A bin lookup test is a check that takes the first six to eight digits of a payment card, known as the bank identification number or BIN, and matches them against a database or API to confirm the issuing bank, card brand, card type, and issuing country. It answers one narrow question fast: does this number range belong to a real, identifiable issuer, and what kind of card is it?
What a BIN lookup test returns
A lookup returns attributes tied to a number range, not to an individual cardholder. Common fields include:
- Card brand such as Visa, Mastercard, American Express, or Discover
- Issuing bank or financial institution
- Card type: credit, debit, prepaid, or charge
- Card level, for example classic, gold, platinum, or commercial
- Issuing country, and sometimes the region
- Whether the range is still active
It does not return the cardholder name, the full account number, the expiry date, or the security code.
How the test works
- Capture the leading digits of the card. The first digit is the major industry identifier and the following digits point to the issuer.
- Normalize the input by stripping spaces and dashes.
- Send the prefix to a BIN database or API.
- Compare the returned attributes against what the checkout expects.
- Apply a rule: allow, send to review, or decline.
Why merchants and processors run BIN lookup tests
- Routing: send the transaction to the right network and apply the correct interchange rate.
- Currency and locale: show the right currency or local payment method.
- Fraud screening: flag a mismatch between the card country and the billing or IP country.
- Payment method display: hide debit options where the processor does not support them.
- Data quality: catch typos before an authorization request is submitted.
What a BIN lookup test cannot do
It cannot confirm that a card is open, funded, or authorized. Only an authorization request through the card network does that. A valid BIN range says nothing about the specific account behind it. People who use BIN data to generate and test card numbers rely on the payment gateway to reveal which guesses worked, and that activity is card fraud, which is illegal in the United States and most other jurisdictions.
Accuracy limits to plan for
BIN data changes over time. Issuers merge, card portfolios get sold, and new ranges are allocated, so a database that is months out of date will return stale bank names or the wrong card type. Card brands have also expanded some ranges from six digits to eight, meaning tools that read only the first six digits can misclassify newer cards. Check how often a provider refreshes its data before you build a decision rule around it.
Best practices
- Treat BIN data as one signal among several, not as a verdict on its own.
- Store full card numbers only when there is a documented business need and PCI DSS controls are in place.
- Log lookup results with timestamps so rules can be tuned later.
- Review decline rules on a schedule, since issuer data shifts.