US Disbursement Card Systems

Four distinct roles, often confused — the payer (agency / employer / insurer) contracts a program manager, who rides on an issuer-processor and a sponsor bank's BIN, settling over a network or instant rail:

• Sponsor / issuing bank — holds the BIN, regulatory liability, and the deposits/float (Comerica, US Bank, Fifth Third, BNY; Sutton/Pathward-tier for fintech programs).
• Program manager — runs the card program end-to-end for the client (Fiserv/Money Network, Conduent, Onbe, US Bank ReliaCard/Focus).
• Issuer-processor — the transaction/ledger/tokenization layer (Marqeta, Galileo [SoFi-owned], i2c, Lithic, Highnote, FIS).
• Push-to-card / money-movement rail — Visa Direct, Mastercard Send/Move; API aggregators on top (TabaPay, Astra, Ingo, Cross River, Increase).

Incumbents are consolidating the program-manager tier while a modern issuer-processor tier and rail-aggregators grow underneath.

EBT/SNAP skimming — the marquee crisis

• EBT cards are magstripe-only — trivially skimmable at POS/ATM overlays. GAO counts ≥$320M stolen Oct 2022–Dec 2024.
• The reimbursement cliff: federal replacement of stolen SNAP benefits expired Dec 20, 2024 (the December CR didn't renew it). Benefits skimmed since are not federally replaced — losses now fall on low-income victims and statehouses. States had approved ~450k claims / ~$211.8M before the cutoff.
• The chip fix works: California was first to issue EMV chip-and-tap EBT (~4M cards by Apr 2025, via FIS; ~$76M state+federal cost) — reported theft down 83%. Followers: Oklahoma, Alabama, Maryland, Massachusetts, New York (planning). Expect a multi-year, state-by-state migration — a processor revenue event favoring FIS.

Unemployment insurance — the pandemic hangover

• Pandemic UI saw massive identity/synthetic fraud (est. tens of billions); California EDD was the epicenter.
• The controls backfired: BofA's crude fraud filter auto-froze legitimate cardholders en masse → $225M in CFPB+OCC penalties and its exit from the space. False-positive freezes on benefit cards are a regulatory-liability event, not just a CX problem.
• States rebuilt identity verification at the application layer (IDV vendors, device/behavioral signals) rather than only at the card layer.

Instant-payout & account fraud

• Push-to-card and RTP/FedNow are instant and irrevocable — no post-hoc clawback window, so fraud decisioning must move pre-authorization on the payout instruction.
• Account-takeover SAR filings ran ~14–17k/month in 2024–25, roughly 3× five years prior; mail theft of physical cards rides the broader mail-theft/check-fraud surge.
• Emerging controls: chip/tap EBT, cardholder lock/unlock, faster reissue, velocity/geolocation limits on magstripe cards, real-time risk scoring on push-to-card instructions.

• Prepaid Accounts Rule (CFPB, effective Apr 2019) extends Reg E — error resolution, limited liability, standardized disclosures — to prepaid accounts, payroll cards, certain government benefit cards, and wallets. The consumer-protection floor for most disbursement cards.
• EBT is statutorily carved out of Reg E. No unauthorized-transaction or error-resolution rights. Combined with the Dec 2024 reimbursement cliff, EBT recipients are the least-protected disbursement population in the US — the sharpest consumer-protection gap in the space.
• State patchwork forming: as federal reimbursement lapsed, states are legislating their own replacement funds and mandating chip cards.
• CFPB retrenchment (2025–26) is material: the July 2025 reconciliation bill roughly halved the CFPB's funding cap (12% → 6.5% of the Fed reference budget); an ~88% workforce reduction was pursued and most pending enforcement dismissed. The primary federal supervisor of prepaid is effectively dormant. Net effect: lower federal enforcement risk near-term, but enforcement migrates to state AGs (especially CA and NY) — a fragmented, uneven risk map for any national program, and one that could snap back with an administration change.

1. Card rails vs. A2A vs. wallets: cards keep the unbanked and government segments (ubiquity, no bank account required); banked corporate disbursements (insurance claims, refunds, marketplace payouts) shift fastest to push-to-card and RTP/FedNow. Payers converge on a choice menu, optimized by cost and fraud.
2. Consolidation: Fiserv–Payfare, Syncapay–Onbe, BofA's exit — the mid-tier program-manager layer is being absorbed while Marqeta/Highnote/Lithic and the rail aggregators grow underneath.
3. Government contracts are lumpy, political, and re-tradeable — Direct Express and Maryland EBT both flipped via readiness failure or litigation.
4. EMV migration is the near-term growth driver in government disbursement, and the regulatory vacuum leaves the EBT protection gap unresolved federally.