Bank identification number (BIN) is the first six or eight digits of a payment card number, identifying the issuing institution and card product, and every card transaction is routed, priced and risk-scored on that prefix. ISO/IEC 7812 calls it the issuer identification number (IIN), since e-money institutions, fintech programme managers and retailers issue cards too. Visa and Mastercard began assigning 8-digit ranges from April 2022, so systems reading only six digits misread issuers. A BIN lookup returns scheme, issuer, country, card type and tier, driving routing, pricing and fraud rules. Fintechs without scheme membership issue on a sponsor's BIN, and losing the sponsor means reissuing every card.
What is BIN on a card
A card's primary account number (PAN) is usually 16 digits, though it can run from 8 to 19. The bank identification number (BIN) sits at the start. The first digit is the Major Industry Identifier, and the leading ranges name the scheme: 4 for Visa, 51–55 and 2221–2720 for Mastercard, 34 and 37 for American Express. The next digits narrow it to an issuer, country and programme, such as consumer debit or corporate credit. The final digit is a Luhn check digit, and the digits in between identify the account.
What is issuer identification number
The issuer identification number (IIN) is the formal name for the same prefix in ISO/IEC 7812. So what is IIN on a card? Exactly the digits described above: a card starting 4539 12 is a Visa card, and the full IIN tells a processor which issuer and product range it belongs to.
IIN vs BIN
The difference is vocabulary, not digits. "BIN" dates from when only banks issued cards; the standard switched to "issuer" because e-money institutions, fintech programme managers, retailers and airlines now issue cards too. Schemes and fraud tools still mostly say BIN; ISO documents say IIN.
The standard also lengthened the prefix. Six-digit ranges were running out, so IINs moved to eight digits, with Visa and Mastercard assigning 8-digit ranges from April 2022. The card number did not grow: the two extra digits came out of the account identifier section. Any system parsing only the first six digits, from fraud rules to fee tables, had to be updated or it began misreading issuers.
How does BIN lookup work
Card networks distribute BIN tables to acquirers and processors, and commercial databases resell similar data. A lookup takes the first 6 or 8 digits and returns scheme, issuing institution, country, card type (credit, debit or prepaid) and product tier. Payment systems use the answer in real time:
- Routing: smart routing sends a German card to a local acquirer so the payment stays domestic.
- Pricing: a commercial credit card costs more to accept than consumer debit. Under PSD2, EEA merchants cannot surcharge consumer cards capped by the Interchange Fee Regulation, and the BIN is how they tell those apart from commercial ones.
- Risk: prepaid ranges or high-risk issuing countries trigger extra checks, and bursts of generated card numbers on one prefix signal a BIN attack.
Whose BIN the cards run on
Fintechs issuing cards without their own scheme membership run on a BIN sponsor: a licensed bank or e-money institution that holds the range, lends it to the programme and stays responsible to the scheme. For a buyer of a card issuing business, this is a central diligence point. If the BINs belong to a sponsor, the programme depends on a contract that may contain change-of-control clauses, and losing the sponsor means reissuing every card.