📘

BIN lookup is a subscription service. Contact [email protected] or [email protected] to gain access to our BIN lookup product.

What is BIN Lookup?

As a merchant operating in the digital payments ecosystem, there are many challenges to processing payments in an effective way. Digital payments fraud, chargeback fraud, low authentication rates, the consumer experience, compliance with regulations, and high transaction costs are all nuanced challenges that can affect the success of each transaction. A BIN Lookup is a process in which rich metadata about a payment card can be retrieved by querying the PAN against a BIN database.

What is a BIN?

A bank identification number (BIN) is the first 4, 6, or 8 digits of a payment card account number (PAN). The BIN represents a range of account numbers that an issuer can use to issue cards within a given BIN. All cards issued in this BIN share the same attributes.

Example

With TokenEx Universal Tokens, our customers do not need to know the BIN or the PAN to query the valuable BIN lookup data. TokenEx will use the full PAN that we collect for tokenization to query the BIN lookup database. Since TokenEx is using the entire account number to perform the BIN lookup, the service works seamlessly for cards with any length of BIN and we return all relevant data without requiring our customers to know the bin length or the PAN. This provides maximum effectiveness while keeping our customer's PCI DSS scope to a minimum.

Data Sources

TokenEx provides over 70 BIN data points (not all data is available for every BIN) that are sourced directly from the following payment card networks. TokenEx currently has about one million BINs in the database.

• PayPal
• Discover
• Prop
• JCB
• Mastercard
• Visa
• Amex
• Elo
• Dankort
• Diners Club
• Unionpay
• EFTPOS Australia
• RuPay
• Accel
• NYCE
• STAR
• PULSE
• Korean Local
• MIR
• Culiance
• Bancontact
• Carte Bancaire
• Hipercard
• ATM Card
• UATP
• Cirrus
• Private Label
• Maestro
• EFTPOS

Card Products

When available for a BIN range, we provide the product ID and product name in the response. Each Network has a different product ID standard, please see below for details.

Visa

Mastercard

🚧

Some card brands issue card products referred to as "debit", but with a funding source that's actually credit. This is typical of corporate or professional cards where the credit line can be used despite the card product name indicating it's debit. Examples include Debit Mastercard BusinessCard and Debit Mastercard Professional Card.

Full BIN File Download

BIN Lookup Enterprise tier subscribers have access to a full BIN file download endpoint. This enables customers to store a local copy of the BIN data to perform BIN lookups on-premise. This can be useful to minimize latency and to enable offline use cases for BIN lookup. The file is in csv format and has a .zip extension. The file is updated every Monday at 12:30 AM UTC.

Enterprise customers will need to design search logic to search for a BIN value within a given range. For example, if you want to review details for BIN "464565", you'd generate the 19-digit value for a card number, padded with trailing zeros; you would then search for all the rows where the card number "4645650000000000000" is between the bin_min and the bin_max.

Overlapping BIN Ranges

It's possible for a BIN to appear in two or more overlapping BIN ranges. This typically indicates one of the following:

• The provided BIN does not contain enough digits. More digits are required to narrow the results (e.g. providing six digits results in two BIN range matches, but providing eight digits results in only one). For this reason, it is recommended to provide as many digits as possible. To do BIN lookups locally without incurring PCI DSS scope for handling card data, you can retain a certain number of digits from the PAN to comply with the PCI's allowable truncation formats. For PANs greater than 15 digits in length, the PCI DSS will allow you to retain the first eight digits and any other four. In these cases, it is advised to provide the first 12 digits for best results. For PANs that have a length of 15 digits or less, PCI DSS only allows you to retain the first 6.

📘

As a PCI level 1 service provider, TokenEx uses the full PAN when performing a BIN lookup. This guarantees best results. This enables organizations to get accurate BIN data without incurring any PCI DSS scope from handling card data internally.

• The given BIN has multiple card brands associated with it. The primary card brand for the BIN will be one of the main card brands—Visa, Mastercard, Amex, Discover, JCB, or UnionPay; the secondary is typically a pinless debit network (Pulse, NYCE, Star, etc.) or a regional brand (e.g. EFTPOS, Dankort, Carte Bancaire). Below is an example of a card with multiple networks represented as logos on the back.

Access Points

Iframe

The TokenEx iframe JS library has a BIN Lookup function and an event listener. The function is used to retrieve BIN lookup data for a PAN that has been collected in the iframe, and the event is used to trigger another action off of a BIN lookup.

It is best practice to perform the BIN lookup after input validation of the PAN and before tokenization. However, the trigger for BIN lookup is controlled by the customer's implementation of the function.

Documentation

Iframe Function

Iframe Event

Token Services API v2

There are two API endpoints within the PCI Token Services section of API v2. The BinFile endpoint can only be accessed by Enterprise tier BIN Lookup subscribers, while any BIN Lookup subscriber can use the BinLookup endpoint.

Documentation

BIN Lookup API Endpoint

BIN File API Endpoint

Mobile API

The Mobile API has a BIN Lookup endpoint that can be accessed by client-side devices.

Documentation

Mobile BIN Lookup

BIN Lookup Guides

The following guides go into detail about how to leverage some of the data provided by the TokenEx BIN Lookup service.

Level 2 and Level 3 Indicators

A merchant provides a lot of data in a payment transaction. This transaction data typically includes information about the order, the customer, and the payment instrument. Merchants can obtain lower interchange rates by submitting more data in a payment transaction. The card networks perceive lower risk of fraud when more data is provided and certain conditions are met. In general, more data leads to less risk, and therefore, lower interchange fees. The level of data that a merchant provides is classified into a three level system (level 3 being the most data provided). A merchant may qualify for level 2 or level 3 interchange if a majority of it's transactions are business-to-business (B2B) or business-to-government (B2G).

Level 1 Data

Level 1 data includes total purchase amount, card number, expiration date, merchant category code, and merchant's name. This level of data is associated with typical business-to-consumer (B2C) transactions.

Level 2 Data

Level 2 includes all data from level 1 plus sales tax amount, customer accounting code, merchant's tax ID, any applicable minority or woman owned business status, and sales outlet zip code.

Level 3 Data

Level 3 includes all data from levels 1 and 2 plus quantities, product codes, product descriptions, ship to zip code, freight amount, duty amount, order number, unit of measure, discount indicator, discount amount, net/gross indicator, tax rate applied, tax type applied, debit or credit indicator and alternate tax identifier.

Type vs. FundingSource

Generally, the "type" of a payment card and its funding source are synonymous. However, there are rare scenarios in which they are not. There are times when a debit business card is funded by a commercial line of credit or a credit card is set based on the backend of a business' bank account. This is why Visa and Mastercard have added funding type to their network files in addition to type. In some cases, a card product may be considered a debit card (i.e. Debit MasterCard BusinessCard Card) by the consumer, but the funding source may be a line of credit, as indicated by the funding source field, set by the card brands.