What is BIN number and BIN attack?
A BIN number, or Bank Identification Number, is an initial combination of six to eight digits that is located at the beginning of the card number. This number usually identifies the bank issuer of the card. The number also helps to tell information such as the type of the card, the level of the card and so on. BIN attack is a type of credit card attack where the attacker is trying to guess the correct combination of the BIN number, expiration date and Card Verification Value or CVV by using brute force method.
According to the Consumer Sentinel Network Data Book 2023 by the Federal Trade Commission or FTC, a total of 471,488 reports regarding payment fraud were received. Among them, there are 114,348 reports related to the credit card fraud which caused approximately $246 million in losses.
This shows that BIN attacks have become one of the rising issues for credit card usage now.
How does the attacker perform a BIN attack?
A BIN attack usually involves a few processes before the card owner or bank issuer realizes the attack.
These processes are:
- Identify targeted BIN number
- The attacker will get started by obtaining the BIN number from some sources, such as those purchased from the dark web.
- Generate the card number
- Based on the BIN number obtained in the previous step, the attacker will then try to generate a complete card number using the Luhn algorithm. This is usually done by an automated script.
- Validate the card number
- The attacker will also need to validate the generated card number to make sure it is a valid one. They will achieve this by purchasing an item in a small amount to avoid triggering a fraud check, or by adding the card number into the e-wallet and letting the e-wallet check the card number.
- Start the attack
- Once they have the list of valid card numbers, they will then make unauthorized purchases or orders using those card numbers. The action will be performed repeatedly until the card is blocked by the issuer bank.
Who will get impacted by the BIN attack?
The BIN attack will affect various parties. Those parties are:
The customer: Once the customer’s credit card number is being used for fraudulent transactions, they will suffer financial losses and also negatively impact their credit score. They will also need to spend unnecessary time or other resources to remediate the issue with the credit card issuing bank.
The merchant: If the fraudulent transactions went through without any obstacle, the merchant will be blamed for being vulnerable to the BIN attack, and thus lose their reputation. Also, they will also suffer financial losses too, as they may need to refund the money to the credit card owner.
The bank or card issuer: They will need to carry out additional activities to investigate and handle the disputes request of the transaction from the actual card owner. Additionally, they might also need to implement more secure measures to make sure such incidents might not happen again.
How can merchants prevent such attacks?
In order to prevent the BIN attack, there are few steps that merchants can implement into their business, such as:
Transaction monitoring
Merchants should monitor the transactions regularly. A normal customer shouldn’t make multiple transactions at the same time. However, attackers will do these to test the card validity. Hence, if merchants detect such behavior, they can take appropriate action to prevent fraudulent activity from happening.
Utilizing fraud prevention service
By using fraud prevention services such as FraudLabs Pro, merchants are able to detect any fraudulent transaction automatically and flag for further investigation. The fraud prevention services will identify suspicious patterns and scrutinize order information such as IP address, billing and shipping address, and so on. Also, if the merchants found out some additional fraudulent patterns, they can also define the rules to detect those patterns.
Implementing security measures to the transaction
As a merchant, they must make sure that customers are able to carry out the buying process safely at their website. As such, merchants must implement any security measures to ensure the security of their checkout process. One of the examples is 3-D secure, which has been adapted by various card issuers and payment gateways. The “3-D” here means the merchant/acquirer domain, the issuer domain, and the interoperability domain.
Make use of OTP in transaction
OTP or One-Time-Passcode is a generated combination of digits or alphanumeric for a single request or transaction. As the name implies, it will be valid only for a single transaction in a defined period. Hence, it is safe as only the OTP issuer and the customer can know the exact OTP string.
How can customers get similar protection?
Apart from the merchants’ side, the customers can also take some steps to prevent their card BIN number from leaking and being abused in the attack.
Enabling Multi Factor Authentication (MFA)
Secure account with MFA to prevent unauthorized access.
Monitoring card statement
It is essential that the customer always check their card purchase history so that they can quickly be aware if any unauthorized transactions happened and take immediate action to secure the card.
Monitor transaction alerts
As one of the features, the bank issuer will offer an option to enable notification when any kind of transaction occurs. The notification can be sent to the customer via SMS or email. Thus, if any unexpected transaction notification is being sent to the customer, the customer can quickly take action to secure the card.
Conclusion
BIN attack is a threat to all parties, no matter if you are a merchant or a customer. Without a complex set of security practices and measures, attackers can easily get what they want with the card number. By reading this article, hopefully you can learn more about how to prevent the attack from happening.