BIN number explained

The long number on the front of a payment card isn’t just a random sequence, and the first six to eight digits are perhaps the most important of all. 

Known as the BIN, these digits give merchants essential information, like the card issuer and type, helping them process payments faster and fight fraud. 

But why six to eight numbers? How do BINs work? What are they used for? And how does the number of digits in the sequence affect merchants?

Below, we reveal all. 

What is a BIN number?

A Bank Identification Number (BIN) is the first six to eight digits of the Primary Account Number (PAN), the long number on a credit, debit, or prepaid card. A BIN tells merchants which bank or other financial institution issued the card.

Merchants can use BINs to match any given transaction to the corresponding issuer and identify lost or stolen cards to prevent identity theft and reduce the risk of fraud. 

Issuers can also act as BIN Sponsors, using their relationships with card schemes like Mastercard or Visa to offer fintechs access to payment processing and card management services – without the lengthy membership processes. 

How bank identification numbers work

Credit card BIN numbers can be broken down into two parts: the Major Industry Identifier (MII) and Issuer Identification Number (IIN).

The Major Industry Identifier (MII)

The first single digit is called the MII, and is used to identify the type of institution that issued the card. For example, the BIN for a card with a Visa logo on it will always start with a 4, the issuer category for banking and financial cards. Likewise, the 5 that most Mastercard cards start with also identifies it as a bank. 

In contrast, American Express BINs always start with a 3 (34 or 37 more specifically), the issuer category for travel and entertainment cards. That’s because, while it is now classed as a bank holding company, Amex has a history of providing travel services. 

The Issuer Identification Number

The remaining five to seven digits constitute the IIN, which identifies the specific bank or institution responsible for issuing the card. However, while the MII is its own unique number, it is technically part of the IIN, which is frequently used interchangeably with the BIN. 

The remainder of the PAN makes up the individual account number, which identifies the specific account that the card is tied to. 

What are BIN numbers used for?

The BIN doesn't just identify the issuer and its category; it also tells merchants the following information:

• The issuer’s address and phone number
• The card brand 
• The card level (platinum, business, etc.)
• The country where the issuer or financial institution is based
• Whether the transaction originates in the same country (important for fraud checks and fees)

This empowers the merchant in a number of ways. Perhaps most importantly, the BIN helps prevent identity theft and other fraud types by verifying cardholder and issuer details with what’s on file. 

It also allows merchants to accept multiple payment methods and improves payment processing speed by making it easy to validate customer details with the issuer. 

Impact of BINs for merchants

BINs are a vital component of successful payment processing. They give merchants accurate data to verify customers, speed up approvals, and avoid fraud. 

However, it’s only very recently that they’ve taken their present six to eight-digit form. Until 2022, BINs were commonly six numbers. But in 2017, major card brands realized that, with the proliferation of fintech companies and the growth in the number of payment cards being issued, they would eventually run out of six-digit combinations. 

As a result, the International Organization for Standardization (ISO), which is responsible for card-numbering conventions, decided to transition to eight-digit BINs to address this potential future shortage. As of April 2022, all new BINs have been issued with eight digits, though existing six-digit BINs are still valid. 

As merchants are responsible for analyzing BINs, one implication is that you may have to modify your system to accommodate the storage and masking of longer BINs. You might also have to reassess your data handling and storage practices to ensure they are compliant with the most up-to-date PCI-DSS. That means only storing the bare minimum of PAN digits that are necessary for transaction processing, minimizing the exposure of sensitive information to hackers.  

Merchants must guard against BIN attacks, where criminals attempt to use brute-force to steal card details, by using advanced fraud detection tools like Fraud Detection Pro.

Launch your card program with Checkout.com

Are you looking to start a card program? Checkout.com can help. We allow you to issue, process, and manage both virtual and physical payment card programs via our open APIs. 

Our Issuing solution helps you get your card program up and running in no time. And it combines processing, card management, compliance, and reporting in one platform – so you can launch quickly and scale with confidence. 

It also offers card design and spend control customizations (and more), so that you can promote your brand and create unique experiences that meet your customers’ needs. Whether it's debit or credit, single or multi-use, virtual or physical – we’ve got you covered. 

Security is built into every element, from 3D Secure authentication to flexible fraud rules. 

Get in touch with our team to find out more about launching a card program with Checkout.com.