Bank Identification Number
What Is a Bank Identification Number (BIN)? Definition and How It Works
Definition
A Bank Identification Number (BIN), also called an Issuer Identification Number (IIN), is the first six to eight digits of a payment card number that identify the institution that issued the card, the card network, the card type, and the card's country of issue. BINs are used by payment systems to route transactions to the correct issuer, apply appropriate interchange rates, and trigger relevant fraud and risk rules at the point of payment.
How it works
Every payment card number (PAN) follows the ISO/IEC 7812 standard. The BIN occupies the first six digits (extended to eight digits under the 2017 ISO standard update to accommodate the growing number of issuers). The remaining digits form the individual account number, with the final digit being a check digit calculated using the Luhn algorithm to detect typographic errors.
The BIN encodes several properties of the card: the card network (Visa PANs start with 4; Mastercard with 51-55 or 2221-2720; Amex with 34 or 37); the issuing institution (the specific bank or e-money institution that issued the card); the card type (credit, debit, prepaid, commercial, corporate); the card level (standard, gold, platinum, infinite); and in many cases the card's country of issue.
At the point of payment, the BIN is used for multiple purposes. Routing: the acquirer or gateway uses the BIN to identify the card network and route the authorisation request to the correct network endpoint. Interchange determination: the BIN identifies the card type and level, which determines the applicable interchange rate category. Fraud scoring: BIN data contributes to fraud models by identifying unexpected card geography mismatches, high-risk issuer types, or prepaid cards in fraud-prone categories. 3DS routing: the BIN is used to look up the issuer's Access Control Server (ACS) endpoint for 3DS authentication.
BIN databases are maintained by the card networks and commercial BIN data providers. Merchants and payment providers subscribe to BIN database feeds to ensure accurate card type identification and routing decisions. BIN data must be kept current because new BIN ranges are issued regularly as card programmes expand.
Why it matters
Accurate BIN identification is essential for correct interchange rate qualification and optimised transaction routing. A merchant that misidentifies a debit card as a credit card (or vice versa) due to stale or inaccurate BIN data will submit the transaction with the wrong transaction type indicator, resulting in an interchange downgrade and higher processing costs.
BIN data is also a key input to fraud detection. Mismatches between the BIN's country of issue and the transaction's IP geolocation are a classic fraud signal: a card issued by a US bank used from an IP in Eastern Europe with no travel history warrants elevated scrutiny. Prepaid BINs are associated with higher fraud rates in some contexts, enabling fraud models to apply stricter controls to prepaid card transactions in high-risk merchant categories.
BIN attacks are a specific fraud type in which automated scripts cycle through card numbers within a known BIN range to identify valid card numbers and CVVs. Merchants who do not implement rate limiting, CAPTCHA, or velocity checks on payment attempts are vulnerable to BIN attacks, which generate large numbers of small test transactions that can overwhelm fraud defences and generate chargeback exposure.
With PXP
PXP offers a BIN lookup API, and BIN data feeds its routing, interchange optimisation, and fraud screening. Talk to our team about how PXP can support your BIN lookup and routing.
Frequently asked questions
What is the difference between BIN and IIN?
BIN (Bank Identification Number) is the traditional term used in the payments industry. IIN (Issuer Identification Number) is the ISO standard terminology for the same concept. Both refer to the first six to eight digits of a payment card number that identify the issuing institution and card properties. The terms are used interchangeably in practice; BIN is more common in commercial contexts while IIN appears in ISO standards documentation.
Why did BINs expand from 6 to 8 digits?
The original 6-digit BIN standard allowed for approximately one million unique BIN assignments. As the global card industry grew, with new issuers, new card programmes, and new card types requiring unique BIN ranges, the available 6-digit space began to run low. The ISO/IEC 7812 standard was updated in 2017 to support 8-digit BINs, expanding the available address space to accommodate growth. Card schemes began the transition to 8-digit BINs in 2022, with full implementation ongoing. Payment systems must support both 6-digit and 8-digit BIN lookup to handle cards issued under both standards.
How do merchants protect against BIN attacks?
Protection against BIN attacks requires detecting and blocking the automated transaction patterns that characterise them: high volumes of small transactions from single IP addresses or device fingerprints, sequential card number patterns within a BIN range, high decline rates on authorisation attempts, and unusual velocity on a specific BIN range. Effective countermeasures include rate limiting by IP, device, and BIN range; CAPTCHA on payment forms; real-time velocity rules triggering holds after N failed attempts; and monitoring for BIN-range concentration in authorisation requests.
Revolutionize your business with PXP
Take complete control of your commerce and payments with one platform.
Get Started