A card number looks like a random string of digits, but it isn't. The first several digits identify the institution that issued the card, and through that, the card network, the issuing country and usually the kind of card it is. That prefix is called the BIN, for bank identification number, or more formally the IIN, issuer identification number.
BINs are everywhere in payments, mostly out of sight. They decide which network a payment goes to, which provider a routing engine picks, how much interchange a payment costs, whether a fraud rule fires, and which logo appears in a checkout form as the customer types. This guide explains what a BIN is, the industry's move to eight-digit BINs, and how payment systems use BIN data.
How a card number is structured
Card numbers, formally primary account numbers or PANs, follow the international standard ISO/IEC 7812-1. A PAN is up to 19 digits long, and is made of three parts:
| Part | Digits | What it identifies |
|---|---|---|
| Issuer identification number (IIN or BIN) | The first 6 or 8 | The issuing institution, and through it the network, country and card product |
| Individual account identifier | The digits after the BIN, except the last | The cardholder's account at that issuer |
| Check digit | The last digit | A Luhn checksum that catches most typing mistakes |
The very first digit is the major industry identifier, and the first few digits are enough to recognise the network. Visa numbers begin with 4; Mastercard numbers begin with 51 to 55 or fall in the 2221 to 2720 range; American Express numbers begin with 34 or 37. RuPay, Discover, Diners, JCB, UnionPay and others use other ranges, so use a maintained BIN table rather than hard-coded prefixes.
From six digits to eight
For decades the BIN was the first six digits. With the growth in card issuers and products, six-digit ranges were running out, and ISO revised the standard (ISO/IEC 7812-1:2017) to allow eight-digit IINs. Card networks moved to eight-digit BINs from 2022: Visa set April 2022 as its deadline for acquirers and processors to support them, and said it would assign only eight-digit issuing BINs after that date.
- Card numbers didn't get longer. The BIN takes more of the existing digits, so existing cards didn't need reissuing.
- Six- and eight-digit BINs coexist, because issuers migrate on their own timelines.
- Any system that stores, looks up or routes on the first six digits should handle the first eight, or two different issuers can look identical.
- Rules on how many digits may be displayed or stored changed with it, as explained below.
What BIN data tells you
A BIN on its own is just a prefix. Its value comes from BIN tables, maintained by card networks and specialist data providers, that map each range to attributes:
- Card network or scheme.
- Issuing bank.
- Issuing country, which decides whether a payment is domestic or cross-border.
- Card type: debit, credit or prepaid.
- Product: consumer or commercial, standard or premium.
Treat BIN data as very good, not perfect. Ranges are reassigned, tables lag behind changes, and a few issuers share ranges. Use it for decisions that tolerate the occasional mistake, and keep tables up to date.
How payment systems use BINs
Most uses happen before the payment is even authorised:
| Use | What the BIN contributes |
|---|---|
| Checkout | Shows the card brand as the customer types, and checks the number's length for that network |
| Routing | Sends the payment to a provider or acquirer suited to the network, card type or issuing country |
| Pricing | Interchange and scheme fees depend on card type, product and region |
| Risk | Flags mismatches, such as a card from one country with a device and address in another |
| Offers | Bank-specific discounts and card EMI eligibility are matched to the issuer by BIN |
| Reporting | Success rate and declines broken down by issuer, network and card type |
Routing and pricing are where BINs matter most for a business with more than one provider. Our guides to local acquiring and interchange++ pricing explain why issuing country and card type change both approval and cost, and our guide to payment success rate covers breaking performance down by issuer.
The Luhn check digit
The last digit of a card number is a checksum calculated with the Luhn (mod 10) algorithm. It catches all single-digit typos and most swaps of adjacent digits, so checkout forms validate it before sending anything. It proves nothing about whether the card exists or has funds; it only catches typing errors.
function passesLuhn(pan: string): boolean {
if (!/^\d{12,19}$/.test(pan)) return false;
let sum = 0;
let double = false;
for (let i = pan.length - 1; i >= 0; i--) {
let digit = pan.charCodeAt(i) - 48;
if (double) {
digit *= 2;
if (digit > 9) digit -= 9;
}
sum += digit;
double = !double;
}
return sum % 10 === 0;
}
passesLuhn("4111111111111111"); // true: a widely published test number, not a real cardIn practice, most merchants never handle full card numbers in their own code: the provider's hosted fields or payment page collect the number, validate it, and return a token plus card metadata such as the network, the BIN or a masked number, and the issuing country. That keeps the full number out of your systems and your compliance scope. Our guide to PCI DSS SAQ types explains why that matters.
Handling BINs and card numbers safely
A BIN on its own identifies a bank, not a person. A full card number is sensitive account data, and the rules about how much of it you may show or keep changed with eight-digit BINs:
- Display: PCI DSS requirement 3.4.1 allows no more than the BIN and the last four digits of a PAN to be displayed, unless there's a documented business need to see more.
- Storage: if you keep part of a card number, truncation formats are set by each card network, and the PCI Security Standards Council's guidance points entities to the networks for the formats that apply to eight-digit BINs. Keeping fewer digits is always safer, and systems that only ever show the last four digits need no change.
- In India: RBI's card-on-file rules mean merchants can't store actual card numbers at all. Saved cards work through tokens, and providers return card metadata separately for display and routing. Our card tokenisation guide explains how.
Frequently asked questions
What is a BIN number on a card?
The first six or eight digits of the card number. It identifies the institution that issued the card and, through BIN tables, the card network, issuing country and type of card. BIN stands for bank identification number; the formal term is issuer identification number (IIN).
Is BIN the same as IIN?
Yes, in practice. IIN, issuer identification number, is the term used in the ISO/IEC 7812 standard; BIN, bank identification number, is the older and more common industry term for the same prefix.
Are BINs six or eight digits?
Both are in use. ISO/IEC 7812-1:2017 introduced eight-digit IINs, and card networks began moving to them from 2022, while issuers migrate their existing six-digit ranges over time. Card numbers stayed the same length.
Is it safe to share a card's BIN?
A BIN alone only identifies the issuing bank and card type, not the cardholder. But never share the full card number, expiry date, CVV or OTP, and avoid sharing more of the number than the BIN and last four digits.
How can I tell the card network from the card number?
From the first digits: Visa begins with 4, Mastercard with 51 to 55 or the 2221 to 2720 range, and American Express with 34 or 37. Other networks, including RuPay, use other ranges, so systems should use an up-to-date BIN table.
Official sources
- PCI Security Standards Council — 8-Digit BINs and PCI DSS: What You Need to KnowISO/IEC 7812-1:2017; first six and last four remains a format accepted by all payment brands; systems that display only the last four digits need no change.
- PCI Security Standards Council — FAQ 1492: PAN masking and truncation with 8-digit BINsRequirement 3.4.1: no more than the BIN and last four digits displayed without a business need; truncation formats from each payment brand.
- Visa — Preparing for the Eight-Digit BIN (FAQ)April 2022 deadline for acquirers and processors to support eight-digit BINs; Visa assigns only eight-digit issuing BINs after that release.
- ISO — ISO/IEC 7812-1:2017, Identification of issuers, Part 1: Numbering system
- RBI — Restriction on Storage of Actual Card Data [i.e. Card-on-File (CoF)] (24 Jun 2022)
Last reviewed . Examples, amounts and screens marked illustrative are not LILPE figures.
