The short answer
A BIN lookup test takes the first six to eight digits of a card number and matches them against a database of issuing ranges. What comes back is descriptive: the issuing bank, the country the card was issued in, the card brand, whether the card is credit, debit or prepaid, and often the card level (classic, gold, platinum, business). What does not come back is whether the card number is valid, whether it has money on it, or who holds it. A BIN is a routing label, not a key to an account.
That gap trips people up constantly. Someone runs a lookup, sees a clean bank name and a US country code, and assumes the check passed. The lookup only confirmed that the prefix belongs to a real range. It says nothing about the other ten to twelve digits.
What a BIN actually is
BIN stands for Bank Identification Number, though the industry has mostly moved to IIN, Issuer Identification Number. ISO/IEC 7812 sets the structure: a major industry identifier digit, a variable-length issuer identifier, and a check digit at the end of the full number. Historically the issuer portion was six digits. Since 2015 the card networks have been assigning eight-digit ranges, which is why your lookup tool needs to accept both lengths and why a six-digit result can be less precise than it used to be.
What a lookup returns
- Issuer name and, sometimes, the issuer's phone number from the back of the card
- Issuer country and region
- Brand: Visa, Mastercard, Amex, Discover, UnionPay, and so on
- Card type: credit, debit, prepaid, charge
- Product tier or level, if the issuer publishes it
- Whether the range is still active or has been retired
Different tools give different depths. Free lookups usually stop at brand and country. Commercial ones, fed by issuer files and network updates, add the level and the issuing institution's contact details.
What it does not return
No balance. No cardholder name. No address. No expiry. No confirmation that the number is assigned to a real account. Merchants get an authorization response from the issuer for that, and authorization requires a live transaction, not a lookup.
Where the data comes from
Ranges originate with the card networks and are distributed to acquirers, processors and gateway providers. The networks publish some of it; the rest flows through licensing and settlement files. A lookup tool is essentially a cached copy of that distribution, refreshed on some schedule. Stale data is the most common reason a lookup disagrees with what an authorization later shows.
Why merchants run BIN checks
The main uses are mundane. Routing a transaction to the right network and currency. Calculating interchange, since debit and prepaid carry different rates. Applying brand-specific rules, like requiring a CVV for certain regions or flagging prepaid cards where returns are a risk. Fraud scoring is part of it, but a BIN check is one weak signal among many, and treating it as a verdict produces both false alarms and false confidence.
Where the signal breaks down
Prepaid and virtual card ranges shift fast. Banks buy portfolios from each other, so a country code can lag reality by months. Corporate cards can carry a commercial range while behaving like consumer credit. And because eight-digit ranges overlap with six-digit ones from different issuers, a short lookup can point at the wrong bank entirely.
Limits worth remembering
Treat a BIN result as one field in a larger risk picture. It is useful for categorization and routing. It is not proof of anything about a specific card, and no legitimate service can turn a prefix into a validity check. If a tool claims it can verify a card without an authorization, it is either mislabeling what it does or selling a guess.