{"id":4642,"date":"2023-02-09T11:33:25","date_gmt":"2023-02-09T11:33:25","guid":{"rendered":"https:\/\/ccbill.com\/kb\/?p=4642"},"modified":"2023-03-06T09:29:55","modified_gmt":"2023-03-06T09:29:55","slug":"bin-attack","status":"publish","type":"post","link":"https:\/\/ccbill.com\/kb\/bin-attack","title":{"rendered":"BIN Attack: What Is It and How to Protect Your Business?"},"content":{"rendered":"\n

Introduction<\/p>\n\n\n\n

To protect their customers, merchants need to implement robust fraud prevention policies<\/a>, invest in fraud detection tools, and learn about different types of payment fraud<\/a>.<\/p>\n\n\n\n

A particularly dangerous type of fraud is the BIN attack. It involves the use of bank identification numbers (BIN) and computer-generated number sequences to discover valid payment card numbers.<\/p>\n\n\n\n

Find out how BIN attacks work and take the necessary steps to secure your business.<\/p>\n\n\n

\n
\"BIN<\/figure><\/div>\n\n\n
\n\n\n\n

What Is a BIN Attack?<\/h2>\n\n\n\n

A Bank Identification Number (BIN) is the first 4-8 digits of a payment card number. It identifies the card issuer (i.e., financial institution, bank), card network, and the type of card being used - a credit or debit card<\/a>.<\/p>\n\n\n\n

BINs are publicly available and are easily obtained. During a BIN attack, an attacker takes the BIN of an issuer and uses computer software to generate the remaining digits of the cardholder\u2019s card number.<\/p>\n\n\n

\n
\"BIN<\/figure><\/div>\n\n\n

Once the attacker generates thousands of card numbers, they test them on actual online stores to determine which card numbers<\/a> correspond to existing, valid cards.<\/p>\n\n\n\n

How Does a BIN Attack Work?<\/h2>\n\n\n\n

A BIN attack does not target a specific cardholder but tries to identify as many valid card numbers issued by the same issuer as possible.<\/p>\n\n\n\n

A BIN attack typically follows these steps:<\/p>\n\n\n\n

    \n
  1. The fraudster targets a specific card issuer and obtains their 4 to 8-digit BIN.<\/li>\n\n\n\n
  2. They utilize special software to generate a vast array of potentially valid card numbers.<\/li>\n\n\n\n
  3. Fraudsters then test the generated numbers by attempting small transactions at legitimate businesses to determine if a credit card number is valid. Sometimes attackers use merchant accounts they create specifically for this purpose.<\/li>\n\n\n\n
  4. They use the card numbers identified as genuine to make high-value unauthorized purchases.<\/li>\n<\/ol>\n\n\n
    \n
    \"An<\/figure><\/div>\n\n\n
    \n\n\n\n
    \n\n\n\n

    Note<\/strong>: It is not uncommon for card numbers attained from BIN attacks to be sold on the dark web and used in other types of payment fraud such as phishing, identity theft, and account takeover<\/a>.<\/p>\n\n\n\n

    \n\n\n\n
    \n\n\n\n

    Who Are the Targets of BIN Attacks?<\/h2>\n\n\n\n

    A BIN attack targets the cardholder\u2019s card number. The attacker makes countless attempts with different card number sequences until they succeed in initiating a transaction.<\/p>\n\n\n\n

    This type of attack targets participants in the payment process, including:<\/p>\n\n\n\n