Fraud Alert: Debit Card BIN Attacks Targeting Financial Institutions

Debit card BIN attacks are hitting financial institutions of every size. These attacks need no data breach, no skimmer, and no customer mistake. Any bank that issues debit cards can be a target.

Here's how BIN attacks work, the warning signs to watch for, and steps your bank can take now.

The Threat

How BIN Attacks Work

The Bank Identification Number (BIN) is the first 6 to 8 digits of a card number, and it identifies the bank that issued the card. In a BIN attack, fraudsters take a bank's BIN and use automated software to generate the rest of the card number. They then guess the expiration date and security code (CVV).

The attack usually runs in three steps:

1. Generate. Software builds thousands of possible card numbers from one known BIN. Card numbers follow a predictable checksum, so there are fewer valid combinations that you might expect.
2. Test. Bots run small charges, often a few cents or a dollar, at online merchants to see which numbers are approved. Foreign merchants are often used for these tests.
3. Exploit. Cards that work are used for larger card-not-present purchases or sold to other criminals.

Why It Matters to Your Bank

• No breach required. Fraudsters only need your BIN. In one case at a Florida credit union, thousands of member cards were compromised with no other card or customer data.
• Issuers bear the cost. The bank typically absorbs fraud losses, plus the cost of reissuing cards, handling disputes, and answering customer calls.
• Customer confusion. Cardholders often report fraud on cards they have never used, or that have never left the drawer. That can make them doubt the bank's security.
• Size is no protection. Community banks, credit unions, and national banks have all been targeted.

What to Watch For

Review your authorization and decline reports for these patterns on your BIN ranges:

• A sudden spike in small-dollar authorizations, often $0 to $1
• Many declines on sequential or near-sequential card numbers in the same range
• Clusters of wrong-CVV or wrong-expiration-date declines
• Test-sized foreign or card-not-present transactions on cards with no recent activity
• Activity at unusual hours, such as overnight bursts
• A jump in customers reporting charges on cards they have not used 

Actions to Take

1. Randomize card numbers at issue. This is one of the strongest prevention tools available. When card numbers are issued in sequential order, finding one valid card leads fraudsters straight to the next. Random numbering forces them to search a far larger range. Visa's issuer guidance advises banks to refrain from issuing sequential or incremental card numbers and from batch-issuing expiration dates. Ask your card vendor or processor to confirm that both card numbers and expiration dates are assigned randomly. Cards already issued in sequence stay exposed, so plan to monitor them closely or reissue them over time.
2. Tighten velocity rules. Work with your debit processor to limit wrong-CVV and wrong-expiration attempts per card. Set alerts for small-dollar spikes on each BIN.
3. Block testing merchants. When you spot a merchant or merchant category being used for testing, block it temporarily for your BIN ranges.
4. Limit risky channels when needed. During an active attack, consider temporary limits on foreign or card-not-present transactions for the affected range.
5. Reissue confirmed cards. Reissue any card that was successfully tested.
6. Monitor your BINs. Ask your processor and card network (Visa or Mastercard) about BIN monitoring and compromise alerts.
7. Brief frontline staff. Make sure branch and call center staff can explain BIN attacks to customers who were affected.

What to Tell Customers

• Turn on transaction alerts and use card on/off controls in online or mobile banking.
• Report any charge they don't recognize, even one for a few cents.
• They did nothing wrong. A BIN attack does not mean their card was lost or their information was stolen.

If you see unusual activity on your BIN ranges, contact your debit processor and card network right away.