N.Y. Comp. Codes R. & Regs. tit. 18, § 387.4 – Security control, processing of payment access cards and the State-approved social services district notice of change form.

(a) Any unauthorized issuance, use or alternation of a payment access card or the State-approved social services district notice of change form is a federal crime. Social services districts must take all precautions necessary to avoid unauthorized use of payment access cards or notice of change forms and must safeguard these documents from theft, embezzlement, loss, damage or destruction. For purposes of this section, the term payment access card also includes the common benefit identification card (CBIC) used to obtain SNAP benefits in all social services districts except New York City and the corresponding personal identification number (PIN) selection form used to register the access code with such identification card.
(b) All blank payment access cards and notice of change forms must be kept in secure storage under lock and key.
(c) Access to blank payment access cards and notice of change forms must be limited to assigned personnel.
(d) An inventory control record must be maintained by all offices and individuals responsible for distributing blank payment access cards to other social services district personnel. At a minimum, such an inventory control record must provide for all of the following:
1. (1) the assignment of a specific individual or a limited number of individuals to maintain the inventory control record. Whenever possible, offices responsible for a bulk supply of payment access cards must limit this responsibility to a single person;
2. (2) a record by serial number and date of all payment access cards withdrawn from or placed in inventory; and
3. (3) the signature of the person receiving the blank payment access cards as a record of receipt.
(e) The inventory control records maintained on payment access cards must be retained for audit purposes in accordance with section 387.2(k) of this Part.
(f) A physical inventory must be made of all payment access cards at least once a calendar year.
(g) Social services districts must notify the department immediately if counterfeit or stolen payment access cards and/or notice of change forms are discovered or if a theft occurs.
(h) When a recipient who accesses SNAP benefits by use of a payment access card reports the loss or theft of that payment access card, the social services district must immediately initiate procedures to prevent unauthorized access to the recipients' SNAP benefits.