# BIN Attacks: How Card Testers Pick Their Targets

Source: https://bondproof.com/blog/2026-11-08-bin-attacks-card-testers-targets.html

[Home](../index.md) / [Blog](index.md)


**Short answer:** Card testers pick targets by BIN, the first six to eight digits of a card number, because a BIN tells them the issuing bank and card type before they spend a cent. They then run tiny test charges, usually a cent to a dollar, and a store whose decline ratio climbs past 90 percent is already being tested.

## The BIN is the address, not the attack

A BIN is the first six to eight digits of a card number, and it identifies the issuing bank, the card brand, and whether the card is debit, credit, or prepaid. Testers collect lists of BINs the way a burglar collects addresses, then work through them one store at a time. The store is not chosen because it is weak. It is chosen because its checkout accepts the BINs the tester holds.

That is why an attack often starts with a single card brand or a single issuing bank. The tester is not guessing. They hold a batch of stolen numbers from one breach or one BIN range, and they need to find out which of them are still live. Your checkout is the fastest way to check, and it costs them nothing when the charge is declined.

## What a test run looks like from the gateway

The charges are almost always tiny, a cent to a dollar, because the point is not to steal money. The point is to get an approval. A one dollar authorization that clears tells the tester the card is live, and the card then goes into a second pile for a real purchase somewhere else. The small amounts also slip under most fraud rules, which are tuned for large anomalous charges.

The volume is the giveaway. A normal store sees a handful of declines an hour. A store under test sees hundreds of attempts in minutes, almost all declined, from card numbers that share a BIN range. The 2026 Merchant Risk Council report put it plainly: card testing now touches at least a third of merchants, and most of them first notice it as a spike in declines, not as fraud.

## The ratio that gives them away

Watch the decline ratio, not the chargeback count. When declines climb above 90 percent of authorization attempts, you are almost certainly being tested. Real customers fail a card for a typo or an expired date, and those failures spread across banks and card types. A test run concentrates on one BIN range and fails the same way, over and over.

Visa has been tracking this long enough to put a number on it. The network attributes about 1.1 billion dollars in a year to card enumeration, and its Acquirer Monitoring Program added enumeration criteria in April 2026. That means your acquirer may flag you before you notice the problem yourself, and the flag comes with a remediation clock.

## What to do when the ratio spikes

The first move is rate limiting by BIN, not by IP address. Testers rotate IPs freely, but they cannot rotate BINs, because the BIN is the thing they are testing. A velocity rule that caps authorization attempts per BIN range per hour stops the run without touching real customers, whose cards spread across many BINs.

The second move is to stop treating a one dollar authorization as harmless. A low value threshold that routes tiny authorizations to step up authentication breaks the economics of testing: the tester needs a clean approval signal, and a challenge kills it. Pair that with an alert on the decline ratio, and you catch the next run in minutes instead of finding it in the monthly statement.

Keep reading: [3-D Secure 2 vs Card Testing Bots: Where the Friction Actually Helps](https://bondproof.com/blog/2026-11-06-3ds2-card-testing-bots.md), [What Happens After a Card Testing Attack: The Bill Nobody Budgets For](https://bondproof.com/blog/2026-11-07-after-card-testing-attack-costs.md), [Promo Code Stacking: How Bots Drain Discount Budgets at Checkout](https://bondproof.com/blog/2026-11-06-promo-code-stacking-bots.md).

## Frequently asked questions

### What is a BIN attack?

A BIN attack, also called card testing or enumeration, is when someone runs hundreds or thousands of tiny charges against a store checkout to find out which stolen card numbers are still valid. The BIN, the first six to eight digits of the card, tells the tester the issuing bank and card type, so they can target stores that accept those cards.

### Why do card testers use such small amounts?

They use amounts of a cent to a dollar because they are not trying to steal money from your store. They are trying to get an authorization approval, which proves the card is live. Small amounts also slip past fraud rules that are tuned to catch large anomalous charges, and a declined test costs the tester nothing.

### How can I tell if my store is being card tested?

Watch your authorization decline ratio. Real customers decline for typos and expired cards, spread across many banks. A test run pushes declines above 90 percent of attempts, concentrated on one BIN range, with hundreds of attempts in minutes. That pattern is the signal, and it shows up before any chargeback does.

### Does 3-D Secure stop card testing?

It helps, but it is not a complete answer. A challenge step breaks the tester's approval signal, because they cannot complete the authentication for a card they do not own. But testers adapt by moving to checkouts and payment flows where no challenge is presented, so rate limiting by BIN and decline ratio alerts still matter.

[Get a free bot-traffic audit](mailto:hello@bondproof.com?subject=Free%20free%20bot-traffic%20audit)