What a BIN test checks

A BIN test matches the first six to eight digits of a card number against issuer records. Those leading digits are the bank identification number, also called the issuer identification number. The test confirms four things: the card brand, the card type, the issuing bank, and the issuing country. It answers one narrow question. Does this prefix belong to a live issuing range, and does it match the data your system already expects? A BIN test does not prove the card has funds, and it does not prove the cardholder authorized the charge.

Prerequisites

• A sandbox account with your payment processor
• The processor's published test card numbers
• Access to a BIN lookup database or a BIN endpoint in your processor's API
• A staging environment that is isolated from live card data

How to run a BIN test

1. Copy the first eight digits of the test card number. Those digits are the BIN.
2. Send the BIN to the lookup endpoint of your processor or BIN database.
3. Compare each returned field against the values you expect: brand, card type, issuer name, and country.
4. Run the Luhn check on the full test number to confirm the check digit is valid.
5. Submit the test card to a sandbox authorization and record the response code.
6. Repeat the process with at least one card per brand and per card type, including credit, debit, and prepaid.
7. Log the BIN, the response fields, and the authorization code in your test record.
8. Add an assertion to your test suite so the same BIN is validated on every build.

Reading the results

A response that returns an issuer name and country but the wrong card type usually means your mapping table is out of date. A response that returns nothing means the prefix is not assigned, or that you sent too few digits. Most networks now issue eight-digit prefixes, so a lookup built on the older six-digit format will return incomplete or ambiguous matches. Treat every mismatch as a data problem in your own system first, and a range problem second.

What a BIN test cannot do

A BIN test is a routing and data check. It does not replace address verification, CVV verification, or a real authorization. It also does not authorize you to test card numbers you do not own. Run BIN tests only against your processor's sandbox credentials, and never against live account data. Under PCI DSS, stored account data must be protected wherever it lives, including test databases and log files.