A bank identification number, or BIN, is the opening sequence of digits on a payment card that identifies the institution that issued it. Under the current ISO/IEC 7812 standard, new BINs are eight digits long, though millions of legacy six-digit BINs remain in use. Those digits sit at the front of the full card number and are the first thing every terminal, gateway, and fraud system reads. They drive routing, interchange pricing, and risk screening on billions of transactions a day.
What the BIN Encodes
The BIN follows the structure defined in ISO/IEC 7812-1. The first digit historically identifies the card’s industry category: 4 signals Visa, 5 signals Mastercard, 3 identifies American Express and Diners Club, and 6 marks Discover. The remaining digits in the BIN sequence identify the specific issuing bank or financial institution, as assigned by the registration authority.
Beyond the issuer’s identity, the BIN also encodes whether the card is a credit, debit, or prepaid product and the country where the issuer operates. That matters more than most cardholders realize. It determines which processing network handles the transaction, what interchange rate the merchant pays, and whether the merchant is even allowed to add a surcharge. A prepaid card from a small credit union and a premium rewards card from a multinational bank look identical at the counter, but their BINs tell the payment system they are fundamentally different products.
Where the BIN Sits on the Card
The BIN occupies the leading position within the Primary Account Number (PAN), the full numeric string printed, embossed, or displayed digitally on the card. PANs are typically 16 digits but can range from 12 to 19 depending on the issuer and network. Everything between the BIN and the final check digit identifies the individual cardholder’s account. Whether the card is embossed plastic, flat-printed, or a virtual number inside a wallet app, the BIN always comes first, so both machines and people can identify the issuer at a glance.
How the BIN Routes a Transaction
When a card is tapped, swiped, or entered online, the merchant’s point-of-sale system reads the BIN before anything else happens. Those leading digits tell the payment gateway which card network should receive the authorization request. The gateway sends the data through the appropriate network (Visa, Mastercard, or another processor), which then forwards it to the issuing bank for approval.
If the BIN identifies a debit card, the processor routes the request through a network capable of real-time fund verification. If the BIN’s country code doesn’t match the merchant’s location, the system triggers currency conversion. Sending a transaction to the wrong network or issuer would cause an immediate processing failure, so the BIN functions as the address label that keeps the entire system running. This all happens in fractions of a second.
How the BIN Sets Interchange Fees
Merchants pay interchange fees on every card transaction, and the BIN directly determines the rate. Credit card interchange varies significantly by card program. Mastercard’s published 2024–2025 rate schedule shows credit interchange ranging from about 1.65% for certain optimized transactions up to 3.15% plus $0.10 for standard credit purchases, with premium rewards cards generally commanding higher rates than basic cards.1Mastercard. Mastercard 2024-2025 U.S. Region Interchange Programs and Rates
Debit interchange is a different story. Under the Durbin Amendment, codified at 15 U.S.C. § 1693o-2, issuers with more than $10 billion in assets face a federal cap on debit interchange fees. The Federal Reserve’s Regulation II sets that cap at $0.21 plus 0.05% of the transaction value, with a possible $0.01 fraud-prevention adjustment for eligible issuers.2Federal Reserve. Average Debit Card Interchange Fee by Payment Card Network Smaller issuers are exempt from the cap and typically charge higher debit interchange rates. Which category a given card falls into is something the merchant learns from the BIN.
The Durbin Amendment also gives merchants routing rights. Federal law prohibits issuers and card networks from restricting debit transactions to a single network. Every debit card must be enabled on at least two unaffiliated payment networks, and merchants can choose which of those networks processes any given debit transaction.3Office of the Law Revision Counsel. 15 U.S. Code 1693o-2 – Reasonable Fees and Rules for Payment Card Transactions As of July 2023, that routing freedom explicitly extends to online debit transactions, not just in-store purchases.4Federal Reserve. Regulation II Debit Card Interchange Fees and Routing – A Small Entity Compliance Guide The BIN is the piece of data that makes routing work, because it tells the merchant’s system what card type is present and which networks are available.
