What Is a BIN? Bank Identification Numbers, IIN and PAN (2026)

A BIN (Bank Identification Number) is the first six or eight digits of a payment card number. It identifies the issuing bank and, through BIN tables, the card brand, product, country and type. Card networks use the BIN to route each authorization to the right issuer, while PSPs use it to price, route and screen payments.

In 2026, the BIN is no longer a six-digit afterthought. Card numbers now start with eight-digit issuer ranges, wallets and stored credentials run on token ranges, and BIN data drives routing, interchange, fraud rules and reporting. For PSPs, PayFacs and platforms, reading the first digits correctly is the cheapest optimization they have.

What is a BIN?

A BIN is the leading part of the primary account number (PAN) that identifies the institution that issued the card. The formal name is IIN, Issuer Identification Number, defined by the standard ISO/IEC 7812-1:2017, which set its length at eight digits. The industry still says “BIN” for historical reasons, when banks were the only card issuers.

The first digit is the Major Industry Identifier. In practice, card numbers starting with 4 are Visa, with 2 or 5 Mastercard, and with 3 American Express, JCB or Diners Club. Our guide to how card networks work covers the schemes behind these prefixes. The full BIN points to an issuer and, inside that issuer, to an account range with its own attributes. Related notions:

• PAN: the full card number, up to 19 digits, made of the BIN, the individual account number and a check digit.
• Issuer: the bank or licensed institution that gives out the card and approves or declines each payment.
• Account range: a slice of a BIN that schemes use to describe product, funding source and country.
• Token BIN: a range reserved for network tokens, which replace the PAN in wallets and stored credentials, as described in the EMVCo payment tokenisation guide.

Where does BIN data come from? Each card network publishes BIN or account range files to its acquirers and processors, with attributes such as product, funding source, issuer country and regulated status. Acquirers pass a subset to their PSPs, and commercial BIN databases merge several sources into one table. None of them is perfect, which is why large operators compare more than one source and refresh their tables often.

A BIN is also not a secret. It appears on receipts and in checkout fields, and it can be shared with partners for routing and reporting. What turns a BIN into sensitive data is the rest of the card number next to it.

BIN vs IIN vs PAN: what is the difference?

The BIN and the IIN are the same thing under two names, while the PAN is the whole card number that contains them.

• BIN: the industry name for the issuer prefix, six or eight digits. Not sensitive on its own.
• IIN: the ISO name for the same prefix, eight digits since ISO/IEC 7812-1:2017. Not sensitive on its own.
• PAN: the full card number, up to 19 digits: IIN, account number and check digit. It is cardholder data.
• Token BIN: the prefix of a network token that stands in for a PAN. Its length is set by the scheme, and its use is restricted to a domain.

The practical difference is compliance. A BIN alone does not identify a cardholder, so it can be stored and analyzed freely. A PAN is cardholder data under PCI DSS and must be protected, masked or truncated.

How does a BIN work?

The BIN tells every party in the chain where an authorization must go and how it should be treated. The flow is the same in card-present and card-not-present payments, but online the PSP has more time and more data to act on the BIN before the request leaves. A typical card-not-present payment looks like this:

1. Checkout: the shopper enters a card number or uses a stored credential. The merchant’s PSP reads the first digits as soon as they are typed.
2. BIN lookup: the PSP or payment gateway checks its BIN table to find the brand, issuer country, debit or credit, consumer or commercial, and sometimes the local scheme.
3. Routing decision: with that data, the PSP picks an acquirer, decides whether to trigger 3-D Secure and applies risk rules.
4. Acquirer to scheme: the acquirer sends the authorization request to the card network that owns the BIN range.
5. Scheme to issuer: the network looks up the BIN in its routing tables and forwards the request to the issuer, or to its processor.
6. Issuer decision: the issuer checks the account, the balance and its own fraud rules, then approves or declines. The answer travels back the same way.
7. After the payment: the BIN is used again for interchange qualification, clearing, reporting and dispute handling.

Two details often surprise new teams. First, the issuer never sees the PSP’s routing choices: it only sees a request coming from an acquirer. Second, the scheme routes on its own tables, not on the PSP’s. If the two disagree, for example on a newly split eight-digit range, the payment still reaches the right issuer, but the PSP may have priced or screened it as the wrong card.

BINs in numbers (2026)

A few dated figures show why the first digits matter at scale.

• 8 digits: the IIN length set by the 2017 edition of ISO/IEC 7812-1, replacing six-digit prefixes.
• April 2022: the date from which Mastercard began assigning eight-digit BINs to issuers, according to its October 2021 note on 8-digit BINs and PCI standards.
• First 8, any other 4: the maximum PAN digits Mastercard allows in truncated storage, while “first 6, last 4” remains the display maximum, per the same Mastercard note.
• Nearly 5 billion: Visa payment credentials at the end of fiscal 2025, each one starting with a BIN, according to Visa’s 2025 annual report.
• 329 billion: Visa-branded transactions processed in fiscal 2025, all routed to an issuer through their BIN, per the same report.
• 0.2% and 0.3%: the EU interchange caps for consumer debit and credit cards under the Interchange Fee Regulation (EU) 2015/751. The BIN tells a PSP which card falls under which cap.

