What is the difference between a BIN and a PAN?
The BIN is only the first six or eight digits of a card number and identifies the issuer. The PAN (primary account number) is the full card number, up to 19 digits, including the BIN, the account number and a check digit. A PAN is cardholder data under PCI DSS, while a BIN alone is not.
In detail
The BIN is only the first six or eight digits of a card number. It identifies the issuer. The PAN (primary account number) is the full card number, up to 19 digits.
How a PAN is built
- BIN or IIN: the issuer prefix.
- Individual account number: the digits that identify the cardholder’s account at that issuer.
- Check digit: the last digit, calculated with the Luhn formula to catch typing errors.
Why the difference matters
A BIN alone does not identify a person, so PSPs can store it, analyze it and use it in routing and reporting. A PAN is cardholder data under PCI DSS: it must be encrypted, tokenized, masked or truncated. Many operators reduce their exposure by replacing PANs with tokens, as explained in the #PayDecoding on network tokens.
Under PCI DSS, the first six and last four digits are the common format for displaying a masked card number. See the full comparison table in What Is a BIN?.