A Bank Identification Number (BIN), also known as an Issuer Identification Number (IIN), is the first six to eight digits of a payment card's Primary Account Number (PAN).4 These digits identify the financial institution or organization that issued the card, such as a bank, credit union, or fintech company.7 The first digit of the BIN is called the Major Industry Identifier (MII), which indicates the industry category of the issuer—for example, 4 for banking and financial services (Visa), 5 for banking and financial services (Mastercard), and 3 for travel and entertainment (American Express).234

The remaining digits in the BIN provide specific information about the issuing institution, card type (credit, debit, prepaid), card network (Visa, Mastercard, etc.), country of issuance, and card level (e.g., standard, gold, platinum).47 This information is critical for routing transactions to the correct issuing bank, verifying card validity, and detecting fraudulent activity.25 BINs are used by merchants, payment processors, and fraud detection systems to validate transactions, prevent identity theft, and ensure secure payment processing.24

The transition from six-digit to eight-digit BINs began in April 2022, driven by the International Organization for Standardization (ISO) to accommodate the growing number of payment cards issued globally, especially by fintechs and non-bank entities.48 While older six-digit BINs remain valid, all new BINs issued since 2022 are eight digits long.4 This change requires merchants to update their systems to handle longer BINs and ensure compliance with data security standards like PCI-DSS.4

BINs are also used in BIN attacks, where fraudsters use brute-force methods to guess valid card numbers, expiry dates, and CVVs by leveraging known BINs.11 These attacks often start with small transactions to avoid detection before escalating to larger fraudulent charges.11 To combat this, merchants and card issuers use BIN databases to verify card details and flag suspicious activity.12