2024 stated that the rate is not a measure of fraud. Third, it measures eligibility and benefit amounts only. It does not measure trafficking at all, because a trafficked benefit was correctly issued to an eligible household before it was sold. Fourth, error rates move with administrative load. They fell to about 3 percent around 2013, then rose after the pandemic disrupted state operations and staffing (Figure 3).

The error rate is still a serious problem. Improper payments of about $10 billion a year are real money, and Congress has tied state cost sharing to error rates starting with fiscal year 2028. The point is narrower: the error rate and the fraud rate measure different things, and controls aimed at one do little for the other. The best available national fraud measure is the trafficking estimate. FNS's eighth study in that series, covering 2015 to 2017 and published in 2021, estimated that 1.6 percent of benefits were trafficked under its updated definition (about $1.0 billion a year) and 2.0 percent under the older definition (about $1.3 billion a year). The earlier 2012 to 2014 study put the rate near 1.5 percent. GAO has warned that the true figure is uncertain and could range from about $960 million to $4.7 billion a year, because the estimate rests on untested assumptions about how much of a trafficking store's volume is trafficked.

3. Anatomy of trafficking

The money flow of a single trafficking transaction is simple (Figure 4).

The core weakness. The EBT authorization message carries the store, the card, the amount, the date, and the time. It carries no list of items. FNS's 2016 feasibility study on capturing purchases at the point of sale confirmed that only total transaction amounts reach FNS. A trafficking store therefore never has to invent products. It keys in an amount, the network approves it, and the deposit follows. Every downstream check has to infer the fraud from the shape of the amounts and timings, because the record contains nothing else (Figure 5).

Both parties lie together. In most fraud, a victim has an incentive to report. In trafficking, the shopper and the cashier both gain. The recipient converts restricted benefits into cash, which can pay rent or utilities, or in worse cases buy drugs. The store keeps the spread. Neither party will complain, and any data either party enters can be shaped to look normal. This collusion property drives most of the design choices later in this report.

Why small stores dominate. The 2015 to 2017 study found that small stores (small and medium groceries and convenience stores) handled about 15 percent of redemptions but accounted for over 95 percent of trafficked dollars, and 99 percent under the updated definition. Several factors explain the concentration. A small store is often owner-operated, so one person controls the register, the cash drawer, and the books. Large chains run centralized point-of-sale systems with item scanning, cashier logins, and loss-prevention audits, and a cashier who trafficked would be stealing from the employer. Small stores also have few transactions per day, so a trafficking swipe does not need to hide in a long queue of scanned baskets. FNS itself excludes large stores from its watch list on the ground that their own controls deter trafficking.

The overcharging variant. A store can also traffic partially. The shopper buys real groceries worth $40, the register charges $70, and the shopper receives $15 in cash or store credit. The store earns $15 above its margin. This version leaves a basket that looks normal in size and timing, so it is harder for amount-based analytics to catch. It also has a predatory form, where the store inflates prices for EBT shoppers who do not check their receipts.

The economics. Any restricted currency trades at a discount to cash. A dollar of benefits that can only buy groceries is worth less than a dollar to a household that needs to pay rent. A household that already spends more than its benefit on food gains little from trafficking, because benefits replace cash food spending dollar for dollar. A household with an urgent cash need, or one whose benefit exceeds its food budget, may value a benefit dollar at well under a dollar. Trafficking monetizes that gap. A store that can offer cash at 50 to 70 cents per dollar captures the remainder. Enforcement leaves the gap in place and raises the price of crossing it, by adding the risk of disqualification and prosecution to the store's side of the trade.

4. Current detection and enforcement

4.1 Transaction analytics: ALERT

FNS's main detection tool for retailer trafficking is the Anti-Fraud Locator using EBT Retailer Transactions (ALERT). State EBT processors send FNS daily records of every SNAP transaction. GAO reported in 2018 that ALERT scanned about 250 million transactions per month. The system assigns each store a numeric score for the likelihood of trafficking. Stores above a threshold join a watch list, and analysts prioritize them using factors such as average transaction size relative to store type. Analysts also compare a suspect store with similar stores in the same ZIP code. CRS reported that over 80 percent of the retailer trafficking FNS detects is found mainly through EBT transaction analysis (Figure 6).

FNS charge letters and agency decisions describe the patterns that drive these cases:

• A large number of transactions in repeated or round dollar values, such as many sales ending in .00.
• Multiple transactions from one household account within a short window, a pattern unusual for a small store with limited stock.
• Transactions that are excessively large for the store's size and type.
• Multiple households making similar transactions within a short period.
• Accounts drained in one or two swipes, sometimes by out-of-state cards.

Each pattern is a proxy for "no real basket behind this amount." Round totals are rare when real prices are summed. Repeat swipes from one card suggest the store is splitting a large trafficking amount to avoid a size flag. Large totals at a store with a few shelves of stock suggest the store sells more food than it holds.

4.2 Undercover investigations and penalties

FNS investigators and USDA's Office of Inspector General conduct undercover buys, in which an investigator with a test card offers to sell benefits or to buy ineligible items. Under state law enforcement bureau agreements, which GAO counted in 28 states in 2018, state and local police also run their own undercover cases with SNAP cards.

