What a BIN lookup test is

A BIN lookup test checks one result: the issuer data a lookup service returns for the first six or eight digits of a card number. You enter a known BIN, then compare the response against the reference record. The test passes when brand, card type, issuer name, and country match.

What is inside a BIN

BIN stands for Bank Identification Number. ISO/IEC 7812 defines it as the Issuer Identification Number, or IIN. The digits sit at the start of the primary account number (PAN).

A BIN maps to:

• Card brand: Visa, Mastercard, American Express, Discover
• Issuer name and issuer country
• Card type: credit, debit, prepaid, commercial
• Card level: classic, gold, platinum, signature

ISO/IEC 7812 set the BIN at six digits. An amendment allows eight. Visa and Mastercard have moved issuer ranges to eight digits. A lookup service that reads six digits can return the wrong issuer for those ranges.

How to run a test

1. Pick a BIN with a documented issuer record.
2. Send the BIN to the lookup service.
3. Compare brand, type, issuer, and country to the record.
4. Run the number through the Luhn check to confirm the checksum.
5. Repeat across brands, countries, and card types.
6. Log the date. Issuer data changes.

Run one test per brand and one per card type. Debit and prepaid ranges fail more often than credit ranges in low-cost databases.

Test numbers from processor sandboxes

Payment processors publish test PANs for sandbox work. These numbers pass the Luhn check and carry no account.

• 4242 4242 4242 4242, Visa
• 5555 5555 5555 4444, Mastercard
• 3782 822463 10005, American Express
• 6011 1111 1111 1117, Discover

Use these for integration tests. A sandbox number is not proof that a live BIN database is accurate.

What a BIN lookup test does not prove

A BIN lookup returns public routing data. It says nothing about the account.

• No check that the account is open
• No check on balance or credit limit
• No check on cardholder name or billing address
• No authorization from the issuer

Authorization is the job of the issuer. A merchant sends an authorization request through the acquirer and the card network. The issuer approves or declines. No lookup service replaces that step.

Accuracy limits

BIN databases age. Ranges get reassigned when banks merge, sell portfolios, or launch products. A record that was correct last year can point to a different issuer today. Ask a vendor for the update interval and the source of the data. A vendor that will not name the source is a risk.

Legal and compliance notes

BIN lookup has legitimate uses: routing, fraud scoring, checkout form validation, and analytics. Using lookup tools against card numbers you do not own or have permission to process is a crime in the United States. 18 U.S.C. 1029 covers access devices, which includes card numbers. PCI DSS limits storage of the full PAN. Section 3 sets rules on retention and protection.

This guide does not cover carding. It gives no method to test stolen card data.