What Is a Bank Identification Number (BIN)?
A bank identification number (BIN) is the first 4 to 8 digits of a payment card, and it's what tells a processor which bank issued the card. It also names the network the card runs on.
I worked chargeback support for a year, and I helped merchants hunt down a BIN more than almost anything else, right behind the billing descriptor.
By the end of this you'll read a BIN off any card number and know what it can and can't tell you.
Key takeaways
What Is a Bank Identification Number (BIN)?
A bank identification number is the first 4 to 8 digits on a debit or credit card, and it names the bank that issued the card. It also names the card's network, like Visa, Mastercard, American Express, or Discover.
Each network hands blocks of BIN ranges to the banks that issue its cards. One sequence maps to one institution on one network. A processor reads those digits and knows where the charge goes.
A BIN identifies the bank and the network, and stops there.
The rest of the card number identifies the account. That part is the full primary account number (PAN), and no lookup tool will return it.
What Is a BIN Used For?
Processors use BIN data to route a charge to the right issuer, screen it for fraud before authorization, and confirm issuer details once a dispute is filed. Each job reads a different part of what the BIN encodes:
- Routing: the issuer identifier tells the processor which bank gets the authorization request.
- Fraud screening: the network and card-type flags feed a risk score before approval.
- Dispute confirmation: the same issuer data confirms which bank filed against you.
A BIN is one signal in a fraud decision, alongside the address verification result, the CVV check, and 3D Secure. Each of those checks one attribute of the transaction. Cardholder identity is not one of them.
A matching BIN country is not proof of a real buyer. Require the address check and the CVV check to pass too before you approve.
Can a BIN Be Used for Fraud?
Yes. In a BIN attack, a fraudster takes one real BIN and generates thousands of full card numbers from it, then tests which ones work. Stripe calls the method brute force. Attackers "generate complete card numbers by appending randomly generated digits to the BIN and calculating the appropriate check digit." They then run them against sites with weak checks.
The BIN is what makes this practical.
It's public, and every card an issuer hands out shares it. On a 16-digit card, that leaves the attacker guessing nine digits or fewer, and the check digit gets calculated.
Bots then submit those guesses as small authorization attempts. One BIN can generate thousands of tiny approvals and declines at your checkout in minutes.
A BIN attack is card testing. The attacker wants a list of live card numbers to use elsewhere, so your fix is rate limiting rather than the identity checks that stop account takeover.
Three controls stop a BIN attack at the door:
- Rate limits on your payment endpoint.
- A CAPTCHA on checkout.
- A velocity rule that blocks repeated attempts from one IP or one BIN.
Parts of a BIN: How to Identify One
A card number's first digit is the Major Industry Identifier, the first 4 to 8 digits are the BIN, and the rest is the account.
ISO calls those BIN digits the issuer identification number (IIN), and the two terms mean the same thing.
Reading the Digits
The first digit sorts the card into a broad category, and each digit after it narrows down to the issuing bank. A 4 or a 5 means banking and finance, and a 3 covers travel.
Each network owns known opening ranges, so you can name the network before the bank:
Take 4242 4242 4242 4242, the test number processors publish for sandbox work.
The leading 4 is the Major Industry Identifier and puts it in banking. The first six digits, 424242, are the BIN, and digit nine onward belongs to that one account.
BIN Length and Looking One Up
A BIN reads the same way on a debit card, and BINs now run 4 to 8 digits instead of a fixed 6. A debit BIN points at a checking account, and a credit BIN points at a credit line.
Older ranges run 4 to 6 digits, the standard for decades. ISO then revised ISO/IEC 7812-1 to call for eight digits. Visa and Mastercard began assigning 8-digit BINs in April 2022. Shorter BINs stayed valid, so the industry now runs both lengths.
Anything built to read exactly six digits will misread a newer card.
Our free BIN lookup tool returns the issuer, network, and country from any card's first 8 digits.
Types of BINs
BINs split by who pays for the card and by how many businesses share the range. Each split changes what a merchant can read from a lookup:
- Commercial or retail: who pays for the card.
- Shared or dedicated: how many businesses use the range.
Commercial vs. Retail
A commercial BIN belongs to a business card and a retail BIN belongs to a consumer card. Retail ranges cover personal spending, and commercial ranges cover company cards, corporate accounts, and purchasing cards.