Penalties are set by regulation. For retailers, 7 CFR 278.6 provides:

The regulation lets FNS rely on "evidence obtained through a transaction report under an electronic benefit transfer system." That clause is what lets ALERT data alone support a permanent disqualification.

For recipients, 7 CFR 273.16 sets disqualification periods for an intentional program violation: 12 months for a first violation, 24 months for a second, and permanent for a third. A court conviction for trafficking $500 or more brings permanent disqualification on the first occasion. A fraudulent statement about identity or residence to receive benefits in more than one place brings a 10-year bar. Transactions involving firearms, ammunition, or explosives bring permanent disqualification. Transactions involving controlled substances bring 24 months, then permanent.

4.3 Eligibility and retailer standards

On the eligibility side, states verify income and identity using federal and state data sources. The 2018 Farm Bill required a National Accuracy Clearinghouse (NAC) to stop the same person from receiving benefits in two states at once. FNS issued an interim final rule in October 2022 requiring all state agencies to join the NAC and to act on its match results, with full compliance due by 2027. Before the NAC, states relied on the slower Public Assistance Reporting Information System (PARIS) for interstate matching.

On the retailer side, FNS published a final rule in December 2016 to raise stocking standards. It required stores qualifying on inventory to carry at least seven varieties in each of four staple food categories, with perishable items in at least three categories and at least three units of each variety. The aim was partly integrity: a "store" with a few cans on a shelf and a busy EBT terminal is a classic trafficking front. Appropriations riders blocked enforcement of the variety and breadth provisions for years. USDA proposed updated standards in 2025, and its current guidance says retailers must comply starting in 2026.

4.4 Skimming response

The Consolidated Appropriations Act, 2023 (P.L. 117-328, Division HH, section 501) gave states temporary authority to replace stolen benefits with federal funds, limited to the lesser of the amount stolen or two months of benefits, and to two replacements per household per fiscal year. A later continuing resolution extended the window to cover thefts through December 20, 2024. Congress did not extend it further. According to USDA figures cited by the Center on Budget and Policy Priorities, states replaced more than $150 million in stolen benefits for over 315,000 households between January 2023 and September 2024. The underlying fix is the card itself. California became the first state to issue chip-and-tap EBT cards in 2025, and state officials told legislators that all clients had received new cards by spring 2025. Other states have started similar migrations (Figure 7).

4.5 Limits of the current approach

The current model has five structural limits.

First, it detects after the fact. ALERT reads completed transactions, and the store has already been paid. By the time a store is disqualified, it may have trafficked for months, and the owners can reopen under a new name.

Second, it sees only amounts. Without items, ALERT cannot tell a real $87.43 basket from a trafficked $87.43 swipe. Smart traffickers learn the flags and stop using round amounts.

Third, it targets stores and largely misses recipients. EBT data alone is generally not enough to disqualify a recipient, so states struggle to act on the cardholder side of ALERT cases.

Fourth, it does not scale with investigator capacity. GAO found that FNS reauthorized all stores on a five-year cycle regardless of risk, and that its trafficking estimate rested on assumptions it had not tested.

Fifth, the card was weak. Magnetic stripe cards made skimming cheap. The program bore part of the loss through replacement, and recipients bore the rest after the replacement authority ended. Figures A1 to A4 in Appendix A model this response as UML operations diagrams.

5. Design principles

Four principles shape the architecture in the next section.

6. A layered program and software architecture

The architecture has four transaction-path layers and one analytics layer that reads from all of them. Confirmed cases flow back into the analytics layer as labels (Figure 9).

The transaction-path layers act on each enrollment or sale. The analytics layer acts on aggregates over time, because most fraud signals are weak in a single event and strong in a pattern. Figures A5 to A7 in Appendix A model this architecture as UML software diagrams.

6.1 Eligibility layer

The eligibility layer decides who receives benefits and how much. Its job is to stop overpayments before the first payment, which is cheaper than recovering them later.

Automated income matching. At application and at recertification, the system should query payroll data (such as commercial employment verification services and state new-hire registries), state wage records, federal tax data where the law allows, and bank account verification. A discrepancy above a tolerance triggers a request for documents instead of a denial. The goal is to replace self-reported income with verified income where a source exists, and to save caseworker time for cases where no source exists, such as informal or gig work.

National duplicate-enrollment check. Every new application should check the NAC before the first issuance, and every active case should be rechecked on a schedule, such as monthly. A match pauses the second state's issuance and opens a resolution task with notice to the household. Many matches are benign, such as a family that moved and has not closed the old case. The software should treat a match as a question to resolve quickly, and it should close the old case when the household confirms the move.

