VBASS Explained: How It Reduces Fraud & Chargebacks

Visa BIN Attribute Sharing Service (VBASS) is a paid Visa program that shares BIN-level data, like funding source, issuer country, and product platform, with merchants, acquirers, and issuers. It lets them screen a transaction before authorization instead of guessing after the fact.

I've spent time on the customer-support side of a chargeback tooling company, digging into merchants' processor and alert setups. One pattern shows up again and again.

Merchants buy a data feed like VBASS to stop fraud at checkout. Then they never connect it to the alert stack that catches what gets through anyway. This guide covers what VBASS gives you, what it costs, and where it fits next to your chargeback alerts.

Key takeaways

• VBASS shares Visa BIN attributes so you can screen transactions before authorization.
• The service comes in three access levels, each sharing more BIN attributes.
• Weekly refresh over two-week catches changed risk data up to 7 days sooner.
• VBASS is a paid service, and most recipients must be registered and billable.
• VBASS screens fraud at checkout, and alerts catch what clears anyway.
• In our dataset, Ethoca holds 42.1% of alerts with a recorded network.

What is Visa BIN Attribute Sharing Service (VBASS)?

VBASS is a paid Visa program that shares BIN-level attribute data with merchants, acquirers, issuers, and third parties. Merchants use it for fraud screening and transaction troubleshooting. The shared data includes funding source, issuer country, and product platform.

Per Visa's own VBASS product page, Visa calls it an optional service. That service enables sharing of Visa BIN Attributes to improve merchant processes and checkout experiences within the allowed use cases.

A BIN, or bank identification number, is the first several digits of a card number. It tells you what a BIN is before you know anything about the cardholder. VBASS attaches attributes to that BIN, so you can read risk signals on the card before you authorize the sale.

The attributes Visa shares include "Account Funding Source (credit, debit or prepaid), Product Platform (consumer vs. commercial), Issuer country, Issuer Name and more."

Those signals feed your fraud rules or checkout logic. That's how you avoid a false decline or flag a risky card.

VBASS describes the BIN, not the buyer. Two cardholders on the same BIN get back the exact same VBASS data. The service tells you where the card came from, but nothing about who is holding it.

If you only need the basic details on a card number, our free BIN lookup tool does that without any registration. VBASS goes further and adds the risk attributes a lookup tool doesn't carry.

How does VBASS work?

VBASS works by matching a transaction's BIN against Visa's attribute database at or before authorization, then returning the attribute set your access level covers. The match runs through whichever access method you use, either a direct API call or an indirect feed from an acquirer.

Once the attributes come back, your own fraud engine or checkout logic applies its own rules to the data. So the same VBASS response can trigger a decline at one merchant and a step-up prompt at another.

The timing is what makes it useful.

Because the attributes are keyed to the BIN, you can read them the moment a card number enters checkout, before the transaction goes for authorization. That's earlier than any signal tied to the charge, which exists only once the charge is submitted.

Reading the card early gives you room to act. You can decline a high-risk card, ask for extra verification, or send the sale through a stricter path. All of that happens before the authorization request leaves your system.

That split matters, because VBASS only returns the data and leaves the approve-or-decline call to you. A merchant with no downstream rules engine gets attribute data and no automated action to show for it.

VBASS data levels

VBASS comes in three access levels, Basic, Advanced, and Complete, that differ by the number and type of BIN attributes included. Each level up adds more attributes. Visa publishes the specific list for each level in the Visa Developer Center, but its public product page leaves those details out.

The three levels, in order of depth, break down as follows.

1. Basic Level

Basic is the entry level, covering the smallest set of BIN attributes VBASS offers. It reads core signals like funding source, but you get fewer fields than the levels above it.

2. Advanced Level

Advanced widens the set, adding attribute types Basic leaves out. A merchant who needs more than the core signals, but not the full catalog, sits here.

3. Complete Level

Complete carries the full attribute set, so you get the widest range of fields VBASS shares. It suits a merchant running detailed BIN-based fraud rules that draw on many signals at once.

VBASS delivery options, update frequency, and integration

VBASS attribute tables arrive as a periodic feed that you refresh on a schedule, and Visa recommends refreshing them at least every two weeks. Visa's own guidance is to "update their tables daily or weekly, but at a minimum at least every two weeks."

The feed goes into whatever system you already run for BIN-based routing or fraud rules. That could be a processor's fraud engine, an in-house risk system, or a third-party tool. So the integration work depends on that system. VBASS only supplies the feed.

