BIN number: what a card's first digits tell you

A BIN number is the first six or eight digits of a credit, debit or prepaid card number. BIN stands for bank identification number. The international numbering standard for cards, ISO/IEC 7812, calls the same digits the issuer identification number (IIN), and both names mean one thing: the prefix that tells a payment system which bank or other institution issued the card. From that prefix, the systems behind your checkout can work out the card's network, whether it's credit, debit or prepaid, and the country where it was issued.

You'll rarely type a BIN yourself, but it does quiet work on every sale you take. Fraud rules and debit routing depend on it, and it's how a surcharge program tells a credit card from a debit or prepaid card that must never carry the fee. This guide covers what the digits reveal, why they grew from six to eight, how a BIN number lookup works and where it falls short, and how much of a card number PCI DSS lets you display.

One note before we start: the "Rx BIN" on a pharmacy benefit card is a separate number used for prescription claims, and everything here is about payment cards.

What is a BIN number?

It's the issuer's part of the card number. Every card number, which the industry calls the primary account number (PAN), opens with digits that identify the issuer and continues with digits that identify one cardholder's account. Every card the bank issues from that range shares the same opening digits.

Visa assigns BINs to the banks that issue Visa cards, and it stopped handing out new six-digit issuing BINs after April 2022 while keeping the six-digit ones already in use (Visa). That's why a BIN can tell you two things at once: which network's rules apply to the card, and which bank will approve or decline the charge.

You'll see both names. ISO's standard says issuer identification number, while processors and the networks' merchant guides say BIN. If someone asks for a card's IIN, they mean the same digits.

On a physical card there's no separate label. The BIN is simply where the long number starts: the first six digits on older ranges and the first eight on newer ones.

What does a BIN number tell a merchant?

The prefix by itself is just digits. What makes it useful is the data tied to each range, which links a card to its network, its issuer, its product type and its home country. Each one matters on your side of the counter:

Product type is the one that can cost you real money when it's misread. Visa sets product type at the BIN level, and its guidance on the eight-digit change warns that a system reading only six digits can misidentify a prepaid or other product (Visa).

Country affects cost as well as risk. Visa's annual report says it treats a transaction as cross-border when the issuer's country of origin differs from the beneficiary's, and on a card sale the beneficiary is you (Visa annual report). The BIN is the part of the number that names that issuer. Our guide to cross-border fees explains what those sales add, and our issuing bank guide covers what the issuer does once your authorization request arrives.

What the BIN can't tell you matters just as much. It says nothing about the person holding the card: not their name, not their balance, and not whether the card was reported stolen an hour ago. Many cards share every BIN, so a normal-looking prefix proves very little.

Why did BIN numbers go from six digits to eight?

Because the six-digit supply was expected to run short. ISO revised ISO/IEC 7812-1 to lengthen the issuer identification number from six digits to eight, since the number of card issuers kept growing (ISO). Visa's merchant guide describes the change as an industry standard that ISO announced in 2017, and Visa's clients had to support the new eight-digit issuing BIN length from April 2022 (Visa).

That last row is the one that bites. Visa's merchant FAQ tells acquirers, merchants and service providers to be ready to handle both lengths at once, and it recommends using the nine-digit account range for processing (Visa). Visa's merchant guide is blunter: the first six digits of a card number can no longer be relied on for authorization, routing and clearing.

So check anything in your business that reads the front of a card number. These are the usual hiding places for six-digit logic:

• Fraud rules that flag or block card ranges.
• Surcharge settings that decide which cards get the fee.
• Discounts or promotions tied to one bank's cards.
• Reports that group sales by issuer or card type.
• The masking format on receipts, screens and exports.

Ask your processor and each software provider, in writing, whether those features read eight digits. A yes on the phone isn't the same as a yes in an email you can find next year.

How do merchants and processors use BIN numbers?

Four jobs, mostly out of sight: screening orders for fraud, spotting card testing, routing debit sales and keeping surcharges off the wrong cards.

Fraud screening

Fraud rules lean on the BIN because it tells you something about a card before the issuer has answered. A card issued in one country, used from an IP address in a second and shipping to a third deserves a closer look. That isn't proof of fraud, since travelers and gift buyers do all three. It's a reason to send the order to a review queue rather than decline it automatically.

BIN-based rules work best next to the checks that test the person rather than the card. Clearo's online payments screen orders with AVS, CVV checks and velocity rules, and our ecommerce fraud prevention guide shows how the layers fit together.

Card testing

Card testers love a BIN. Visa's guidance on account testing describes one or two low-dollar transactions run to see whether a card is active, usually on cards from a single BIN range, and it tells merchants to set alerts for a large volume of approvals or declines from a similar BIN range (Visa).