Commercial ranges carry different interchange rates. They also pass line-item data, because a business needs the detail its accounting team can reconcile.
Read a commercial BIN on an incoming charge and you know a company is buying. That matters if you price or support B2B orders differently.
Shared vs. Dedicated
A dedicated BIN belongs to a single organization, while a shared BIN covers many. A dedicated range belongs to one bank every time.
Program managers and sponsor banks commonly issue cards for several brands out of one shared range. This covers most fintech cards. On a shared range, a lookup returns the sponsoring bank, often a different name from the brand on the card.
A BIN is also a different identifier from your merchant ID, which names your business rather than theirs.
Here's How to Get a BIN Number
A business gets its own BIN either through a sponsor bank that lends its approval, or by licensing directly from a card network. The choice comes down to whether it borrows that approval or earns its own:
- BIN sponsor: a bank or processor lends you its regulatory approval and infrastructure.
- Network license: you apply to Visa or Mastercard directly and hold the approval yourself.
Nearly every fintech starts with a sponsor.
1. BIN Sponsor
A BIN sponsor is a bank or processor that lets a business issue cards under its own regulatory approval. The sponsor already holds the network relationship, so you launch on licensed infrastructure, reach the market faster, and pay less to start.
The tradeoff is control. Your program runs inside the sponsor's risk appetite, so the sponsor can decline categories you wanted or set limits you'd rather not have.
You also depend on one relationship, and a sponsor exit forces a move.
2. Network License
A direct network license means the card network approves your business as an issuer itself. You hold the relationship and set your own program rules, with nothing between you and the network.
Earning one takes real capital, a compliance function, and operational readiness the network audits. Meeting those requirements yourself takes longer and costs more than a sponsorship. That path suits an established institution more than a startup.
What you get back is a program no sponsor can decline categories in or set limits on.
This is how a business becomes a card issuer. Finding the BIN on a customer's existing card is a different job.
BIN + CAID: Why Chargeback Alerts Need Both
Enrolling in chargeback alerts takes your BIN and your Card Acceptor ID together. Your CAID is the code identifying the transaction's merchant location, and each number does one half of the same identification:
Visa RDR matches an incoming dispute against both numbers, so it needs both to connect the dispute to your account.
The two coming from different places is most of why merchants get stuck. Shopify merchants have to ask Shopify support for their CAID.
In our support data, BIN and CAID questions came up in roughly 200 of about 1,600 keyword-matched conversations over 12 months. Only billing descriptor questions came up more often.
Brand-new stores had it worst, because a store with no processed transactions can't produce either number yet.
An alert can still fail on a descriptor mismatch, or because the issuing bank isn't in the alert network. You need both numbers right, and they still might not be enough.
Bank Identification Code vs. Bank Identification Number
A bank identification code (BIC) names a whole bank for international transfers, and a bank identification number (BIN) names a card issuer for card payments. One moves wire transfers, the other routes card charges. The near-identical names are all they share.
ISO 9362 defines a BIC as "an 8 alphanumeric character code that identifies a business party in a specified country," extending to 11 characters for a branch. Banks use it to address cross-border payments to each other.
The two identifiers differ on every axis that matters:
The confusion is a naming accident. BIC is sometimes written out as "bank identification code," one word away from "bank identification number."
Each one works in exactly one system, BICs in wire transfers and BINs in card payments.
How we sourced our data
The support figures here come from a 12-month review of our own Intercom support conversations. The window runs 2025-07-07 to 2026-07-07.
Counts are keyword-match totals across that window, reviewed and clustered by hand. Read them as rough support volume rather than exact incident counts. They describe the merchants who wrote to us, a narrower group than the payments industry.
FAQ
Can I find a card's BIN from just the physical card?
Yes, the BIN is printed on the card as the opening digits of the card number. A BIN lookup turns those digits into an issuer name.
Does a BIN tell you if a card is prepaid or a gift card?
Often yes, because issuers give prepaid and gift programs their own BIN ranges. A BIN lookup returns the funding type, and the answer depends on how current its database is.
Is it safe to share a BIN with a support team?
Yes, a BIN names the issuing bank and counts as public information. Keep the full card number, expiry, and CVV to yourself.
Why does my dashboard show an unexpected BIN?
Usually the dashboard reads a different number of digits than you do, or the card is on a shared range and resolves to the sponsoring bank. Check the digit count first.