The eligibility check runs at signup, at recertification, and on a schedule, and it settles every question before the first payment.

def check_eligibility(application):
    # Verified income replaces self-reported income where a source exists.
    sources = [payroll_data, new_hire_registry, state_wage_records,
               federal_tax_data,  # only where the law allows
               bank_account_verification]
    verified = [s.income_for(application.household) for s in sources if s.covers(application)]
    if not verified:
        assign_caseworker(application)  # informal or gig work has no source
    for income in verified:
        if abs(income - application.reported_income) > INCOME_TOLERANCE:
            return request_documents(application)  # a mismatch asks, never denies
    match = NAC.find_active_case(application.household)
    if match:
        pause_issuance(application)
        open_resolution_task(application, match, notify_household=True)
        # Most matches are moves; close the old case on confirmation.
        return "pending_resolution"
    return approve_first_payment(application)

def recheck_active_cases(active_cases):  # on a schedule, such as monthly
    for case in active_cases:
        if NAC.find_active_case(case.household, excluding=case):
            pause_issuance(case)
            open_resolution_task(case, notify_household=True)

Household composition checks. Cross-checks against other benefit programs and state records can flag a member listed in two households. These checks catch fraud and honest error alike, so the response should be a request for clarification.

6.2 Credential layer

The credential layer controls who can spend a benefit. Its main target is theft from recipients.

Chip and contactless cards. EMV chip cards defeat magnetic stripe skimming, because a cloned stripe or a captured one-time code cannot authorize a second purchase. Tap-to-pay reduces exposure to tampered card slots. California's rollout shows the main obstacle: retailers must upgrade terminals, and for a time most transactions still fell back to the stripe. The program should set a date after which stripe fallback is declined except at stores with an approved exception.

Phone wallets. Mobile wallet credentials add device binding and biometric unlock. The 2018 Farm Bill authorized mobile payment pilots for SNAP. A wallet also gives the program a direct channel to the recipient.

Recipient app controls. A recipient app should let the household lock the card between uses, block out-of-state and online transactions by default, and receive an alert for every swipe. Locks and geography blocks stop most cloned-card drains. Per-swipe alerts let a household report theft within minutes.

Countering load-day drains. Skimming crews strike when the monthly benefit lands, because that is when the balance is highest. Two controls help. The first is to vary the load time within the day or to spread loads across days by case number, so a crew cannot predict the exact moment. The second is a step-up check for large spending soon after a load: if more than a set share of the balance is spent within a short window, at a store far from the recipient's usual stores, the system asks for confirmation in the app before approving. The check must fail open for recipients without phones, or it will cut off the households least able to absorb a delay (Figure 10).

The credential check runs on every swipe and asks the household to confirm only a large spend soon after benefits load.

def authorize_swipe(card, txn, settings, now):
    send_swipe_alert(card.household, txn)  # households report theft within minutes
    if txn.entry_mode == "stripe" and now >= STRIPE_FALLBACK_DEADLINE:
        if not txn.store.has_approved_exception:
            return decline("STRIPE_FALLBACK_ENDED")
    if settings.card_locked:
        return decline("CARD_LOCKED")
    if txn.is_out_of_state and settings.block_out_of_state:  # on by default
        return decline("OUT_OF_STATE_BLOCKED")
    if txn.is_online and settings.block_online:  # on by default
        return decline("ONLINE_BLOCKED")
    if needs_step_up(card, txn, now):
        if card.household.has_app:
            if not confirm_in_app(card.household, txn):
                return decline("NOT_CONFIRMED")
        # No phone means fail open, never a cutoff.
    return approve(txn)

def needs_step_up(card, txn, now):
    soon_after_load = now - card.last_load_time <= STEP_UP_WINDOW
    spent = card.spent_since_last_load + txn.amount
    large_share = spent > STEP_UP_SHARE * card.balance_at_last_load
    far_away = distance(txn.store, card.usual_stores) > STEP_UP_DISTANCE
    return soon_after_load and large_share and far_away

6.3 Transaction layer

The transaction layer is where the program can close the core weakness: the payment record with no item list.

Mandatory item-level basket data. Each EBT sale should carry a line for each item: the barcode (UPC or PLU), quantity, unit price, and SNAP-eligible flag. FNS's 2016 feasibility study showed that item-level data can be captured from integrated electronic cash registers and matched to EBT transaction records at above 99 percent accuracy using card number, date, store, and amount. The new standard would carry the basket in the authorization message itself or in a linked message sent within seconds.

Real-time rules. With item data in the message, the processor can reject a sale that includes ineligible items before it completes. It can also reject or flag lines for products the store is not known to stock. The program would maintain a per-store product catalog, seeded from the store's own price list at authorization and from wholesale records over time. A convenience store that suddenly sells 30 pounds of beef in one basket, a product it has never bought from a supplier, would see the line flagged.

The processor validates the itemized basket inside the authorization and declines a bad one at the register with a reason code.

def validate_basket(txn, products, store_catalog):
    total = 0
    for line in txn.basket_lines:
        product = products.get(line.upc)  # UPC or PLU
        if product is None:
            return reject(txn, "UNKNOWN_BARCODE", line)
        if not product.snap_eligible:
            return reject(txn, "INELIGIBLE_ITEM", line)
        # Catalog seeded from price list, then supplier records.
        if line.upc not in store_catalog[txn.store]:
            return reject(txn, "NOT_STOCKED", line)
        total += line.quantity * line.unit_price
    if total != txn.amount:
        return reject(txn, "TOTAL_MISMATCH")
    return accept(txn)

def reject(txn, reason_code, line=None):
    # Repeated unstocked lines are a signal for the monthly score.
    report_to_analytics(txn.store, reason_code, line)
    return Decline(txn, reason_code)

Small-store capacity. Many small stores do not run integrated scanning registers. The standard needs a low-cost path, such as a subsidized, certified tablet point-of-sale app, or the rollout will drive stores out of the program.