Picture a made-up coffee roaster in Raleigh that sells beans online. At 2 a.m., its checkout logs 300 attempts at $1 each, nearly all on cards that open with the same eight digits. No real customer behaves like that. A rule that pauses checkout once declines from one range pass a set number could have cut the run short after the first few dozen. Our card testing fraud guide covers what to do during and after an attack.

Debit routing

US debit cards have to be enabled on at least two unaffiliated networks, and issuers and networks can't block a merchant's choice between them (Federal Reserve). Your processor makes that choice card by card, and to make it the system has to know what the card is. That's why Visa's merchant guide includes routing among the jobs six digits can no longer be trusted with. Our least cost routing guide explains where the savings come from.

Surcharge checks

If you add a fee to credit card sales, the BIN is what keeps that fee off debit and prepaid cards. In the US, Visa holds a credit card surcharge to your merchant discount rate or 3%, whichever is lower, and Mastercard holds it to your average effective merchant discount rate or 4%, whichever is lower. Neither network lets a surcharge touch a debit or prepaid card (Visa, Mastercard). Visa also says a debit card remains a debit card when the customer presses "credit," so the decision has to come from the card's range, never from the button.

Here's what a stale six-digit table can cost. Say a hardware store in Tucson adds 2.5% to credit card sales, under both its merchant discount rate and Visa's 3% ceiling. Its old software reads one range of prepaid gift cards as credit, so a $200 purchase on one of those cards picks up a $5 fee. At 40 of those sales a month, that's $200 a month, or $2,400 a year, collected from customers the networks say should never have paid it. Refunding them is easy. Finding every affected sale in a year of reports is not.

Clearo's surcharging program covers compliance, disclosure and setup. Our debit card surcharge guide lists the states whose laws go further than the networks' rules.

How does a BIN number lookup work?

A BIN number lookup matches the first digits of a card number against a table of card ranges, then reports what the table says about that range: network, issuer, product type and country. That's the whole trick. The answer is only as good as the table, and tables age.

We know of no official public BIN lookup run by ISO or by the card networks. The free lookup sites you'll find online aren't run by either, so you're trusting data you can't trace to its source or date. After the eight-digit change, that matters. A list built on six-digit prefixes can return the wrong product for a card from an eight-digit range, which is exactly the mistake Visa warned merchants about.

For a business, the BIN data that counts is the data your processor and gateway already use when they authorize and route your sales. Rather than looking cards up by hand, ask your provider three questions:

1. Can I set fraud rules by card type, issuing country or card range?
2. Do your tables and my rules read eight-digit BINs?
3. Does my surcharge setting take the card type from the card's range rather than the customer's button?

What can a BIN number check tell you, and what can't it?

A BIN number check answers questions about the card, never about the person. Treat it as one signal among several:

One habit to break today: never paste a full card number into a website to see its BIN. You only need the first six or eight digits. Anything more, typed into a site you don't control, is a card number handed to a stranger.

How much of a card number does PCI DSS let you show?

The BIN and the last four digits, at most, unless someone has a legitimate business need to see more. That's Requirement 3.4.1 of PCI DSS v4.0.1, which says the full card number has to be masked when it's displayed (PCI SSC).

The wording changed along with the eight-digit move. PCI DSS v3.2.1 set the display limit at the first six and last four digits (PCI SSC), while v4 ties it to the BIN, whatever its length. PCI SSC's FAQ on eight-digit BINs names the two requirements affected, 3.4.1 for masking on screen and 3.5.1 for stored card numbers. It also says acceptable truncation formats vary by payment brand, depending on card number and BIN length, so questions about a brand's format go to that brand (PCI SSC).

Receipts you hand to customers follow a stricter federal rule. Under the Fair Credit Reporting Act, an electronically printed receipt given to the cardholder can show no more than the last five digits of the card number, and it can't show the expiration date (FTC). The BIN has no place on it.

Our guide to what PCI compliance is covers the rest of the standard. If your questionnaire also calls for quarterly external scans, our ASV scan guide explains how they work.

Common BIN mistakes merchants make

• Running fraud or surcharge rules on six digits when the card's range uses eight.
• Deciding credit versus debit from the button the customer presses.
• Blocking whole countries or banks with no review, which turns away good customers along with bad ones.
• Treating a BIN check as proof of who's paying.
• Pasting full card numbers into lookup sites or support tickets.
• Showing full card numbers on screens or printouts that don't need them.

PCI DSS, the networks' surcharge caps and the federal receipt limit work the same way for merchants anywhere in the United States. State surcharge laws sit on top of them.

Your next step

If you surcharge credit cards, or you aren't sure your checkout and fraud rules read eight-digit BINs, your statement is a good place to start. Send us a recent one for a free statement review, and we'll show you how your sales break down by card type and where the fees land. We handle payment processing for US and Canadian businesses, with interchange-plus pricing and a dedicated rep. If you'd rather talk through a surcharge setup or your fraud rules first, contact us.