Refresh cadence changes what you catch. Refresh weekly and you pick up a BIN's updated risk attributes, like a funding-source or issuer change. That's up to 7 days sooner than a merchant who waits the full two weeks.

Stretch the gap and you're working from stale data. At the two-week minimum, you screen live transactions against attributes that can be two weeks old. That's the trade-off for a lighter update schedule.

How do you access and implement VBASS?

You access VBASS one of two ways, a direct connection to Visa's own APIs, or an indirect feed passed through an acquirer or acquirer-sponsored third party.

Which one fits depends on your build. You either build against Visa directly or let a partner handle the connection.

Direct Access

Direct access means you connect straight to Visa's VBASS APIs through the Visa Developer Center. Visa describes it as "Merchants, acquirers, issuers, and third parties connect directly to the VBASS APIs." The path gives you the most control. It also needs the most build work on your side.

Direct access uses three APIs, each for a different job. The Full BIN List returns the whole attribute table so you can load it into your own system. The Single BIN Lookup checks one BIN at a time. The Issuer API serves issuer-side attribute needs.

Which one you build against depends on how you screen. A merchant applying rules across every transaction usually loads the full list on a schedule. One checking edge cases reaches for the single lookup.

Indirect Access

Indirect access means the attribute data comes to you through a partner instead of Visa. You "receive the BIN Attributes from an acquirer or an acquirer sponsored third party." The partner carries the Visa connection and you consume their feed.

It's the lighter lift when you'd rather not build against Visa's APIs.

VBASS pricing

VBASS is a paid service, and Visa requires every recipient of BIN attribute data to be registered and billable, with limited exceptions. Visa states that all recipients of the BIN Attribute data must "be registered and billable for the service," then notes that "some exceptions do exist."

Registration and billing run through whichever access path you use. Direct access registers through the Visa Developer Center, and indirect access goes through your acquirer. That's why the cost varies by setup, and why there's no single published rate.

Visa's own materials list no per-tier or per-transaction price, so a specific figure isn't available to cite.

The exceptions to the billing requirement aren't spelled out on Visa's public page. If you're counting on a free tier, confirm it directly with Visa or your acquirer.

Where VBASS fits next to chargeback alerts

VBASS cuts fraud and false declines before authorization, while chargeback alerts catch the disputes that clear anyway, after the charge and before it turns into a chargeback. The two tools answer different questions at different points in the transaction lifecycle:

An alert flags a transaction a cardholder has already disputed with their bank. That gives you a short window to refund and close the complaint before it becomes a chargeback. Handle it in time and the charge never counts against your rate. VBASS offers no help here, since it scored the card at checkout and then it's done.

The alert side splits across two companies. Ethoca, owned by Mastercard, catches disputes on the Mastercard side.

On the Visa side, Verifi is Visa-owned. It runs two dispute-resolution products of its own.

RDR, or Rapid Dispute Resolution, resolves a flagged dispute automatically.

CDRN, the Cardholder Dispute Resolution Network, routes it back to you to resolve by hand.

In our dataset, Ethoca holds the largest single share of alerts with a recorded network, at 42.1%. RDR and CDRN make up the remaining 57.9% together. A merchant on VBASS alone sees none of these disputes. VBASS acts only at checkout, so it never sees a dispute that lands after the charge clears.

If you want the disputes VBASS can't catch handled before they become chargebacks, Chargeback.io's alerts cover both sides of the split.

How we sourced our data

The alert-network share figures in this article come from anonymized, aggregated alert data across merchants enrolled on the Chargeback.io platform. They reflect the disputes our own platform processed, so they are our coverage rather than an industry-wide benchmark.

We measured total alerts within each network category and report them as shares of the labeled total. The figures describe what our own platform handled, so they stay specific to the merchants we protect rather than the payments industry at large.

FAQ

Is VBASS the same as a BIN lookup tool?

No. A BIN lookup returns basic card details, while VBASS is a paid, registered Visa program sharing a wider set of risk attributes. A free lookup answers "what card is this," and VBASS answers "what risk comes with this BIN."

Do I need VBASS if I already use chargeback alerts?

They do different jobs, so most merchants benefit from both. VBASS screens risk before authorization, and alerts catch disputes on transactions that already cleared.

Can a small merchant get VBASS, or only large acquirers?

A small merchant can get VBASS, usually through indirect access. Going through an acquirer or acquirer-sponsored third party avoids the heavier path of building against Visa's APIs.

What happens if I don't refresh my VBASS data on schedule?

Your screening runs on outdated attributes. Visa's minimum is a refresh every two weeks, and past that point a card that still reads low-risk may already have changed.