WAG 22-03-02: Replacing SNAP Benefits Due to EBT Electronic Theft

PM 22-03-02

Card Skimming

Card skimming occurs when devices illegally installed on ATMs or point-of-sale (POS) terminals capture card data or record SNAP households' PINs. The data captured by skimming or other means can be used to create fake EBT cards (card cloning) and then used to steal from a households' account.


Other similar fraudulent methods of obtaining EBT card data may include, but are not limited to, scamming through fraudulent phone calls or text messaging. 

Report of Electronic Theft

  • A SNAP customer who has their Illinois Link card in their possession discovers an unauthorized transaction has occurred to steal benefits from their Illinois Link account may report the theft by completing Report of Electronic Theft of Illinois Link Benefits (Form IL444-4986):
    • By phone 1-800-843-6154 (Monday through Friday 8:30 am to 5:00 pm CST); or
    • Online @ www.dhs.state.il.us; or
    • Submitting by mail or in-person at the local FCRC.
    • Note: An electronic or telephonic signature is accepted when filed online or by phone.
  • The following sections must be completed on Form IL444-4986:

    • Customer Name
    • Case identifying information
    • Date and amount of each unauthorized transaction
    • Validation customer had Link card in their possession at all times
    • Signature of attestation
  • The following information is optional and if provided is used for central office internal purposes only. The customer is not required to provide this information:

    • Type of theft (skim vs. scammed)
    • Police report information
    • Details related to any scam that may have occurred
    • Details related to any known perpetrator
  • The theft claim must be filed within the required timeframe.
    • Retroactive claim is filed within 12 months of 07/02/2023. Retroactive claims are thefts that occurred between 10/01/2022 and 7/02/2023.
    • Current claim filed 07/03/2023 and after is reported within 30 calendar days of discovery of the unauthorized transaction. The date a household reports their EBT Link card as stolen and requests replacement is considered the "Date of Discovery".

Electronic Theft Claim Replacement Process

  1. The FCRC worker accepts the customer's attestation of EBT benefit theft as verification that the theft occurred and processes the current and/or retroactive claim no later than 10 calendar days after a completed and signed IL444-4986 is received.
  2. Either through a task, or over a telephonic phone call with a customer, the FCRC worker validates the theft claim by viewing the household's transaction history in ebtEDGE to ensure the unauthorized transaction(s) occurred, the actual benefit amount and that the household has replaced their EBT Link card.
  3. The FCRC worker processes the claim in the IES EBT Theft Claim Module by entering the case number and theft claim information on the screens related to the theft. EBT theft claims received outside of a telephonic phone call will be uploaded to tasks titled "EBT Theft Claims". Tasks are monitored daily to ensure staff are meeting timeliness.
  4. The FCRC worker should review their entries on the screens to ensure accuracy. IES does not know EBT transaction data and must have accurate information to process the claim and determine if the household is eligible for a replacement. 
    1. The date the household reports their EBT Link card as stolen and requests a new card is the "Date of Discovery".  Inform customers who have not replaced their LINK card, that the card must be replaced.
    2. The Date of Claim is the date the claim is received in the local office with a signature. For a mail-in, the Date of Claim is the date stamped into the FCRC.
  5. IES determines if there are any outstanding tasks or if any claims have been approved. If not, the FCRC worker processes as a new claim and enters the date of the first theft. Each unauthorized transactions is entered separately and not combined. IES determines when the last time benefits were received prior to the date of first theft. The FCRC worker certifies the claim
  6. IES displays the results and notice correspondence. The approval of the claim creates the replacement issuance. The validation of a claim and the creation of any eligible issuance is done in the same process. Notice of Decision on Replacement of EBT Benefits Due to Theft (Form 444-0370) is systematically generated to the customer.

