What is a BIN Attack?

What is a BIN Attack, and How to Detect It

Credit card fraud is a growing concern in today's digital world, with more than $219 million worth of credit card fraud losses reported in 2022 alone¹. One type of credit card fraud that is increasingly common is the BIN attack, where cybercriminals use brute-force methods to guess valid combinations of credit card information. Once they find a working combination, they move on to card testing, where they make small purchases to determine if the card is active and vulnerable to fraud. Here, we will explore what BIN attacks are, how they work, and ways to detect them.

What Does BIN Mean?

The first four to eight digits on a credit card, debit card, or gift card are known as the BIN, or bank identification number. Many consumers don’t think about the sequence of their credit card numbers at all. But, in most cases, the first number on a credit card is 3 through 6, which indicates personal banking, payments, and finance.

The BIN identifies the bank that issues the credit card. The issuing bank uses the BIN to trace their cards so they can detect and stop financial crimes and fraud such as identity theft and unauthorized charges.

What is a BIN Attack?

In a BIN attack, a cybercriminal uses brute-force methods to try to guess a valid combination of a credit card number, expiration date, and card verification value (CVV).

A botnet can quickly test hundreds or thousands of combinations. When it discovers a valid combination, it may test other variations, assuming that other cards will have the same BIN.

What is Card Testing?

The next step in a BIN attack is called card testing, or “carding,” and it involves the attacker attempting small transactions to see if the card is active and protected against fraudulent activity. Many of these attempted purchases are stopped without the customers' knowledge of activity on their accounts, but some of these minor charges result in a successful transaction. When the scammer locates a weak card, they can either use it for further fraudulent transactions or sell it on the account numbers on the dark web.

Learn how to prevent bot-driven attacks. Download The Ultimate Bot Prevention Playbook today!

How to Detect a BIN Attack

There are a few ways to spot the signs of a BIN attack or a carding attack:

1. Minor transactions: The detection of repeated, minor transactions coming from the same IP address is a red flag for fraud.
2. Transaction velocity: Once a credit card is compromised, malicious bots and automated software will make lots of purchases in a short amount of time.
3. Authorization errors: These errors may be attributed to a fraudster's persistent attempts to obtain access to private information.
4. CVV errors: These errors occur as fraudsters test the CVV during card testing.
5. Oddly timed purchases: If you notice purchases made outside of regular business hours (depending upon your business and time-zone), cybercriminals may be using your business to test credit cards.

How Consumers can Prevent BIN Attacks

There isn’t anything a consumer can do to prevent a brute-force attack in which automated programs attempt to guess a combination of credit card numbers, expiration dates, and CVVs. But that doesn’t mean they are powerless. Consumers can and should take the following steps to detect and respond to any unusual activity in their accounts:

1. Set up transaction alerts for purchases of more than one cent, to detect and identify suspicious activity as soon as possible.
2. Opt for multifactor authentication (MFA) that requires users to sign in with something they know (such as a password) and something they have (such as a mobile device).
3. Shop online only with merchants that use the Verified by Visa (VBV) or Mastercard SecureCode (MCSC) features, which prompt the cardholder for a one-time password whenever their card is used at participating stores.

How Businesses can Prevent BIN Attacks

Businesses have a few more options when it comes to responding to BIN attacks. Online merchants can use a PCI-compliant gateway to prevent credit card testing. Businesses that notice a rapid increase in chargebacks (when a customer disputes a credit card charge), can use chargeback analytics to identify BIN attacks and card testing. Here are five more ways a business can prevent BIN attacks:

1. Use fraud detection software: Fraud detection software can help identify suspicious transactions and patterns, and flag them for further investigation. This can help catch BIN attacks before they do significant damage.
2. Use a bot-management solution: A bot management solution, like that offered by Arkose Labs, can protect ecommerce sites from cyberattack, while also accelerating conversion rates.
3. Implement multi-factor authentication (MFA): MFA can add an extra layer of security to transactions, making it more difficult for cybercriminals to carry out BIN attacks.
4. Use address verification: Address verification can help confirm that the person making a transaction is the legitimate cardholder. This can be done by comparing the billing address provided by the cardholder with the address on file with the credit card issuer.
5. Educate employees: Employees should be trained to recognize and report suspicious activity. They should also be instructed on the proper procedures for handling transactions to minimize the risk of fraud.

Additionally, businesses can implement security measures such as card limits, blocking a user after a predetermined number of declined attempts, and using a CAPTCHA solution for online transactions. By implementing these measures, businesses can reduce the risk of BIN attacks and protect their customers' sensitive information.

What to do if You Notice Fraudulent Charges

A consumer who notices unauthorized charges, or believes they are the victim of a BIN attack, should request a new credit card with a new number. Contact the number listed on the back of the credit card, or visit the bank's website by typing in the address of the website directly rather than clicking on a link.

Businesses that notice a BIN attack, card testing attack, or any other type of credit card fraud should contact their gateway provider or merchant bank immediately. They will advise you on your next steps. Businesses should also inform the police and other appropriate law enforcement authorities and cooperate with any subsequent investigations.

Conclusion

BIN attacks are a growing concern in the digital world, with cybercriminals using brute-force methods to guess valid combinations of credit card information and then test them through small purchases to determine if the card is active and vulnerable to fraud. However, there are ways to detect and prevent BIN attacks.

Consumers can set up transaction alerts, opt for multifactor authentication, and shop only with merchants that use Verified by Visa or Mastercard SecureCode.

Meanwhile, businesses can use PCI-compliant gateways, chargeback analytics, and security measures such as card limits, user blocking, and CAPTCHA solutions. If fraudulent charges are noticed, consumers should request a new credit card and contact their bank or merchant immediately, while businesses should inform their gateway provider, merchant bank, and appropriate law enforcement authorities. By being vigilant and taking proactive steps, we can reduce the impact of BIN attacks and protect ourselves from credit card fraud.

A bot management solution, like one from Arkose Labs, can detect large-scale testing of stolen payment credentials on retail and ecommerce checkout pages, and prevent fraudulent gift card purchases. And Arkose MatchKey Challenges are the ideal CAPTCHA solution to secure your payment pages from malicious bots.

Want to learn more? Book a demo today!