BIN attack: how generated card numbers hit your checkout
A BIN attack is a form of card testing where fraudsters take a real bank identification number, the first six to eight digits of a card, and generate the remaining digits, expiry dates and security codes. Bots then try the guesses in bulk. Spot it by many distinct cards on one BIN range within minutes, mostly declined.
Updated · RiskCogs team
Key facts
- BIN stands for bank identification number; the newer term is IIN, issuer identification number.
- The last digit of a card number is a checksum, so attackers can produce valid-looking numbers quickly.
- A BIN attack looks like a burst of attempts with sequential or similar card numbers on the same BIN range.
- The merchant pays authorisation fees on every attempt, and the issuing bank sees a wave of declines.
How a BIN attack differs from other card testing
Classic card testing checks real stolen cards. A BIN attack starts with no card at all: the attacker enumerates numbers inside one BIN range and lets your checkout tell them which combinations are live. That means the card numbers are new, but the BIN repeats again and again.
- Many distinct cards sharing one or a few BINs.
- Very high decline share, often for invalid card or wrong expiry.
- Small or identical amounts.
- Few devices or sessions behind many cards.
- Automation and data-center traffic.
How to stop a BIN attack
- Limit distinct cards per device, IP and session within short windows.
- Alert on spikes in declines concentrated on one BIN range.
- Temporarily watch or block an attacked BIN range, then lift the block once the burst ends.
- Challenge or block automated traffic before it reaches payment authorisation.
- Tell your payment provider so the issuer can be informed.
BIN attack indicators
| Indicator | Why it matters | Action |
|---|---|---|
| Distinct cards per BIN in 10 minutes | Enumeration of one range | Watch list for the BIN, raise score |
| Declines with invalid expiry or CVC | Guessed details | Rate-limit the session |
| Many cards per device | One bot, many guesses | Block the device for a period |
| Data-center IP and webdriver flags | Automated tooling | Challenge or block |
| BIN country differs from IP country | Remote attacker | Add to score |
How RiskCogs handles BIN attacks
RiskCogs uses BIN context only, never full card numbers. For BIN attacks it combines card and BIN velocity, a dedicated small-amount testing signal, BIN country versus IP country checks, prepaid, virtual and unknown BIN flags, data-center IP detection and automation signals from the browser SDK.
You can put a BIN, card, device or IP on a watch or block list in your rules, and try the rule in shadow mode first to check it would not hit good customers on the same bank range.
See what you would have blocked — free shadow modeFrequently asked questions
What does BIN mean in card fraud?
BIN is the bank identification number, the first six to eight digits of a payment card. It identifies the issuing bank, the card brand, the card type and often the country. Fraud tools use it to judge risk, and attackers use it as the fixed starting point for generating card numbers in a BIN attack.
Should I block a whole BIN during an attack?
A short, targeted block can stop the burst, but a BIN can cover many real customers of the same bank. Prefer watching the BIN and raising the score, combined with device and velocity limits, and if you do block, remove the block once the attack has stopped.
Why do BIN attacks hit small merchants?
Small merchants often have simple checkouts, low velocity limits and no bot protection, so their payment forms are an easy way to check card guesses. Attackers do not care about the products; they only need the approve or decline answer, which is why the amounts are usually tiny.
Sources and related reading
- ISO/IEC 7812, identification cards, numbering system for issuer identification numbers.
- Visa, Visa Core Rules and Visa Product and Service Rules (public edition).
Measure first. Enforce when ready.
Run RiskCogs in shadow mode next to your existing payment setup and review the decisions before they affect a single customer.