Bin Lookup Verification Application: How to Safely Sell CVV Online
Learn how to safely sell CVV online with a bin lookup verification application. Discover the importance of security and the steps to follow.
BIN Lookup Test: What It Checks and How to Read Results
What Is a BIN Lookup Test?
A BIN lookup test checks the first six to eight digits of a card number against a database of issuing banks. Those leading digits are the bank identification number, or BIN, and they identify the institution that issued the card. The test returns the issuer name, card brand, card type, country of issue, and often the card tier.
What the test does not do is confirm that a card is open, funded, or held by its rightful owner. Those questions need an authorization request that travels through the payment network to the issuing bank.
What Are the Parts of a Card Number?
A card number is not random. Each block of digits carries a specific meaning, and the BIN sits at the front.
BIN Lookup Validation Utility: Guide for Payment Security Teams
Issuer identification number (digits 1 through 6 or 1 through 8)
This block names the bank and the card program. Visa numbers start with 4, Mastercard with 2 or 5, American Express with 34 or 37, and Discover with 6011 or 65.
Account number (middle digits)
The issuer assigns this portion to the individual account. It carries no public meaning and stays inside the bank's systems.
Check digit (last digit)
A math formula called the Luhn algorithm generates this digit. It catches typos and single-digit mistakes, nothing more.
How Does a BIN Lookup Test Work?
The process takes milliseconds and runs on prefix tables rather than on live accounts.
- Pull the first six to eight digits from the card number.
- Match that prefix against a BIN table maintained by the card networks, an acquirer, or a commercial data vendor.
- Read the issuer record attached to the prefix: bank name, brand, country, currency, and card class.
- Compare the record against what the customer or system claims. A US-issued card used from another continent is a mismatch worth flagging.
- Log the result so your rules engine, pricing logic, or fraud model can act on it.
What Data Does a BIN Lookup Return?
- Issuing bank name and, in some databases, a support phone number
- Card brand: Visa, Mastercard, American Express, Discover
- Card type: credit, debit, prepaid, or charge card
- Country of issue and billing currency
- Card level: classic, gold, platinum, signature, business, or corporate
- Consumer or commercial flag, which matters for interchange rates
Commercial databases add fields such as prepaid reloadability and whether the card supports international transactions. Coverage varies by vendor and by how fresh the table is. A stale BIN table will mislabel newly issued card programs.
BIN Lookup Test vs. Card Validation
A BIN lookup reads public prefix data and touches nothing on the account. Card validation goes further and interacts with the bank or the cardholder.
Luhn check
This runs a checksum on the full number to catch mistyped digits. It passes on any number that satisfies the formula, including numbers that belong to nobody.
Address verification (AVS)
AVS compares the billing address and postal code against what the issuer holds. A mismatch returns a code the merchant can accept, decline, or review.
CVV check
The three or four digit security code is verified by the issuer, not stored by the merchant. A failed CVV check is one of the strongest signals of a stolen number.
3-D Secure
This step pushes authentication back to the cardholder through an app or one-time code. Liability for fraud shifts to the issuer when authentication succeeds.
Who Runs BIN Lookup Tests?
- Payment gateways use BIN data to route transactions and apply the right interchange category.
- Fraud and risk teams score each order using issuer country, card type, and prepaid status.
- Chargeback analysts check whether a disputed card came from a high-risk BIN range.
- Merchants use BIN lookups for currency display and for blocking card types they do not accept.
- Issuers verify their own BIN ranges and audit how partners handle them.
What a BIN Lookup Test Cannot Tell You
- Whether the account is open, closed, or frozen
- Whether the credit line has room for the charge
- Whether the person entering the number owns the card
- Whether a prior chargeback sits on the account
- Whether the card is reported lost or stolen
Any service that claims a BIN check can confirm a live balance is either guessing or pulling from a source it should not have. Treat such claims as a red flag about the vendor.
Is a BIN Lookup Test Legal?
Looking up public BIN data is legal and routine in payments work. Using card numbers you do not own is a different matter. In the United States, 18 U.S.C. § 1029 criminalizes trafficking in counterfeit access devices, which covers buying, selling, or possessing card numbers that belong to others. A BIN check run against a stolen number serves as evidence of intent, not as a harmless technical step.
Frequently Asked Questions
How many digits are in a BIN?
Historically six. The ISO/IEC 7812 standard now allows eight-digit issuer identification numbers, and the card networks have been migrating toward that length. Most lookup tools accept six and return a match either way.
Can a BIN lookup test confirm a card is active?
No. Only a live authorization request sent to the issuer can return an approval or decline. A BIN lookup works from a static prefix table with no connection to the account.
Do BIN lookup tests cost money?
Some are free and offer basic brand and country data. Commercial vendors charge per lookup or by subscription for extra fields such as card level, prepaid status, and phone numbers.
Why does a BIN result show the wrong bank?
Banks sell card portfolios, rebrand, and issue through partner institutions. A prefix table that has not been refreshed will still show the old issuer. Check the table update date before you trust an unusual result.
What is the difference between a BIN lookup and a BIN attack?
A BIN lookup reads one prefix. A BIN attack floods a gateway with thousands of guessed card numbers that share a prefix, hoping to find valid ones. Gateway velocity limits and rate rules exist to stop the second kind of traffic.