6.4 Merchant payout layer

Card networks and payment processors face the same problem SNAP faces: some merchants are fronts for fraud. Processors such as Stripe and PayPal manage that risk at payout time. The SNAP payout layer should adopt the same tools.

Probation for new stores. A newly authorized store, or a store under new ownership, starts in a probation tier. It receives payouts on a longer delay, faces a monthly volume cap set from its stated size and stock, and gets an early field visit. Trafficking stores often show high volume soon after authorization, so probation targets the riskiest period.

Risk-tiered delays and caps. Every store sits in a tier set by its analytics score. Low-risk stores get the standard settlement time. Higher tiers get longer settlement delays and volume caps. A delay of a week or two does not stop an honest store from operating. It does let the program withhold funds when a case opens, which makes recovery possible (Figure 11).

Holds pending review. When a store's score crosses a high threshold, the program can hold part of its payouts until review. A hold of this kind must have a time limit and a clear path to release, or it becomes a penalty without process.

Recovery reserve. For high-tier stores, a rolling reserve (a share of payouts held for a period) gives the program a fund to recover from after a disqualification.

The payout layer pays clean stores on the standard schedule and slows, caps, or holds money as a store's tier climbs.

def payout_treatment(store):
    if store.tier == "disqualified":
        return Action(pay=False, recover_from=store.reserve)
    if store.tier == "probation":
        return Action(delay=PROBATION_DELAY, field_visit="early",
                      monthly_cap=cap_from(store.stated_size, store.stated_stock))
    if store.tier == "normal":
        return Action(delay=STANDARD_SETTLEMENT)
    if store.tier == "elevated":  # a delay of a week or two
        return Action(delay=ELEVATED_DELAY, monthly_cap=ELEVATED_CAP)
    if store.tier == "high_risk":
        return Action(delay=HIGH_RISK_DELAY, monthly_cap=HIGH_RISK_CAP,
                      hold_share=HOLD_SHARE,  # hold until review
                      hold_expires=HOLD_TIME_LIMIT,  # needs a release path
                      reserve_share=RESERVE_SHARE)

def next_tier(store, score, today):
    if store.case and store.case.decision == "disqualify":  # a person decides
        return "disqualified"
    if today - store.authorized_or_new_owner_on < PROBATION_PERIOD:
        return "probation"  # trafficking stores spike soon after authorization
    if score >= HIGH_RISK_THRESHOLD:
        return "high_risk"
    return "elevated" if score >= ELEVATED_THRESHOLD else "normal"

6.5 Analytics layer

The analytics layer reads from all four transaction-path layers and from third-party sources. It produces store, card, and case scores, and it feeds the investigation queue. Two methods matter most beyond price anomaly detection, which Section 7 covers.

Inventory reconciliation. Compare EBT sales per product category against the store's wholesale purchases of that category. A store cannot sell 400 cartons of eggs in a month if its suppliers delivered 50. Purchase data can come from supplier invoices that the store submits and from data feeds provided by large distributors under agreement. Without item data, reconciliation works at the level of total food purchases against total EBT redemptions. With item data, it works per product. The limit is that a store can buy stock for cash at a wholesale club, which leaves no supplier record in a distributor feed. The program should make purchase records a condition of authorization: a store must keep invoices or receipts for food it sells and submit them on request. Random audits of a sample of stores each year, plus targeted audits of high scorers, keep the requirement credible. A store that cannot show purchases to support its sales has a problem regardless of what its baskets say (Figure 12).

Reconciliation compares what a store sold through EBT with what its suppliers delivered, evidence the store does not write.

def reconcile_inventory(store, month):
    # Wholesale-club cash buys leave no distributor feed record.
    if not store.purchase_records_submitted(month):
        request_purchase_records(store, month)  # a condition of authorization
    invoices = distributor_feeds.invoices(store, month) + store.submitted_invoices(month)
    if not store.has_item_data(month):
        sold = sum(t.amount for t in store.ebt_transactions(month))
        bought = sum(i.food_total for i in invoices)
        return [Flag(store, month, "ALL_FOOD")] if sold - bought > TOTAL_TOLERANCE else []
    delivered = units_by_upc(line for i in invoices for line in i.invoice_lines)
    sold = units_by_upc(line for t in store.ebt_transactions(month) for line in t.basket_lines)
    flags = []
    for upc, units_sold in sold.items():
        gap = units_sold - delivered.get(upc, 0)
        if gap > UNIT_TOLERANCE:
            flags.append(Flag(store, month, upc, gap))
    return flags

# Report example: 400 cartons of eggs sold, 50 delivered.

Network and graph analysis. Build a graph with cards and stores as nodes and transactions as edges. Trafficking rings leave clusters: groups of cards that all visit the same few suspicious stores, often traveling past closer and larger stores to do so. A single-transaction rule sees a normal-looking $60 sale. The graph sees 200 cards that spend nearly all their benefits at three small stores owned by related parties. Community detection, shared-owner links from authorization records, and shared bank accounts on payout records together reveal rings that no store-level score would. The same graph helps on the recipient side: a card that appears in many confirmed trafficking cases is a candidate for a state investigation with evidence beyond a single transaction pattern (Figure 13).

