BIN / IIN Lookup: A Guide to Credit Card Validation

What is a BIN / IIN?

A Bank Identification Number (BIN) — officially called an Issuer Identification Number (IIN) since the ISO/IEC 7812 standard update — is the first 6 to 8 digits of a payment card number. These digits uniquely identify:

• The issuing institution (bank or financial provider)
• The card scheme (Visa, Mastercard, Amex, etc.)
• The card type (credit, debit, prepaid, corporate)
• The country of issuance

The remaining digits are the individual account number and a check digit (verified via the Luhn algorithm). Card numbers are typically 13–19 digits long, with Visa and Mastercard standardised at 16 digits.

How does the Luhn algorithm work?

The Luhn algorithm (also known as the "modulus 10" or "mod 10" algorithm) is a simple checksum formula used to validate card numbers. It was designed to detect single-digit errors and transposed digit pairs. Here's how it works:

• Starting from the rightmost digit (the check digit), move left
• Double every second digit
• If doubling produces a two-digit number, subtract 9
• Sum all the digits
• If the total is divisible by 10, the number is valid

For example, the Visa test number 4111111111111111 passes the Luhn check. The Luhn algorithm does not confirm that an account is open — only that the number is structurally plausible.

Card number prefixes by scheme

Card schemes can be identified from the first 1–4 digits:

• Visa: starts with 4
• Mastercard: starts with 51–55 or 2221–2720
• American Express: starts with 34 or 37 (15 digits)
• Discover: starts with 6011, 622126–622925, 644–649, or 65
• JCB: starts with 3528–3589
• Maestro: starts with 6304, 6759, 676770, or 676774

Why do businesses perform BIN lookups?

BIN lookups are used across many payment and fraud prevention use cases:

• Fraud detection: If a customer claims to be in Germany but their card is issued by a bank in Nigeria, that's a risk signal worth flagging.
• Routing optimisation: Payment processors route transactions differently based on card type, scheme, and country to minimise interchange fees.
• 3D Secure eligibility: Knowing the issuing bank helps determine whether 3DS authentication is required or supported.
• Prepaid card detection: Some merchants restrict prepaid cards (e.g. for subscription services), and BIN data identifies them.
• Compliance: Cross-border payment regulations (e.g. PSD2 in Europe) may require knowing the card's country of issuance.

BIN lookup vs. full card validation

A BIN lookup uses only the first 6–8 digits of a card number — no sensitive data is required or shared. Combined with a Luhn check on the full card number, you get a comprehensive picture of a card's validity and origin without ever processing or storing the actual account number.

The Versys card checker performs both a Luhn validation and a BIN lookup automatically. It never stores card numbers, only the BIN (first 6 digits) for issuer identification.