How a BIN attack works
The BIN identifies the issuer, and the last digit of a card number is a checksum, so only the digits between have to be guessed. A script submits thousands of combinations of number, expiry date and security code through a checkout, a donation page or an API. Approved attempts reveal live cards, which are used elsewhere or sold.
Visa's rules call this an enumeration attack: the systematic submission of card-absent transactions to obtain or validate payment information.
Signs of a BIN attack, and defences
- A burst of low-value or zero-value authorisations
- Sequential card numbers on one BIN
- A sharp rise in declines for a wrong expiry date or security code
- Many cards from one device, IP address or session
The usual defences are rate limits per device and per BIN, bot detection or a challenge on the payment form, and blocking after repeated declines.
Why a BIN attack matters to a gateway or an issuer
The merchant pays for every authorisation attempt and later meets disputes on the cards that worked. Visa counts enumeration in its acquirer monitoring programme: its 2025 fact sheet names two thresholds for a merchant, an enumeration ratio of 2,000 basis points (20% of authorisation attempts) and 300,000 enumerated transactions in a month.
An issuer under attack sees one BIN hit across many merchants, and usually responds by declining the pattern and reissuing the cards that were confirmed.
BIN attack or card testing?
- Card testing
- Checks card details that were stolen whole, to see which still work. A BIN attack starts with no stolen cards and generates the numbers.
- Card skimming
- Copies the data of real cards as they are used. A BIN attack needs no contact with the card or its holder.
Where a BIN attack shows up in a platform
Modules that do the work
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- Card issuingVirtual and physical cards, wallets and controls, on the issuer processor you choose.
Platforms that need it
Guides that go deeper
Where it is written
The laws and standards this page's facts come from.
- Visa Core Rules and Visa Product and Service Rules, 18 April 2026 (Visa)
- Visa Acquirer Monitoring Program fact sheet, 2025 (Visa)
General information, not legal advice: what applies to you depends on your services and your market.