The ring finder builds a card to store graph and flags groups of cards whose spending piles into the same few stores.

def find_rings(transactions):
    graph = Graph()
    for txn in transactions:
        graph.add_edge(txn.card, txn.store, weight=txn.amount)
    rings = []
    for cluster in community_detection(graph):
        stores = cluster.stores_by_spend()[:FEW_STORES]
        cards = [c for c in cluster.cards
                 if graph.spend_share(c, stores) >= CONCENTRATION_SHARE]
        if len(cards) < MIN_RING_CARDS:
            continue
        # Rings travel past closer and larger stores.
        skipped = count_cards_passing_closer_larger_stores(cards, stores)
        linked = shared_owners(stores) or shared_payout_accounts(stores)
        rings.append(Ring(stores, cards, skipped, linked))
    return rings

def recipient_leads(graph, confirmed_cases):
    # Evidence beyond one transaction pattern, for state investigators.
    return [c for c in graph.cards
            if confirmed_cases.count_with(c) >= RECIPIENT_CASE_COUNT]

# Report example: 200 cards, nearly all benefits at three stores.

Feedback. Every closed case, whether confirmed or cleared, becomes a labeled example. The scoring models retrain on these labels. Cleared cases matter as much as confirmed ones, because they teach the models which patterns are benign, such as round prices at a store that prices in whole dollars.

7. Price anomaly detection without human basket review

Item-level data creates a new problem: volume. Retailers process millions of SNAP transactions per day. No program can afford a person to look at baskets. The design question is how to turn that volume into a short list of stores worth a human's time, so that operating cost grows with investigator headcount while transaction volume affects only computing cost. Figure A8 in Appendix A shows the monthly scoring run as a sequence.

7.1 Reference prices

The system builds a reference price for each barcode in each region from all stores' basket data. For a given barcode and region in a given month, the reference is a robust central value of observed prices, such as the median, with a spread measure such as the interquartile range. Separate references for store classes (supermarket, convenience store, small grocery) reflect the fact that convenience stores charge more for the same item. Products with few observations borrow strength from related products in the same category and from neighboring regions (Figure 14).

7.2 Score stores, not baskets

One odd price means little. A store may run a promotion, price a slow item high, or key a price wrong. Independent stores set their own prices, and small stores pay more at wholesale than chains. Scoring each basket would flood the system with noise.

The unit of scoring is the store-month. For each store and month, the system computes:

• The excess price share: the sum over lines of (price paid minus the upper bound of the reference range, when positive), divided by total EBT sales.
• The share of lines priced above the reference range.
• Basket plausibility: how far the mix of items departs from what EBT shoppers buy at similar stores (for example, baskets made of a few high-priced items that recur in round-total combinations).
• Supply consistency: EBT sales per category divided by known purchases per category, from the inventory reconciliation.

These features feed a model trained on labels from past cases. Before scoring, the system applies statistical shrinkage so that a store with few transactions does not get an extreme score from a handful of odd lines.

The monthly run builds a reference price per barcode and region, then scores each store-month from all of its lines together.

def reference_prices(lines, month):
    refs = {}
    for (upc, region, store_class), prices in group(lines, by=(upc, region, store_class)):
        if len(prices) < MIN_OBSERVATIONS:  # borrow from category and neighbors
            prices += related_prices(category_of(upc), neighboring_regions(region))
        mid, spread = median(prices), interquartile_range(prices)
        refs[(upc, region, store_class)] = Reference(mid, upper=mid + REF_RANGE_WIDTH * spread)
    return refs

def score_store_month(store, month, refs, reconciliation, model):
    lines = store.ebt_basket_lines(month)
    upper = {l: refs[(l.upc, store.region, store.store_class)].upper for l in lines}
    sales = sum(l.quantity * l.unit_price for l in lines)
    excess = sum(max(0, l.unit_price - upper[l]) * l.quantity for l in lines)
    features = {
        "excess_price_share": excess / sales,
        "share_lines_above": count(l for l in lines if l.unit_price > upper[l]) / len(lines),
        "basket_plausibility": mix_distance(store.baskets(month), peers(store.store_class)),
        "supply_consistency": reconciliation.sales_vs_purchases_by_category(store, month),
    }
    raw = model.predict(features)  # trained on labels from past cases
    # Shrinkage: one odd basket cannot swing a small store.
    score = shrink(raw, toward=peer_average, n=len(lines), strength=SHRINKAGE_STRENGTH)
    return StoreMonthScore(store, month, score, features)

7.3 Rank by expected loss

The output of scoring is a ranked list of stores by expected loss:

expected loss = probability of fraud x estimated excess dollars per year

The probability comes from the model. The excess dollars come from the excess price share and the supply gap, multiplied by the store's EBT volume. The program then acts on the list through a funnel (Figure 15).

The automated tier handles most stores that score above normal. A warning letter tells a store its prices sit well above its peers and invites an explanation. A payout delay or volume cap limits exposure without accusing anyone. These actions are reversible and need no investigator time. They also deter: a store that knows the system watches its prices has less reason to inflate them.

