BIN Attack

A BIN attack is a form of card fraud in which criminals start from a known bank identification number (BIN), the first six or eight digits of a card number that identify the issuer and card range, and use software to generate thousands or millions of possible full card numbers. They then test these numbers through online payment attempts to discover which correspond to real, active cards, along with a working expiry date and security code.

BIN attacks are a type of enumeration attack and a close relative of card testing fraud. The difference is in the starting point: card testing usually checks card numbers that have already been stolen, while a BIN attack creates candidate numbers from scratch. Both rely on automated bots and both target card-not-present channels, where no physical card is needed. Card issuers, merchants, payment gateways and acquirers all bear costs from such attacks.

1. Choosing a BIN. The attacker picks a BIN, often one known to belong to an issuer with weaker fraud controls or a card product used for online spending.
2. Generating numbers. Because the remaining digits of a primary account number include a check digit calculated with the Luhn formula, software can quickly produce numbers that look valid, cutting the search space.
3. Guessing other data. The attacker cycles through likely expiry dates and, where needed, three-digit card verification values.
4. Testing. A bot submits small payment or zero-value verification attempts on one or many merchant websites, often charities, digital goods stores or poorly protected checkouts, and records which ones are approved.
5. Using or selling. Confirmed card details are used for larger purchases or sold on criminal marketplaces.

Attackers spread attempts across many merchants, IP addresses and devices to avoid triggering limits. When one merchant is used heavily, the merchant sees a flood of declines. When attempts are spread across the internet, the issuer sees unusual authorisation patterns concentrated on one card range.

• Issuers. They face fraud losses on the cards found, the cost of reissuing large batches of cards and heavy authorisation traffic that can strain systems.
• Merchants. Targeted merchants pay authorisation and gateway fees on every attempt, can see their decline rates spike, may face scheme monitoring programmes and chargebacks, and risk being cut off by their acquirer.
• Acquirers and gateways. They must absorb processing load and may be held responsible by card schemes for allowing excessive attack traffic.
• Cardholders. Victims may see unexpected small charges, followed by larger fraud, and suffer the inconvenience of replacement cards.

Defences are needed on both sides of the transaction.

Merchants and gateways use velocity checking to limit attempts per card, device, IP address or session; CAPTCHA and other bot challenges; device fingerprinting; and rules that block repeated declines or many cards tried from one source. Requiring cardholder authentication through 3-D Secure 2 for suspicious traffic makes guessing much harder, since the attacker cannot pass the issuer's challenge. Requiring the address verification check and security code also helps.

Issuers monitor authorisation traffic by BIN range for spikes in declines with invalid expiry dates or security codes, sequential card numbers and many low-value attempts across unrelated merchants. Machine-learning tools for real-time fraud scoring can block a range temporarily, decline unusual merchant types or step up authentication. Issuers also avoid predictable patterns, such as issuing cards in strictly sequential numbers with the same expiry date, which make enumeration easier.

Card schemes contribute by analysing traffic across the whole network, sharing alerts with issuers, and setting rules and fees that push acquirers to stop enumeration traffic from their merchants.

BIN attacks belong to a wider family of automated bot attacks on payment systems. They resemble a brute force attack on passwords, except that the target is card data. They are often a first step towards other fraud, since valid card details obtained this way are later used in larger card-not-present purchases or resold. Because the cards found have never been physically compromised, cardholders may have no warning until fraud appears.

No single control stops BIN attacks. Strict velocity limits can block real customers who mistype details, CAPTCHA can hurt conversion, and requiring authentication for every payment adds friction. Attackers adapt by slowing their pace, rotating through residential proxy networks and targeting merchants with the weakest controls. Effective fraud detection therefore relies on shared intelligence among merchants, acquirers, issuers and networks, combined with layered controls tuned to each business.