BIN Attack Fraud: How High-Risk Merchants Detect & Shut Down Card Testing

Introduction

BIN attack fraud, also called card testing, is one of the fastest-growing threats hitting high-risk merchants in 2026. Fraudsters use stolen card data to run hundreds or thousands of micro-transactions through a merchant’s payment gateway, testing which cards are live before selling or using them at scale.

By the time most merchants notice, the damage is already done: chargeback ratios have spiked, payment providers are flagging the account, and processing access is at risk.

TL;DR

• BIN attacks use stolen card ranges to test which cards are valid through small micro-transactions
• High-risk merchants are 3x more likely to be targeted than standard merchants
• Card testing fraud caused an estimated $1.1 billion in losses globally in 2025 (Javelin Strategy & Research)
• The average BIN attack sends 1,000-5,000 transactions in under 60 minutes
• Velocity rules, CAPTCHA, and 3DS2 authentication are the three core defences
• An undetected BIN attack can push chargeback ratios above 1.5%, triggering account termination

What Is BIN Attack Fraud?

A BIN, Bank Identification Number, is the first six to eight digits of any payment card. It identifies the issuing bank, card network, card type, and country of issue.

In a BIN attack, fraudsters obtain a BIN range (often purchased on dark web markets for as little as $10–$50 per batch) and systematically test card number combinations against a live merchant’s payment gateway. They’re not trying to buy anything meaningful. They’re running automated scripts to find out which card numbers are active and approved.

Once they identify valid cards, they move them to a separate fraud pipeline, using them for larger purchases, selling them, or deploying them in account takeover schemes. The merchant whose gateway was used for testing is left holding the chargeback liability.

The Scale of the Problem in 2026

Card testing fraud is not a niche concern. According to Javelin Strategy & Research, card testing attacks caused an estimated $1.1 billion in global losses in 2025, a figure that includes direct fraud losses, chargeback fees, and merchant account terminations triggered by spiking dispute ratios.

BIN attacks increased by 35% year-over-year in 2025, driven by three factors: the explosion of compromised card data from data breaches, the automation of attack toolkits available on criminal forums, and the relative ease of targeting merchants with minimal fraud prevention infrastructure.

High-risk merchants face a disproportionate share of this. Payment providers handling high-risk payment categories, subscriptions, digital goods, adult content, gaming, are targeted 3x more frequently than standard retail merchants, according to the Merchant Risk Council’s 2025 Global Fraud Report. The reason is straightforward: high-risk payment gateways often process small-ticket transactions by design, making micro-test charges easier to hide.

How a BIN Attack Works – Step by Step

Understanding the mechanics helps merchants recognize the attack pattern before it escalates.

Step 1 – Acquiring the BIN range: Fraudsters purchase BIN data from dark web markets or extract it from data breach dumps. A single breach can expose millions of card numbers from the same BIN range.

Step 2 – Building the card list: Using the BIN prefix, scripts generate thousands of possible card number combinations using the Luhn algorithm, the mathematical formula that validates card numbers. This gives fraudsters a list of plausible card numbers to test.

Step 3 – Automated submission: Bots submit rapid-fire micro-transactions, typically under $1, sometimes as low as $0.01, through the merchant’s checkout or payment API. The goal is speed: most attacks send 1,000 to 5,000 transactions in under 60 minutes.

Step 4 – Sorting the results: Approved transactions identify live, valid cards. Declined transactions narrow the field. The approved list is extracted and either sold or deployed immediately.

Step 5 – The fallout: The merchant receives a surge of chargebacks as cardholders report the unauthorized micro-charges. Chargeback ratios spike, in some documented cases, a single BIN attack has pushed a merchant’s monthly ratio from 0.5% to above 15% in 48 hours. Payment providers flag the account. In severe cases, merchant account termination follows.

Warning Signs a BIN Attack Is Underway

Merchants and their payment operations teams should monitor for these real-time signals:

• Sudden spike in transaction volume: particularly outside normal business hours (BIN attacks often run overnight or on weekends when monitoring is reduced)
• Unusually high proportion of declined transactions: a legitimate decline rate is 5%–15%; BIN attacks commonly push declines to 60%–90% of the attack batch
• Micro-transaction clustering: a high volume of transactions under $1 or $2, which is not typical for most merchant categories
• Sequential card numbers: multiple transactions where card numbers differ by only one or two digits
• Single IP or narrow IP range: generating abnormal transaction volume
• Identical billing addresses across multiple cards: a common artifact of bot-generated test data
• New customer accounts created in bulk: within the same time window

How Payment Processors Detect BIN Attacks

Most specialist payment providers and high-risk payment gateways have automated detection built in, but the sensitivity varies significantly.

Velocity Rules

Velocity rules cap the number of transactions allowed from the same IP address, device fingerprint, BIN range, or card number within a defined time window. A well-configured rule might flag any IP submitting more than 10 transactions in 10 minutes.