7.4 Cost model

Human cost in this design scales with the number of investigators. Transaction volume drives only computing cost, which is small. That property follows from three rules.

First, set the investigator budget first. The program decides how many investigator hours it can fund in a period. That number fixes N, the count of cases the queue can absorb.

Second, review only what the budget covers. The queue takes the top N stores by expected loss. Stores below the cutoff stay in the automated tier, where their scores keep updating. A store that keeps rising will eventually enter the queue.

Third, review a case only when the expected benefit exceeds the review cost. Even within budget, a case with low expected loss should not consume a review. The test is:

expected loss x share prevented or recovered by action > cost of one review

The share prevented or recovered reflects that a review does not recover every dollar. It may end future losses through disqualification, recover part of past losses, and deter others.

Excess dollars per year equal monthly sales times excess share times 12. For Store A: $60,000 x 0.30 x 12 = $216,000, and $216,000 x 0.8 = $172,800.

Store E fails the threshold: a $6,000 review to protect $960 is a loss. It receives a warning letter and stays under watch. Stores A through D all pass. If the budget covers two reviews this cycle, A and B go to investigators. C and D receive payout delays and volume caps, and they remain at the top of next month's list. Note that Store C has the largest sales but a low excess share and a low probability. Ranking by sales volume alone, a common heuristic, would have sent the wrong store first (Figure 16).

The planner ranks stores by expected loss, sends the budget's top N to people, and puts the rest on automatic actions.

def plan_reviews(scores, investigator_hours):
    n = investigator_hours // HOURS_PER_REVIEW  # budget fixes N before the run
    for s in scores:
        # Excess share comes from excess prices and supply gap.
        s.expected_loss = s.probability_of_fraud * s.monthly_ebt_sales * s.excess_share * 12
    ranked = sorted(scores, key=expected_loss, descending=True)
    worth = [s for s in ranked if s.expected_loss * SHARE_PREVENTED > REVIEW_COST]
    for s in worth[n:]:
        apply(s.store, [Action("payout_delay"), Action("volume_cap")])  # back on next list
    for s in ranked:
        if s not in worth and s.score > NORMAL_SCORE:
            apply(s.store, [Action("warning_letter")])
    return [Case(s.store, s.expected_loss) for s in worth[:n]]

def close_case(case):
    # Cleared cases teach the model which patterns are benign.
    training_labels.add(case.store_month_score, label=case.outcome)

# Worked example: REVIEW_COST 6,000, SHARE_PREVENTED 0.5, N = 2
# store: expected_loss = p x sales x share x 12; x 0.5 vs 6,000; action
# A: 0.8 x 60,000 x 0.30 x 12 = 172,800; 86,400 > 6,000; review, rank 1
# B: 0.6 x 25,000 x 0.40 x 12 = 72,000; 36,000 > 6,000; review, rank 2
# C: 0.3 x 120,000 x 0.05 x 12 = 21,600; 10,800 > 6,000; delay and cap, past N
# D: 0.4 x 15,000 x 0.20 x 12 = 14,400; 7,200 > 6,000; delay and cap, past N
# E: 0.2 x 8,000 x 0.10 x 12 = 1,920; 960 < 6,000; warning letter

7.5 Recipient-side reporting

Recipients can supply a free signal against overcharging. The recipient app should show an itemized receipt for each EBT purchase, with a "price looks wrong" button on each line. Reports feed the store's score as one more feature, weighted by the reporter's history so that one angry customer cannot sink a store. Reports also help the household directly, by showing what each item cost.

This channel does nothing against trafficking. The trafficking shopper colludes with the store and will never press the button. Recipient reporting is a tool for the predatory form of overcharging, where the store cheats its customer. That distinction should shape how the program weights these reports: they are strong evidence of predatory pricing and no evidence about trafficking.

8. Trade-offs and harms

Every control in this report imposes costs on honest participants. The table lists the main ones (Figure 17).

Privacy. Item-level data is the most sensitive control. Once the state holds a record of every item every SNAP household buys, pressure will follow to use it for diet policing, immigration enforcement, or commercial sale. The data design should limit use by statute to program integrity and approved research. It should keep raw baskets for a short period, such as 13 months, then retain only store-level aggregates. It should separate identity from basket data so that analysts work with tokenized card numbers, and only a case opened by an investigator can resolve a token to a household.

Access. Small stores are often the only food retailers in poor urban and rural areas. They also carry most trafficking. A rule that removes trafficking stores also removes some honest ones, and each loss can strand households far from a supermarket. Mitigation requires subsidy for equipment and an explicit access test before disqualifying the last authorized store in an area, with a path to a civil money penalty instead.

Due process. ALERT cases already rest mostly on transaction data, and stores have ten days to respond to a charge letter. Adding automated holds and caps raises the stakes of a wrong score. The program should publish appeal timelines, track how often automated actions reverse on appeal, and pay interest on wrongful holds.

Human review before cutoff. No household should lose benefits because of an automated score. Scores can open a case. A person decides it, with notice and a hearing, as 7 CFR 273.16 already requires for intentional program violations.

