What Is a BIN Number? How Bank Identification Numbers Work

BIN definition: what the first digits of a card tell you

For a merchant, the BIN is the only part of a card number that describes the card programme rather than the individual account. That makes it a useful, low-friction signal at checkout. It also makes its limits important: a BIN tells you where a card came from, not who is holding it.

You can try this yourself with the free BIN checker, or read on for how the number is built and how to use it responsibly.

Anatomy of a card number

Most payment card numbers are 16 digits, though the standard allows up to 19. The structure below follows ISO/IEC 7812-1, which is maintained by ISO and used by the card networks.

The check digit is worth a note: a number that passes the Luhn check is merely well-formed. Fraudsters generate Luhn-valid numbers all the time, so passing it says nothing about whether the card exists.

BIN vs IIN: same thing, different name

"BIN" is the older term, from the days when the number mainly identified a bank. "IIN" is the term used in ISO/IEC 7812, and it is more accurate because issuers are not always banks. Fintechs, prepaid programme managers and other non-bank issuers also receive ranges.

In practice the two terms are used interchangeably. Payment processors, fraud tools and most documentation still say BIN, so use whichever your audience recognises. If you are writing a policy document or reading the standard itself, expect IIN.

The move from 6 to 8 digits

For decades, the first six digits identified the issuer. As the number of issuers, products and programmes grew, six digits became too coarse to allocate ranges. ISO/IEC 7812 was revised to lengthen the IIN to eight digits (ISO announcement), and the card networks have phased this in for newly issued ranges.

What it means for merchants and processors

• Do not hard-code six digits. Systems that assume a 6-digit BIN will mismatch when two different programmes share the same first six digits but differ at digits seven and eight.
• Lookup keys need to be longer. Send as many leading digits as you are permitted to handle, and let the lookup service match the longest range.
• Stored BIN tables go stale. A static spreadsheet or "BIN list" downloaded once will miss new ranges and reissued ones. Prefer a maintained lookup over a file you have to refresh yourself.
• Check your storage and logging. The PCI Security Standards Council sets rules on what parts of a card number can be displayed or stored. Truncation guidance was updated with longer BINs in mind, so confirm the current PCI DSS requirements with your assessor before changing what you log.

Not every card uses an 8-digit range yet, so the practical approach is to support both lengths and resolve to the most specific match.

What a BIN lookup returns

A BIN lookup matches the leading digits of a card number against a reference dataset. Typical fields include:

• Card brand, such as Visa, Mastercard or American Express.
• Card type: credit, debit or prepaid.
• Card level or product, where available, such as standard, premium or commercial.
• Issuing bank or institution name.
• Issuing country.

Field availability varies by dataset and by range, so build your logic to cope with blanks. A missing value is not a fraud signal by itself. The BIN Lookup API returns this type of data programmatically, and the guide to how to check BIN numbers walks through manual and API methods.

Fraud uses for BIN data

BIN data is most useful as one input among several. None of the checks below is conclusive alone.

Country mismatch

Compare the issuing country with the billing address country, the shipping country and the IP geolocation. A UK-issued card with a billing address in another country and an IP from a third deserves a closer look. Treat it as a flag, not a verdict: travellers, expats, students and customers of cross-border digital banks all produce legitimate mismatches. Pairing the BIN country with IP and device intelligence gives you a far better picture than either alone.

Prepaid detection

Prepaid cards are not inherently fraudulent, and many customers use them for privacy or budgeting. But they can be bought with little identity checking, so they carry different risk for some use cases, such as free trials, high-value digital goods, gambling deposits or account funding. Knowing a card is prepaid lets you route it to extra verification instead of declining it outright.

Card testing

Card testing is when a fraudster runs many small transactions to find which stolen or generated card numbers are live. BIN-level patterns help you spot it. Look for a burst of attempts sharing one BIN, many failures from one device or IP address, and repeated low-value attempts with varying expiry dates or CVVs. Velocity rules keyed on BIN, IP and device can slow these attacks before they reach your payment processor's own limits.

Routing and rule tuning

Beyond fraud, BIN data supports routing decisions, surcharging rules where lawful, and eligibility checks, such as accepting only debit cards for a particular product. If you apply different treatment by card type, check the rules in your market and your acquirer's terms first.

For a broader view of how these signals fit together, see our overview of fraud detection.

What a BIN cannot do

A BIN identifies the issuer's range. It does not identify the cardholder, confirm that the person paying owns the card, show the account balance, or prove the card has not been stolen. Millions of cards share a single BIN.

That is why BIN checks belong beside identity controls, not in place of them. Where you need to know who the customer is, such as onboarding, account opening or higher-risk transactions, combine card signals with identity verification: document authentication, biometric and liveness checks, and database checks. The KYC hub explains where these steps fit in customer due diligence.

Also bear in mind that digital wallets and network tokens can present different number ranges than the physical card behind them. If you see an unfamiliar BIN on a wallet payment, confirm how your processor passes through card data before building rules on it.

Getting started

Run a few known cards through the free BIN checker to see the data you will get. When you are ready to automate it, the BIN Lookup API can be wired into checkout or risk scoring. You can start verifying customers through the self-serve sign-up on our pricing page.

This article is general information, not legal or compliance advice. Card network rules, ISO standards and PCI requirements change, so check current requirements with your acquirer, the PCI Security Standards Council or qualified counsel.