What is a BIN test?

A BIN test checks the leading digits of a payment card number to see if they match a real issuing bank and card type. Those leading digits are the Bank Identification Number, or BIN, also called the Issuer Identification Number (IIN). A BIN test validates the prefix, not the account, so it cannot confirm that a card is open, funded, or approved for a charge.

Payment processors run a BIN check on every transaction. The result shapes routing, fee calculation, and fraud scoring before the authorization request reaches the issuer.

What does a BIN tell you?

The BIN covers the first six to eight digits of a card number. The ISO/IEC 7812 standard defines that layout.

• Issuing bank or card program manager
• Card network (Visa, Mastercard, American Express, Discover)
• Funding type: credit, debit, prepaid, or charge
• Country of issue
• Product level, such as classic, gold, platinum, or commercial

The first digit marks the major industry, such as banking or travel. The digits that follow point to the issuer. The remaining digits identify the account holder and end with a check digit.

Is a BIN the same as a card number?

No. The BIN is a prefix of the full card number. The complete number is the PAN, or Primary Account Number, and it can run to 19 digits.

Where the BIN check sits in a payment flow

The check runs at the start of the transaction, before the authorization message goes out. The gateway reads the prefix, matches it against a table, and attaches the result to the request. This adds no visible step at checkout.

How do merchants use BIN checks?

BIN data feeds rules that run before authorization. Most gateways and processors apply them by default.

• Routing the transaction to the right network and acquirer
• Calculating interchange and network fees
• Blocking prepaid or high-risk card types on certain products
• Flagging foreign-issued cards for extra checks
• Choosing currency and conversion settings

A mismatch between the BIN country and the billing address raises a fraud score. That signal on its own is weak, so teams pair it with device and behavior data.

What is a BIN attack?

A BIN attack is an automated attempt to guess live card numbers inside one BIN range. The attacker submits many card numbers that share the same first six digits and watches which ones return an approval. Volume hides the individual guess.

BIN attacks target checkout pages, subscription signups, and any endpoint that returns a clear pass or fail. They cost the merchant in fees, chargebacks, and blocked traffic.

Signals that point to a BIN attack

• Decline spikes grouped under one BIN
• Hundreds of attempts in minutes from rotating IP addresses
• Low-value orders placed to test approvals
• Authorization-only requests with no capture
• Guest checkouts where card and address data disagree

How do you stop a BIN attack?

1. Cap attempts per BIN, per IP, and per device inside a rolling window.
2. Require 3D Secure for new cards and high-risk BINs.
3. Add a CAPTCHA or proof-of-work step after repeated failures.
4. Challenge card-not-present traffic from data-center IP ranges.
5. Send authorization-only requests to a fraud model instead of a raw approve/decline page.
6. Review alert rates per BIN and tune thresholds each week.

Rate limits matter more than blocklists. Attackers rotate numbers and IPs, so a rule that reads pattern and speed holds up longer than a static list.

BIN test vs. card validation

The two terms get mixed up. A BIN test reads the prefix and needs nothing beyond the first six to eight digits. Card validation confirms the full account, through an authorization request, an address check, or a card verification value check.

Only the issuing bank can confirm that an account is open and funded. No third-party lookup tool has that access.

Is a BIN test legal?

Checking BIN data for payment routing, fee calculation, and fraud screening is legal and routine. The prefix is public, derived from the card number format itself. Using card numbers you are not authorized to use is a separate matter and is illegal in most countries.

FAQ

Can a BIN test tell if a card is valid?

No. A BIN test confirms the prefix format and issuer data. It says nothing about whether an account is open, holds funds, or will approve a charge.

Are BIN lookup tools free?

Some databases are free and cover the major networks. Accuracy varies because issuers add new ranges and retire old ones. Commercial providers update sooner and add card type and country fields.

How many digits should a BIN check use?

Six digits cover most ranges. Eight digits give a sharper match where an issuer has split a range across products. Many payment systems store eight so they can handle both.

Does a BIN check involve cardholder data?

The BIN by itself is not a full account number, so it can sit outside the cardholder data environment under PCI DSS. Storing full card numbers brings requirements for encryption, masking, and access control.