A BIN attack is a card fraud method in which a criminal submits thousands of card numbers that share the same Bank Identification Number to a payment page to learn which ones are valid. The attacker guesses the remaining digits and tests each guess with a small authorization. Live numbers get collected, then sold or used for larger purchases.
The name comes from the first six to eight digits of a card, called the BIN or IIN. Those digits identify the issuing bank, the card brand, and the card type. Because they follow a pattern, a fraudster can generate large batches of candidate numbers from one BIN and test them at scale.
How a BIN Attack Works
A BIN attack runs as a loop of cheap guesses. Most of the work is automated with scripts or botnets that rotate IP addresses and card data.
- Pick a BIN range. The attacker takes a BIN from a carding forum, a leaked list, or a public pattern and builds candidate 16-digit numbers.
- Generate a valid checksum. Card numbers pass a simple math check called Luhn, so the script filters out obvious junk before it sends anything.
- Submit the numbers. Bots post the candidates to checkout pages, donation forms, or trial sign-ups, often across hundreds of merchants at once.
- Read the response. A decline code such as "insufficient funds" means the card is real. "Invalid card number" means the guess failed.
- Sell or cash out. Live numbers move into a CVV or fullz listing, or get used to buy goods that resell fast.
Why BIN Attacks Are Hard to Catch
Each attempt looks like a normal authorization to the bank, and the amounts are small. A single merchant may see only a handful of tries while the attacker spreads the load across many sites.
Charges of $0.50 to $2.00 slip past fraud rules because they resemble subscription trials or address verification pings. The pattern shows up in the aggregate, not in one transaction.
Signals That Point to a BIN Attack
- Many declines from one IP address or device fingerprint in a short window.
- Card numbers that share the same first six digits.
- Orders with mismatched billing data, or forms filled with default values.
- A spike in authorization attempts with no completed checkout.
- One email domain, one phone pattern, or one shipping address across many cards.
- Traffic from proxies, data centers, or regions far outside your customer base.
How Merchants Prevent BIN Attacks
Rate Limits and Velocity Checks
Cap authorization attempts per IP, per device, and per card inside a rolling window. A limit of three to five attempts per hour stops most automated runs before they find a live card.
Require CVV and AVS
A card verification value check adds a second secret that a generated number will not carry. Address verification adds another. Both cut the hit rate of a blind enumeration run, so the attacker burns time for fewer results.
3-D Secure and Step-Up Authentication
3-D Secure passes the risk decision to the issuer. A one-time passcode breaks the loop, because the attacker cannot answer a challenge for a card they do not control.
Bot Detection and Fraud Scoring
Device fingerprinting, CAPTCHA on high-risk flows, and machine learning models flag batches that share behavior. Static rules miss slow attacks, so account-level and device-level scoring matters.
Watch Your Decline Codes
Issuers return different codes for a bad number versus a good number with no funds. Log those codes and alert when one endpoint collects a large share of "insufficient funds" declines. That signal arrives weeks before the chargebacks do.
What Issuers and Card Networks Do
Issuers run their own velocity checks and can block a BIN range at the network level when attack volume spikes. Card networks publish rules on authorization attempt limits and merchant monitoring programs.
Visa and Mastercard both treat merchant card testing as a compliance issue. Repeated failure to control it can lead to fines or loss of card acceptance rights.
FAQ
Is a BIN attack the same as card cracking?
They overlap. Card cracking is the broad practice of guessing card data. A BIN attack is one method inside it, aimed at a specific BIN range.
Does a BIN attack steal cardholder data?
No. The attacker starts with data that leaked elsewhere, or with pure guesses. The attack confirms which numbers are live. It does not break into your database.
How much does a BIN attack cost a merchant?
Costs come from chargebacks, interchange penalties, lost inventory, and fraud tooling. Test charges that never ship still create authorization fees and can push a merchant into a card network monitoring program.
Can a small site be a target?
Yes. Attackers scan for weak checkout forms, and a store with no rate limits is an easy test bed. Volume matters less than how simple the form is to automate.
Key Takeaways
- BIN attacks guess card numbers, not passwords, and they run at machine speed.
- Small test charges and shared BIN prefixes are the clearest warning signs.
- Rate limits, CVV checks, and 3-D Secure remove most of the value from an enumeration run.
- Log declines by code and by endpoint so you see the pattern before chargebacks land.