The bank identification number, or BIN, is the opening sequence of digits on a payment card, and it encodes five things about the card: the financial institution that issued it, the card network it runs on, whether it is credit, debit, or prepaid, the product tier within that category, and the country where the issuing bank is registered. Payment processors read those digits in milliseconds to route the transaction, apply the right fees, and screen for fraud. Under ISO/IEC 7812, the BIN is expanding from six digits to eight to make room for the growing number of issuers worldwide.1International Organization for Standardization. Changes to the Issuer Identification Number (IIN) Standard
The Issuing Bank or Credit Union
The BIN’s most fundamental job is pointing to the specific bank, credit union, or fintech that issued the card. When you tap, swipe, or type the number online, the payment processor reads the BIN first and uses it as a routing instruction, sending the authorization request to your bank. That request asks a simple question: does this account exist, and does it have the funds or available credit for this purchase? Without a valid BIN linking the card to a recognized issuer, the transaction dies before it starts.
This routing function doubles as a first-pass fraud filter. If the BIN doesn’t match any known issuer in the processor’s database, the transaction is automatically declined. Merchants and their processors keep BIN tables updated so that newly issued ranges are recognized promptly, and payment networks recommend refreshing those records at least monthly. An outdated table causes legitimate cards to be rejected at checkout.
The Card Network
The first digit of a card number is called the Major Industry Identifier (MII), and it slots the card into a broad industry category. ISO assigns ten possible values, though consumer cards fall into just a few:2Pay.UK. Issuer Identification Number Card Issuers – Current Procedures
- 1 and 2: airlines
- 3: travel and entertainment, including American Express and Diners Club
- 4 and 5: banking and financial services
- 6: merchandising and banking
- 7: petroleum
- 8: telecommunications and healthcare
- 9: national standards bodies
In practice the MII combined with the digits that follow narrows the identification to a specific network brand. Cards starting with 4 belong to Visa. Cards starting with 5, and certain ranges beginning with 2, run on Mastercard. American Express cards start with 3, and Discover cards start with 6. Each network operates its own clearing and settlement system with its own rules, so a Visa transaction travels through Visa’s rails while a Mastercard transaction follows a completely separate path.3Federal Reserve Bank of Philadelphia. Clearing and Settlement of Interbank Card Transactions Recognizing the network from the BIN puts the transaction on the correct system from the start.
Card Type and Product Tier
The BIN also reveals the kind of card you’re holding. Visa’s BIN Attribute Sharing Service, for example, gives merchants the account funding source (credit, debit, or prepaid), the product platform (consumer or commercial), and product identifiers that indicate the tier of the card.4Visa. Visa BIN Attribute Sharing Service A merchant’s system can distinguish a basic consumer debit card from a corporate purchasing card before the transaction ever reaches the bank for approval.
These distinctions carry real financial consequences. Interchange rates vary widely by card type. A regulated debit card swiped in person might carry a rate as low as 0.05% plus $0.22 per transaction, while a premium rewards credit card can reach 2.30% plus $0.10. The average interchange rate across all credit card transactions runs about 1.81%, compared with roughly 0.3% for debit. Merchants don’t set these rates or pay them directly; they pay a merchant discount to their acquiring bank that bakes in the interchange cost along with other processing services.5Visa. Visa USA Interchange Reimbursement Fees The BIN is what tells the system which rate schedule applies.
Commercial and corporate cards typically carry higher interchange rates than personal consumer cards, and rewards cards cost more to process than no-frills products. That’s why some merchants offer discounts for debit payments or steer customers toward certain methods. Their system already knows what kind of card is being presented before checkout is complete.
Country of Issuance
The BIN identifies the country where the issuing bank is registered and regulated. This data point sits alongside issuer name, card type, and billing currency in the attributes networks make available to merchants and processors.6Visa. Visa BIN Attribute Sharing Service – Developer It looks like a minor detail and triggers several important downstream effects.
Fraud detection systems compare the card’s issuing country against the buyer’s IP address, shipping address, and transaction location. A card issued in Brazil, used for a large online purchase shipped to Romania, placed from an IP address in Vietnam, will raise flags. Geographic mismatches are one of the most common signals automated fraud systems use to intercept stolen card data.
Country of issuance also determines whether the merchant pays cross-border fees. When a card was issued in a different country than where the merchant’s acquiring bank sits, card networks add an assessment fee on top of the standard interchange rate. These fees vary by network and currency but generally range from about 0.6% to over 1% of the transaction. For merchants with significant international customers, that cost adds up quickly and shapes pricing strategy.
What the BIN Does Not Reveal
The limits are worth being clear about. The BIN identifies the institution, network, card type, and country. It does not reveal your name, account balance, transaction history, credit limit, or any other personal information. The digits after the BIN make up the individual account identifier, which is unique to your account, and a final check digit used to catch typos through a mathematical formula. The BIN is the card’s institutional fingerprint, not your personal one.
This matters because BIN data is semi-public. Merchants see it on every transaction, and BIN lookup tools are freely available online. Knowing a card’s BIN tells you the issuing bank and card type; it gives you no access to anyone’s account. The security-sensitive part of a card is the combination of the full number, expiration date, and security code, not the BIN alone. One consequence: because the BIN is the known portion of the number, fraudsters use it as the starting point for “BIN attacks,” generating plausible full card numbers with the Luhn algorithm and testing them against weakly protected sites. That’s a merchant-side security problem rather than something the BIN itself exposes about you.
The Shift From Six to Eight Digits
For decades the BIN was six digits long. As more banks, fintechs, and digital wallet providers entered the market globally, the pool of available six-digit combinations started running thin. ISO revised ISO/IEC 7812 to expand the identifier to eight digits, multiplying the number of available issuer codes by a factor of 100.1International Organization for Standardization. Changes to the Issuer Identification Number (IIN) Standard
The transition has been gradual rather than a hard cutover. Major card networks began issuing eight-digit BINs and updating their systems years ago, but many merchants, processors, and adjacent industries are still adapting. The pharmacy sector, for example, has set a 2028 target for completing its migration. If your business processes card payments, any system parsing card numbers should already handle both six-digit and eight-digit BIN formats. Hardcoding a six-digit assumption into payment logic will eventually produce authorization failures as more issuers adopt the longer format.
The eight-digit expansion also affects how merchants display and store card numbers under PCI DSS. The traditional rule allowed showing the first six and last four digits of a 16-digit card. Visa’s guidance now permits retaining the first eight plus any other four, provided at least four digits are removed from the stored or displayed number.7Visa. 8-Digit BIN – PCI Security Requirements The BIN digits themselves are treated as low-sensitivity precisely because they identify the institution, not the individual account.