Surcharges Depend on the BIN
Card network rules prohibit merchants from adding surcharges to debit and prepaid card transactions. Only credit cards can be surcharged. The BIN is how the merchant’s terminal tells one from the other. When a debit cardholder selects “credit” at the terminal, they are choosing a signature-based transaction rather than a PIN-based one, but the card itself is still a debit card as identified by the BIN, and surcharging it is still prohibited.5Visa. U.S. Merchant Surcharge Q and A
The BIN in Fraud Screening
BIN data is one of the first fraud signals a merchant can check on a card-not-present transaction. If the BIN says the card was issued in one country but the shipping address is in another, that geographic mismatch is worth investigating before completing the sale. Merchants also use BIN lookups to spot prepaid cards being used for recurring payments or high-value purchases, patterns that sometimes correlate with fraud.
The same data helps criminals. In a BIN attack, fraudsters start with a known valid BIN and systematically generate potential card numbers, testing them with small transactions to find active accounts. Once they identify a working number, they use it for larger fraudulent purchases or sell it. These attacks tend to target merchants that process high volumes of low-dollar transactions, where small test charges blend into normal activity. Defenses include velocity monitoring for bursts of small transactions and additional authentication steps for online purchases.
Who Assigns BINs
The ISO/IEC 7812 standard governs how BINs are structured and assigned. The American Bankers Association has served as the registration authority for the standard since its inception in the early 1970s, with CUSIP Global Services acting as its service agent to handle day-to-day assignments.6American Bankers Association. ISO/IEC 7812 Issuer Identification Numbers The centralized registry ensures no two institutions receive the same BIN sequence. Card networks like Visa and Mastercard are governed by the ISO standard and enforce its requirements through their own operating rules.7Visa. Preparing for Eight-Digit BINs – What Merchants Need to Know
Fintech companies that issue payment cards but aren’t chartered banks usually operate under a BIN sponsorship arrangement. A licensed bank shares its BIN, allowing the fintech to issue cards under the bank’s regulatory umbrella. Sponsorship agreements impose substantial obligations on the fintech, including compliance with card network rules, adherence to federal information security standards, merchant underwriting responsibilities, and indemnification of the sponsor bank for losses stemming from fraud or chargebacks.8U.S. Securities and Exchange Commission. Sponsor Bank Agreement (The Bancorp Bank and Heartland Payment Systems, Inc.) If the fintech violates card network rules and triggers fines from Visa or Mastercard, the fintech, not the sponsor bank, bears that cost.
How BINs Can Be Stored and Displayed
The Payment Card Industry Data Security Standard (PCI DSS) governs how merchants and processors handle card data, including the BIN. Truncation is the primary safeguard: merchants can display at most the first six and last four digits of a PAN on receipts and screens, rendering the full account number unreadable. That first-six/last-four format remains the common standard accepted by all major card networks.9PCI Security Standards Council. 8-Digit BINs and PCI DSS – What You Need to Know
The Move From Six-Digit to Eight-Digit BINs
In 2017, ISO updated the 7812 standard to expand BINs from six digits to eight, driven by the simple problem that the world was running out of six-digit sequences to assign to new issuers. Visa endorsed the new standard and set April 2022 as its effective date. Since then, Visa has only assigned eight-digit BINs for new products and services.10Visa. The 8-Digit BIN Expansion – Visa Existing six-digit BINs continue to function and will remain in the ecosystem for the foreseeable future, so the transition is gradual rather than a hard cutover.
For merchants, the migration matters. Systems that still hard-code a six-digit BIN length risk several operational failures as eight-digit BINs become more prevalent:
- Incorrect routing, when transactions are sent to the wrong network or processor because only six digits were read.
- Unauthorized cashback, provided to cardholders whose card type doesn’t qualify because the system misidentified the BIN.
- Broken loyalty programs, where transactions cannot be matched to the correct benefits program and cardholders miss rewards or pay higher rates.
- Reporting errors that distort point-of-sale activity data and business analytics.
Visa’s guidance notes that these failure points don’t all appear overnight; they ramp up as more issuers adopt eight-digit BINs.7Visa. Preparing for Eight-Digit BINs – What Merchants Need to Know Merchants who haven’t updated their systems face an increasingly unreliable payment environment as the share of eight-digit BINs in circulation continues to grow.