What is a BIN attack?
A BIN attack is card-testing fraud that starts with a real Bank Identification Number and guesses the rest of the card digits in bulk until a few numbers authorize. It trades accuracy for volume: thousands of wrong guesses for every working card.
The BIN is the first six to eight digits of a card number, and those digits are not secret. They name the issuing bank, the card brand, and the card type, which is why they appear in public BIN lists.
What do the digits in a card number mean?
A card number has three parts, and only one of them is hidden.
- Issuer identification number: six to eight leading digits tied to the bank that issued the card.
- Account block: the middle digits, unique to one cardholder.
- Check digit: the last digit, produced by the Luhn formula.
Luhn catches typos at the checkout page. It says nothing about whether an account exists, so a number can pass the check and still be dead.
How does a BIN attack work in practice?
Attackers generate candidate numbers inside a chosen BIN range, then push them through real payment pages in small batches. The merchant's response tells them which numbers are live.
- Pick a BIN and card type to target.
- Generate candidate numbers around that prefix, filtered by the Luhn check.
- Send low-value authorization requests to stores with weak card checks.
- Keep the approvals, drop the declines, and restart with a new BIN.
Each step is cheap to run and simple to automate. That is the whole appeal, and it is also the weakness, because fraud systems are built to read patterns in volume.
Why does a BIN attack fail more often than it works?
An authorization request carries more than the card number. It carries device data, IP address, time, merchant history, and the amount, and the issuer scores all of it together.
- Address and CVV mismatch: guessed numbers seldom line up with a billing address or a security code.
- Velocity rules: fifty attempts from one IP in a minute is a signature, not a customer.
- 3-D Secure: a challenge step stops most automated attempts cold.
- Issuer risk models: banks flag BINs that show abnormal decline rates.
Raw guessing produces few live numbers. Card-not-present losses at most merchants come from stolen data that already has a matching address and CVV, not from a prefix scan.
What signals give a card-testing run away?
Fraud teams watch a short list of markers, and a test run trips several of them at once.
- Decline rates that jump from 5% to 60% inside an hour.
- Dozens of card numbers from the same BIN hitting one checkout page.
- Ticket sizes under one dollar, repeated on the same device.
- IP country that does not match the card's issuing country.
- Disposable email domains and auto-filled shipping fields.
- First-time buyers with rush shipping and no browsing history.
What does a BIN attack cost a merchant?
Each approved fraudulent order costs the goods, the shipping, a chargeback fee, and the original sale. Chargeback fees run from $15 to $40 per case at most processors, and the merchant eats the revenue on top.
Repeat hits bring bigger problems. Processors track chargeback ratios, and a store above the card brand thresholds lands in a monitoring program with fines and a rolling reserve on its account.
Some stores lose the merchant account altogether. That is the part that ends businesses.
Is a BIN attack illegal?
Yes. In the US, generating and testing card numbers to obtain goods or services falls under access device fraud (18 U.S.C. § 1029), wire fraud, and identity theft statutes.
Buying stolen card data is a separate offense with its own penalties. A conviction can carry prison time, restitution, and a record that closes off most jobs in finance and tech.
How do you stop card testing on a store?
Layer basic controls and most automated runs die at the first or second request.
- Put bot detection or a CAPTCHA on the checkout and on account login.
- Set velocity limits per IP, per device, and per card prefix.
- Require CVV and address verification on every card-not-present order.
- Enforce 3-D Secure for high-risk countries and first orders.
- Set a minimum order value and block known proxy and Tor exit nodes.
- Review decline rates per hour and pause checkout when the rate spikes.
None of these steps is exotic. The stores that get drained are the ones running no limits at all.
Frequently asked questions
How is a BIN attack different from carding?
Carding uses stolen card data, often bought in bulk, and tries to spend it before the card gets shut off. A BIN attack manufactures candidate numbers from a known prefix instead. Both end at the same checkout page.
Do BIN attacks work against 3-D Secure?
Seldom. The challenge step asks for something the attacker does not have, and a failed challenge is a hard stop. Stores that enforce 3-D Secure on all card-not-present orders see very few successful test runs.
Why do BIN lists circulate if the digits are public?
Because a list saves work. It groups prefixes by bank, country, and card type so a buyer can aim at a specific market. The list itself is not the fraud. Using it to guess account digits is.
Can a merchant tell a test from a real customer?
Often yes. A real customer buys something they want. A test run produces many small orders from one device, several card numbers, and a spike in declines.