9. The policy alternative

Trafficking exists because SNAP benefits are restricted to food at authorized stores while cash is unrestricted. If the program paid benefits as unrestricted cash, trafficking would end by definition, because there would be no discount between a benefit dollar and a cash dollar for anyone to capture. The retailer authorization system, ALERT, undercover buys, and most of the merchant-side architecture in this report would become unnecessary.

That is a policy choice, and it carries its own debates. Supporters point to lower administrative cost, more dignity and flexibility for households, and economic research finding that, for most households, SNAP affects food spending much as an equal amount of cash would. Opponents argue that restricting benefits to food is the program's purpose and the basis of its political support, that cash could shift spending away from food for some households, and that the change would remove an effect that supports grocery retailers. A middle path, such as a partial cash-out, would shrink the trafficking discount without ending it.

This report takes no position on that question. The point for designers is that the software architecture addresses a problem the policy creates. If policy changes, the integrity problem changes with it: eligibility fraud and payment theft remain, and trafficking disappears.

10. Implementation roadmap

The architecture is too large to deploy at once, and some parts depend on others. A three-phase rollout orders the work by cost, dependency, and the size of the loss each step addresses (Figure 18).

Phase 1: credentials and payout risk. Complete the national move to chip and contactless EBT cards. Launch a recipient app with card lock, geography and online blocks, and per-swipe alerts. Introduce merchant risk tiers using the existing ALERT score: probation for new stores, settlement delays and caps for high tiers. These steps need no new data standard and attack skimming and hit-and-run trafficking directly.

Phase 2: item-level data standard. Define and publish an item-level basket standard for EBT messages. Certify point-of-sale vendors against it. Fund a low-cost certified option for small stores. Turn on real-time rejection of ineligible items. Begin building reference prices and per-store product catalogs. Set privacy rules in regulation before data collection starts.

Phase 3: analytics and the investigation queue. Add inventory reconciliation with distributor feeds and purchase-record requirements. Build the card-store graph. Deploy store-month price scoring and expected-loss ranking. Size the investigation queue to the budget and run the feedback loop from closed cases.

Each phase should ship with measurement. Phase 1 should report skimming claims per thousand cards before and after the switch. Phase 2 should report the share of EBT volume carrying item data and the count of small stores that left the program. Phase 3 should report the confirmation rate of reviewed cases, reversal rates on appeal, and estimated trafficking from the next FNS study. Without measurement, the program cannot tell whether controls pay for themselves.

11. Conclusion

SNAP fraud is smaller and more specific than public debate suggests. The headline error rate near 11 percent measures payment accuracy, and it counts mistakes in both directions. The best estimate of trafficking, the program's signature fraud, is about 1.6 to 2.0 percent of benefits, concentrated in small stores. Skimming is a separate problem whose victims are recipients.

Trafficking persists because the EBT record carries amounts without items and because both parties to the lie gain from it. Controls that rely on data the shopper or the store enters cannot fully solve it. The architecture in this report responds in layers: verify eligibility from outside sources before the first payment, harden the card, carry items in the transaction, manage payouts the way processors manage risky merchants, and reconcile what stores sell against what their suppliers delivered. Price anomaly detection runs at the store-month level, ranks stores by expected loss, and sends only what the budget covers to people, so that oversight cost tracks investigator headcount.

Each control harms some honest participants, through lost privacy, lost store access, delayed payouts, or wrongful flags. Those costs belong in the same calculation as the fraud the controls stop. A program that counts them, publishes its error and reversal rates, and keeps a person between any score and a family's food will protect both the budget and the trust that the program depends on.

Appendix A. UML models

These models turn the design into operations and software specifications. The operations models come first.

A.1 Operations

The figures so far follow the money and the fraud. The next four show the operations side in UML, the notation software teams use to specify systems. The first is a use case diagram. It names each party that touches the integrity program and what each one does there, from the household and the store to the federal retailer analyst at FNS (renamed FNA in 2026).

Two points stand out. Recipients and retailers run controls themselves: a household locks its own card, and a store submits its own purchase records. And every sanction rests with a person, as section 8 requires.

An activity diagram shows how one case moves between parties. It starts in software. The analytics system scores every store each month, and only stores in the top N reach a federal analyst; the rest get an automated warning letter, payout delay, or volume cap. Once a case opens, three lines of evidence run at the same time: supplier records, an undercover buy, and the store's own purchase records.

The case file joins them before anyone decides. A sanction can go to independent review, and every outcome, closed, upheld, or reversed, becomes a label for next month's scores.

The same process, seen from the case record, is a state machine. Each box is a status the case can hold, and each arrow names the event, guard, and action that move it. The design rules from sections 6 to 8 become guards here.

A case opens only when its expected loss beats the review cost within budget. A payout hold starts when the case enters the queue and lifts if the evidence shows no violation. Every sanction can go to appeal before the case becomes final.

The last diagram turns to the recipient side, where the loss is theft from families. Section 6.2 proposes a recipient app with per-swipe alerts and a card lock, and section 4.4 describes how benefit replacement worked. The activity diagram joins the two.

A family can stop a drain within minutes of the first unknown swipe. The response then splits: the state reissues the card and decides whether the stolen benefits come back. Under the facts in section 4.4, federal replacement covered thefts only through December 20, 2024.

