BIN Attack Example: How Card Testing Shows Up in Your Orders

The short answer

A BIN attack is card testing aimed at one card range. The BIN, the first six to eight digits of a card number, tells you which bank issued the card and what kind of card it is. It does not identify a person. An attacker who knows a BIN knows which numbers can exist, so the rest is volume: generate candidates, push them through a live checkout, keep whatever gets approved, and spend the survivors somewhere else before the issuer shuts them down.

more on this topic

A worked example from a fraud queue

Picture a store selling gift cards and license keys. One Tuesday the queue fills with orders that look like siblings. A $1.00 or $2.00 item, one per order, roughly 300 of them between 02:10 and 03:40. The card numbers differ, but they share the same first six digits. About 12 percent approve. The rest come back as "do not honor," which is exactly the signal the attacker wants, since it separates live numbers from dead ones.

bin attack example

The same handful of IP addresses appears behind a rotating proxy pool, with one device fingerprint repeated across most of the orders. The email addresses sit on three disposable domains, all with random eight-character local parts. The shipping field is blank because the product is digital and nothing gets mailed. CVV checks pass on the approved orders, which tells you the numbers arrived with their security codes attached rather than being generated from math alone.

Bin Attack Tool

Why the pattern keeps repeating across stores

Digital goods are the target of choice. Delivery is instant, there is no address to verify, and the resale market is deep. Attackers run many merchants in parallel because each merchant only sees its own slice of the traffic. A hundred attempts against one store looks like noise. A thousand gets blocked in an hour.

There is a second reason for the speed. Tested numbers have a shelf life measured in hours. Issuers kill them fast once the pattern is clear, so the attacker's incentive is to burn through a range quickly and then pick a fresh BIN. That urgency is what leaves the fingerprint described above.

What I watch in the data

1. Decline rate per BIN. A jump from a normal 5 to 10 percent up to 60 percent or higher on one range is the clearest tell.
2. Authorization velocity. Count attempts per BIN per hour, not just per card.
3. Ticket size clustering. Dozens of orders at the same odd low price point within minutes.
4. BIN diversity per IP or device. One visitor touching twenty different card ranges is not shopping.
5. CVV and AVS mismatch ratio, tracked separately. A spike in CVV failures with clean AVS points at generated numbers. Clean CVV with broken AVS points at something else.

Controls that cut it off

• Require CVV2 on every card-not-present transaction. You cannot store it after authorization, but you can demand it at checkout, and that alone kills most raw-number testing.
• Run AVS on anything physical, and reject mismatches on high-risk orders rather than flagging them for later.
• Put 3-D Secure in front of high-risk segments such as digital delivery and first-time buyers from new devices.
• Rate limit by IP, device, email domain, and BIN. Limits per card number are useless against this attack.
• Block disposable email domains and free VoIP numbers at checkout, and require a phone match for digital goods.
• Watch authorization attempts under $2. Many processors let you auto-void those instead of settling them.
• Talk to your acquirer. They see the same BIN hit other merchants and can add you to a shared alert list.

What it costs when it lands

Card testing is cheap to run and expensive to absorb. You eat the chargebacks on approved orders, you pay scheme monitoring fees once your ratio drifts, and a bad month can put you into a chargeback program that takes a year to climb out of. The fraud losses are usually the smaller number. The processing consequences are the part that hurts.

Distinctions worth keeping straight

A BIN attack is not the same as a data breach or a stolen-card spree. Stolen cards arrive one at a time tied to real people. BIN attacks arrive as a statistical cluster tied to one range. Card enumeration, where someone probes a site to learn which numbers are valid, overlaps heavily and often shows up in the same logs. Treat them as one family of behavior and monitor accordingly.