BIN, bank identification number, now often called the IIN for issuer identification number, is the opening run of digits on a payment card: the first digit names the industry and network family, and the first six to eight digits identify the issuing bank, the card product, whether it is credit, debit, or prepaid, and the country of issue. Checkout systems use it for three jobs that have nothing to do with each other. Error catching: a card number whose BIN belongs to no live issuer range is mistyped, and the shopper can be told now rather than after a decline. Interface help: the BIN names the network before the shopper finishes typing, which drives the card brand display and the formatting of the remaining digits. Risk screening: a prepaid BIN on a subscription signup, a card issued in a country unrelated to the billing and shipping picture, a BIN range associated with a recently breached batch, each one a signal to weigh, never a verdict on its own. The gateway will run its own checks. BIN validation is what lets the store run its checks first, while the shopper is still there to fix the honest errors.
Eight digits is the new reading length
The industry moved from six digit to eight digit BINs as the identifier standard, with the major networks expanding assignment at the eight digit level, which means a lookup table or service built on six digits now returns the issuer at a coarser grain than the card actually carries: right network, wrong product, a debit card read as the bank's generic range. If your checkout still keys BIN logic at six digits, audit what it decides. Formatting and brand display survive the coarser read. Product level decisions, prepaid detection, commercial card handling for invoicing and surcharging rules where they apply, do not. Update the BIN data source on a schedule, too, because issuer ranges are reassigned as banks merge and portfolios are sold, and a stale table misidentifies cards with total confidence.
Luhn is the partner check and it is not a validity check. The Luhn checksum catches most typing errors in the full number, transposed and mistyped digits, and it passes on numbers that were never issued. Luhn plus BIN existence is the pair that means the number is well formed and belongs to a live range. Neither says the account is open, funded, or the shopper's, which is what the authorization is for. Forms that present a Luhn pass as the card being valid teach support teams to debug declines in the wrong place.
Related reading on this site: Home and Form Abuse: Attacks That Pass Every Validation Check cover the neighbouring problems in more depth.
Prepaid, commercial, and the subscription problem
Card type from the BIN is merchandising information as much as risk information. A prepaid card cannot carry a recurring billing relationship reliably, because the balance is finite and the card is often unreloadable or anonymous, so a subscription checkout that detects a prepaid BIN should say so at entry and steer the shopper to another method, rather than discovering it at the first failed rebill, when the customer is annoyed and the dunning sequence starts from behind. Commercial cards flag a business purchase, which some stores route to invoicing options and tax handling the consumer flow does not offer. The shopper experiences BIN reading done well as a checkout that seems to understand the card in their hand. Done badly, as a decline with no reason, it is a story they tell about your store specifically.
Hold the line on signals versus verdicts. A foreign issued card with a domestic billing address is a student, a traveler, an expat, and occasionally a fraudster, in proportions no honest risk manager will quote you without your own data. Score it, combine it, step up verification when the total picture warrants it. A hard rule against any single BIN trait is a decision to refuse a slice of honest trade in exchange for a feeling of rigor.
Frequently asked questions
What is a BIN number on a card?
The bank identification number is the first six to eight digits of a card number. It identifies the card network, the issuing bank, the product type such as credit, debit, or prepaid, and the country of issue. The standard has expanded from six to eight digits.
What is the difference between a BIN check and a Luhn check?
A BIN check confirms the number's opening digits belong to a live issuer range and reveals card type and origin. The Luhn checksum verifies the full number's internal arithmetic and catches most typing errors. A number can pass Luhn without ever having been issued.
Why does a subscription checkout care about prepaid cards?
Prepaid cards have finite, sometimes anonymous balances, so recurring billing fails unpredictably at rebill time. Detecting a prepaid BIN at entry lets the checkout steer the shopper to a durable payment method before the relationship starts failing.
Should a store decline cards based on BIN country?
Not on that signal alone. A card issued in a different country from the billing picture has many honest explanations. BIN country belongs in a combined risk score that can trigger step up verification, not as a standalone refusal rule.