A.2 Software

The component diagram recasts the layered design as software. Each box is a deployable component. A ball marks an interface the component offers, and a cup marks one it needs. The real-time path answers inside a sale: the gateway calls the eligibility, credential, and basket checks, then settles through the payout risk service.

Batch analytics reads the stream of sales once a month. Three evidence services feed one scoring engine. External sources sit outside the packages, because the program reads them and cannot change them.

The sequence diagram follows one EBT purchase once the basket travels with the authorization. The processor checks every line against SNAP eligibility and the store catalog before it touches the balance. A valid basket then passes a risk check. Only a large spend soon after the monthly load triggers a step-up confirmation in the recipient app, and a recipient without a phone fails open.

An invalid basket is declined at the register. The processor still reports the line, because a store that keeps keying items it never stocks is a signal for the monthly score.

The class diagram names the records the software keeps. Two structures mirror each other: a transaction owns its basket lines, and a supplier invoice owns its invoice lines. Both kinds of line point at the same product barcode. That shared key makes reconciliation possible, because the store writes one side and its suppliers write the other.

Scores attach to a retailer and a month, never to a single basket. A score can open a case or trigger an automatic action, and every action carries an expiry and an appeal.

The second sequence diagram shows the batch side. A scheduler starts the run once a month. For each store, the scoring engine gathers three kinds of evidence: excess prices against the regional reference, sales against supplier purchases, and the store's place in the card-store graph. It scores the store-month with shrinkage, so a small store with a few odd lines does not jump the queue.

The ranker sorts stores by expected loss. The investigator budget fixes N before the run starts, so transaction volume never changes how many cases people see.

References

1. Center on Budget and Policy Priorities. "Congress Must Extend Protections for SNAP Households Who Are Victims of Benefit Theft." Blog post, 2024. cbpp.org: SNAP benefit theft
2. Code of Federal Regulations. 7 CFR 273.16, Disqualification for intentional Program violation. Accessed via Legal Information Institute, Cornell Law School. law.cornell.edu: 7 CFR 273.16
3. Code of Federal Regulations. 7 CFR 278.6, Disqualification of retail food stores and wholesale food concerns and imposition of civil money penalties in lieu of disqualifications. Accessed via Legal Information Institute, Cornell Law School. law.cornell.edu: 7 CFR 278.6
4. Congressional Research Service. Supplemental Nutrition Assistance Program: Errors and Fraud (IF10860). Updated April 7, 2025. everycrsreport.com: IF10860
5. Congressional Research Service. Errors and Fraud in the Supplemental Nutrition Assistance Program (SNAP) (R45147). Updated September 28, 2018. everycrsreport.com: R45147
6. Congressional Research Service. Supplemental Nutrition Assistance Program (SNAP): Benefit Theft Through Electronic Benefit Card Skimming (IN12419). congress.gov: IN12419
7. Consolidated Appropriations Act, 2023. Public Law 117-328, Division HH, section 501.
8. Federal Register. "Enhancing Retailer Standards in the Supplemental Nutrition Assistance Program (SNAP)." Final rule, 81 FR 90675, December 15, 2016. federalregister.gov: 81 FR 90675
9. Federal Register. "Supplemental Nutrition Assistance Program: Requirement for Interstate Data Matching To Prevent Duplicate Issuances." Interim final rule, October 3, 2022. federalregister.gov: interstate data matching
10. US Department of Agriculture, Economic Research Service. "Supplemental Nutrition Assistance Program (SNAP) average monthly participation and inflation-adjusted annual program spending, fiscal years 2000-24." Chart. ers.usda.gov: participation and spending chart
11. US Department of Agriculture, Food and Nutrition Service. Feasibility Study of Capturing Supplemental Nutrition Assistance Program (SNAP) Purchases at the Point of Sale. Prepared by IMPAQ International. November 2016.
12. US Department of Agriculture, Food and Nutrition Service. Fiscal Year 2024 SNAP Quality Control Payment Error Rates. 2025. fns.usda.gov: FY 2024 QC report
13. US Department of Agriculture, Food and Nutrition Service. "USDA Releases Annual SNAP Payment Error Rates for FY 2024." Press release, June 27, 2025.
14. US Department of Agriculture. "USDA Announces FY 2025 State Payment Error Rates in SNAP." Press release, June 24, 2026. usda.gov: FY 2025 state error rates
15. US Department of Agriculture. "USDA Announces Actions to Better Serve States, Nutrition Program Recipients, and the American Taxpayer." Press release on the Food and Nutrition Administration, April 30, 2026. usda.gov: FNS restructuring
16. US Government Accountability Office. Supplemental Nutrition Assistance Program: Actions Needed to Better Measure and Address Retailer Trafficking (GAO-19-167). December 2018. gao.gov: GAO-19-167
17. Wilson, Hoke (Manhattan Strategy Group). The Extent of Trafficking in the Supplemental Nutrition Assistance Program: 2015-2017. USDA Food and Nutrition Service, Office of Policy Support, September 2021. fns.usda.gov: trafficking 2015-2017
18. Contra Costa County Employment and Human Services Department. "New EBT Card Security & Technology Upgrade." February 2025. ehsd.org: EBT card upgrade