Glossary
What is a BIN attack?
A BIN attack is a fraud technique in which an attacker takes the first digits of a card number, the bank identification number (BIN), and generates the remaining digits to guess working card numbers. The guesses are tested with many small payments at an online checkout until some succeed. The practice is also called card testing or card enumeration.
How it works
The first six to eight digits of a card number identify the issuing bank and card product. The rest follows a public checksum rule, so a script can produce many numbers that look valid. It then tries them against a merchant with a low-value purchase or a card-add form. Any that are approved are marked as live cards and used or sold.
The merchant pays for this. Each attempt can carry a processor fee, and a flood of declines hurts the merchant’s approval rate and standing with the processor.
Why it matters to an online business
- Processing fees pile up on thousands of failed attempts.
- A high decline rate can lead to penalties or a suspended account.
- Real customers are declined when the issuer sees suspicious activity.
- Any form that touches a card, such as a donation page or a free trial, can be used.
How businesses defend against it
- Limit payment attempts per device and per network, not only per card.
- Require a human check or a login before a card can be added.
- Block checkout from automated browsers.
- Monitor the decline rate and alert on a sudden jump.
- Use the fraud tools of your payment processor alongside your own.
Where FingerPrint Checker fits
FingerPrint Checker tags a checkout event with the device ID and signals such as bots, proxy, hosting networks and fast use from many networks, so you can see one device cycling through many cards. Your rules then cap attempts or require a human check before the next payment.
Frequently asked questions
What does BIN stand for?
Bank identification number. It is the leading digits of a card number that identify the issuer.
Is a BIN attack the same as card testing?
They are closely related. A BIN attack generates the card numbers; card testing is the act of trying them. The terms are often used together.
Can a card number checksum stop it?
No. The checksum only filters out typos. Generated numbers are built to pass it.
Try it on your own sign-up flow
Every new account gets 2,000 free checks. No card required.