According to Chargebacks911’s 2025 fraud prevention benchmarks, velocity rules configured at the BIN range level catch 60%–70% of card testing attempts before they reach authorization. For high-risk merchants, BIN-level velocity monitoring is not optional, it is the first line of defence.

CAPTCHA and Bot Detection

CAPTCHA challenges and behavioural bot detection tools (such as Cloudflare Turnstile, Google reCAPTCHA v3, and Arkose Labs) block automated scripts at the checkout entry point. Cloudflare’s 2025 application security report found that CAPTCHA implementation reduces automated checkout abuse, including card testing, by approximately 65%.

The limitation is friction. Aggressive CAPTCHA implementation can reduce legitimate conversion rates by 2%–4%, so the deployment needs to be risk-tiered: heavier friction for suspicious sessions, seamless experience for trusted users.

3DS2 Authentication

3DS2 is the most structurally effective defence against BIN attacks. When a transaction is submitted through 3DS2, the issuing bank performs its own risk assessment and challenges the transaction where it detects anomalies. Automated bot scripts typically cannot complete a 3DS2 challenge.

Merchants who have deployed 3DS2 universally on their payment gateway see card testing success rates drop by 70%–80%, according to Worldline’s 2025 fraud analysis. The added benefit: on 3DS2-authenticated transactions, fraud liability shifts from the merchant to the card issuer, meaning chargebacks from successfully tested cards cannot be levied against the merchant.

Device Fingerprinting and IP Intelligence

Device fingerprinting tools identify unique characteristics of the submitting device (browser version, screen resolution, font set, plugin configuration). IP intelligence overlays this with geographic risk data, VPN detection, and known bot network identification.

Together, these tools create a session risk score. Transactions from sessions scoring above a defined threshold are automatically declined or escalated for manual review, before they reach the authorization stage.

Shutting Down a Live BIN Attack

If a BIN attack is already in progress, speed matters.

• Block the attacking IP range immediately: your payment gateway or fraud tool should allow real-time IP blacklisting
• Enable emergency velocity throttling: temporarily tighten velocity rules to 3-5 transactions per IP per hour
• Disable or lock the specific checkout endpoint: being targeted for 30-60 minutes if attacks are through a specific API path
• Notify your payment provider or merchant services contact immediately: document that the spike is fraud-originated, not organic, before your chargeback ratio is assessed
• Enable 3DS2 universally: if not already active, this is the fastest structural fix for stopping ongoing attacks
• Initiate chargeback representment: for any chargebacks already filed from the attack batch, using transaction logs and bot detection data as evidence

Pros and Cons of BIN Attack Prevention Tools

FAQ

Q: How is a BIN attack different from carding?z
Ans: Carding uses known valid card data to make fraudulent purchases. A BIN attack is the step before carding, it uses automated scripts to find out which cards in a given BIN range are valid. BIN attacks are the reconnaissance phase; carding is the deployment phase.

Q: Can my payment provider detect a BIN attack on my behalf?
Ans: Most specialist high-risk payment providers have automated monitoring, but sensitivity varies. You should not rely entirely on your provider’s detection, real-time dashboards, velocity alert notifications, and your own fraud team monitoring are all necessary layers.

Q: Will a BIN attack always trigger merchant account termination?
Ans: Not automatically. If you detect the attack early, shut it down, notify your processor, and document the event as fraud-originated, termination risk is significantly reduced. The danger is a BIN attack that goes undetected for days, by which point the chargeback ratio damage is already done.

Q: Do offshore merchants face BIN attacks differently?
Ans: BIN attacks target any merchant with a live payment gateway, regardless of whether the account is domestic or offshore. Offshore merchant accounts may have higher chargeback tolerance thresholds, but they will still terminate accounts where BIN attack fallout pushes ratios to extreme levels.

Q: How do I explain a chargeback spike from a BIN attack to my payment provider?
Ans: Act immediately, document everything, and contact your merchant services account manager before the chargeback ratio is formally assessed. Provide transaction logs, IP data, timestamps, and any bot detection tool output. Payment providers are experienced with BIN attack scenarios, transparency and speed of reporting are both in your favour.

The Bottom Line

BIN attack fraud is a structural threat to any merchant operating in high-risk payment categories. A single undetected attack can destroy months of chargeback ratio progress and put a merchant account at risk.

The good news is that the defences are well understood: velocity rules catch the majority of attacks, CAPTCHA blocks the bots at checkout, and 3DS2 removes the fraud liability entirely on authenticated transactions. Merchants who build these layers before an attack hits are in a fundamentally stronger position than those scrambling to respond after.

Explore TheFinRate’s directory of high-risk payment gateways and fraud prevention tools, compared by BIN attack detection capability, 3DS2 support, and merchant category compatibility.

Card Testingcard testing fraudfraudsters obtainhigh risk merchant accounthigh-risk merchant account providerhigh-risk merchant businesshigh-risk merchantshigh-risk paymentMerchant ServicesPayment GatewayPayment Processingpayment provider