What are the limits and risks of BIN data?

BIN data is only as good as the table behind it, and tables age fast.

• Stale tables: issuers merge, split portfolios and launch new ranges. A table refreshed once a quarter misclassifies new cards, which breaks debit-credit pricing and local routing.
• Six-digit assumptions: code, databases and risk rules written for six digits can mix two issuers that now share the same first six digits.
• Tokens: a token BIN does not always match the BIN of the underlying card. Rules built on PAN ranges can miss or misread tokenized traffic.
• Truncation and masking: keeping eight digits plus the last four is allowed for storage by some brands, but the PCI Security Standards Council notes that “first six, last four” remains the common format accepted by all payment brands.
• Co-badged cards: one card can carry two brands, such as a domestic scheme and Visa or Mastercard. The BIN alone does not settle which network must be used, and some markets give that choice to the cardholder.
• False confidence in fraud rules: blocking whole BIN ranges stops some attacks but also declines good customers of the same issuer.
• BIN attacks: fraudsters who know a valid BIN can generate card numbers and test them with small payments. The BIN itself is not the weakness, but checkout flows that allow unlimited attempts are.

The common thread is ownership. BIN data touches routing, risk, finance and compliance teams, and when nobody owns the table, each team keeps its own version.

BINs: what changes for PSPs, PayFacs and platforms

For operators that serve many merchants, the BIN is a shared input to routing, risk, pricing and reconciliation. Five areas deserve attention.

Routing

BIN attributes such as issuer country, card brand and funding type are the basis of most acquirer selection rules: domestic acquiring for domestic cards, a specialist acquirer for commercial cards, a fallback route when one issuer declines too often. In the NORBr platform, payment routing rules can be set on criteria such as card brand, card type or issuer country, and combined with multi-acquiring setups. The trade-offs are covered in the challenge of payment routing.

Onboarding and risk rules

BIN data complements merchant data. A PayFac can watch the share of foreign, prepaid or commercial cards per sub-merchant and compare it with the merchant category code (MCC) declared at onboarding. A sudden shift in BIN mix is often the first sign of a business model that changed. A local bakery that suddenly takes most of its payments on foreign commercial cards deserves a second look, long before the first dispute arrives.

Tokenization

Wallets and card-on-file programs send token BINs, not PAN BINs. Platforms need a mapping between the two, or a provider that returns the underlying card attributes with each token. Network tokenization in NORBr handles token provisioning through the schemes, which keeps BIN-based rules consistent across both credential types.

Reconciliation and reporting

Interchange and scheme fees depend on card product and region, both read from the BIN. Reconciling fees per transaction is only possible if the BIN table used at authorization matches the one used at clearing. For platforms that report to merchants, BIN attributes also make dashboards more useful: acceptance by issuer country, by card type or by issuer explains most of the gaps that a single acceptance rate hides.

The same logic applies to disputes. Chargeback rules, time limits and evidence formats differ by scheme, and the scheme is read from the BIN. A platform that stores the BIN with each transaction can sort disputes by network and issuer country without asking the acquirer for extra data.

Pricing

Operators that sell IC++ or blended pricing need accurate BIN data to explain costs. A commercial card misread as consumer debit can cost far more than the margin on that payment. The full cost stack is explained in what the merchant discount rate (MDR) is.

For a deeper look at configuration choices, read why BIN configuration needs a second look from PSPs and PayFacs. In Latin America, domestic brands sit beside the global schemes, as the guide to payment methods in Brazil shows.

The Payments Library collects outside reading on the issuer side, such as Debit Cards 2.0: why community banks must modernize. For a practitioner’s view, watch the #TheShot episode BINs as decision drivers. Two more episodes go deeper: what happens when your BIN data is misaligned and whether your BIN setup is quietly killing your conversion rates.

Is BIN intelligence worth it in 2026?

Yes, for any operator that routes, prices or screens card payments. The cost is low: a reliable BIN source, a refresh routine and systems that accept eight digits and token ranges. The value depends on the player:

• PSPs: high value. Accurate, eight-digit-ready BIN data improves acceptance through better routing and cuts mispriced interchange.
• PayFacs: high value for risk. BIN mix per sub-merchant is a cheap, early signal for monitoring.
• ISOs: medium value. Pricing transparency and reporting improve, even when routing stays with the acquirer.
• ISVs and platforms: rising value as they embed payments and start to choose acquirers per market.

The BIN is the address on every card payment, so operators that read it in full, eight digits and tokens included, route better, price more fairly and spot risk sooner.