Denial or Approval of Benefits

  • IES will deny theft claim benefits if the following has occurred:
    • A claim in which evidence indicates the theft incident occurred outside of the allowable timeline 10/01/2022 through 09/30/2024.
    • A claim is submitted by a SNAP household who has received replacement benefits for two approved EBT theft claims in a federal fiscal year from 10/01/2022 through 09/30/2024.
    • A claim is filed 07/03/2023 and after, and is received outside the 30-day timeframe from date of discovery.
    • A retroactive claim is received outside the 12-month timeframe of 07/02/2023.
  • If approved for benefits IES determines the appropriate replacement amount. If eligible for replacement benefits, the total replacement amount cannot exceed the amount of the stolen benefits or the amount equal to two months of the household's SNAP benefits, whichever is less. The replacement amount is the lesser of the:
    • actual amount of stolen benefits; or
    • the amount equal to 2 months of the customer's SNAP benefit allotment directly before the theft occurred.
  • An issuance is loaded into the EBT account on the business day following authorization in the eligibility system. Once loaded, the approved benefit is set to become available the following calendar day.

IES System Generated Form IL444-0370

Systematically generates, Notice of Decision on Replacement of EBT Benefits Due to Theft (Form IL444-0370), with the approval or denial reason, whichever is applicable. The following approval or denial reason will appear on the notice based on the reason the household is eligible or ineligible for replacement.

Notice Description Notice Reasons
Approved for full amount. This claim has been approved for the full amount of $__________.  PM 22-02-00
Claim approved, but amount replaced is less than total theft amount (capped at the two times monthly benefit amount).

This claim has been approved for a replacement amount that is less than the claim amount.

Reason for this action: The claim amount exceeds the maximum replacement amount. PM 22-03-00

Retroactive - Untimely filed claim.

This claim has been denied.

Reason for this action: This claim was filed outside of the allowable 12-month timeframe. PM 22-03-00

Current - Untimely filed claim.

This claim has been denied.

Reason for this action: This claim was filed outside of the 30-day time-frame from the date of discovery. PM 22-03-00

Household received the maximum replacement claims for the year.

This claim has been denied

Reason for this action: You have already received the maximum two claims replaced in the current claim year. PM 22-03-00

Household already received maximum replacement amount for this claim period already issued two times monthly benefits amount for this incident period).

This claim has been denied.

Reason for this action: The maximum replacement amount has already been received for this claim period. PM 22-03-00

Outside replacement period.

(prior to 10/01/22 or after 9/30/2024).

This claim has been denied.

Reason for this action: This theft occurred outside the eligible replacement period, before 10/01/2022 or after 9/30/2024.  PM 22-03-00

new manual textCash benefits are not eligible for replacement at this time.

This claim has been denied. 

Reason for this action: Benefits received under these programs cannot be replaced. PM 22-02-00.

new manual textFCRC Manual Completion of Form IL444-5355

  1. IES does not generate, Notice of Denial on Replacement of EBT Benefits Due to Theft (Form IL444-5355). The FCRC must manually complete and send Form IL444-5355 to deny a theft claim for the reasons listed below.
  2. Prior to denying a claim, workers should make two attempts to contact the customer by phone to confirm that the questions were understood and the customer did not make a mistake when completing the form.
    1. If contact is successful and it is determined that the customer has a valid claim, but did not complete it accurately, process the claim.
    2. If contact is unsuccessful, deny the claim and send IL444-5355 with the denial reason: Your claim is invalid and cannot be processed (PM 22-03-02)
  3. Document in Case Comments all actions taken.
Notice Description Notice Reason

Customer is requesting replacement of benefits received under the Pandemic Electronic Benefit Transfer (P-EBT) Program and/or

Victims of Trafficking, Torture, or other Serious Crimes (VTTC) programs.

Benefits received under these programs cannot be replaced.

 PM 22-03-02

Customer did not complete all the required fields on the Report of Electronic Theft of Illinois Link Benefits (Form IL444-4986) and/or include a signature. Your claim is invalid and cannot be processed. PM 22-03-02
Customer was not in possession of their Link card at the time the theft transactions occurred. You were not in possession of your Link card at the time the theft transactions occurred. PM 22-03-02
Customer's loss of benefits is not due to an electronic theft. You were not a victim of electronic theft. PM 22-03-02


new manual textCustomers have the right to the appeals process. A replacement is not made while the denial is pending appeal. See PM 01-04-04.