A BIN is the first six to eight digits of any card, and it is public — it names the issuer, the network, the country, and the product type before a single cent is authorized. Enumeration is what happens when that public header is used as a map instead of a label: walk the range, generate structurally valid numbers, and read the issuer's own decline codes back as an oracle until chargeable instruments surface. The method below is the 2026 version — Luhn-clean generation, gate behavior, decline-code reading, and the velocity discipline that keeps a checker from burning the BIN before it pays.
ROUTE MAP (PLAIN ENGLISH)
Six digits of any card number are the issuer header: network (Visa, Mastercard, Amex), issuer bank, product tier (debit, credit, prepaid, business), and issuing country. Everything after that header is the account block — typically ten digits on a sixteen-digit PAN, of which the final digit is a Luhn check digit computed from the preceding fifteen. A BIN attack is a numbers game played against that structure: enumerate the account block inside a chosen range, keep every candidate Luhn-valid, fire it at a gateway that answers with real issuer responses, and treat every decline code as a data point about which numbers in the range are alive.
The economics are brutal and simple. Most generated numbers decline — wrong account, closed card, or a fraud score high enough to stop it before the issuer ever sees it. A small slice authorizes. The method lives or dies on three things: picking a BIN whose product profile matches the goal (prepaid behaves nothing like a business credit line), reading decline codes correctly instead of treating every failure as equal, and staying under the velocity thresholds that turn a productive run into a dead IP, a burned gateway, or a fraud alert against the whole range.
STEP 1 - BIN SELECTION
STEP 2 - RANGE MAPPING AND GENERATION
STEP 3 - GATE BEHAVIOR AND REQUEST DISCIPLINE
STEP 4 - VELOCITY AND BURN MANAGEMENT
STEP 5 - FROM ALIVE TO USABLE
WORKED EXAMPLE - 457173 PREPAID RANGE RUN
A six-digit prepaid debit BIN in the European region, product profile = reloadable prepaid, non-3D checkout confirmed on the target merchant. Generation: nine-digit account block drawn at random across the full range, Luhn digit computed per candidate, dedup against 40,000 previously declined entries from an older run against the same header. Firing: zero-auth checks only, twelve attempts per minute across four rotating payment fingerprints, response codes logged with timestamps. Result after 6,100 attempts: 147 positives — all carrying 51 or 61 decline codes on the capture path, zero 14s past the first 900 attempts (structure was clean from the start). Live rate 2.4%, positives moved to capture within the hour against a digital-goods cart matching the prepaid profile; range abandoned when live rate fell below 0.8% at attempt 8,900 — the issuer had begun range-level scoring, and every additional attempt was training it.
WORKING SEQUENCE
QUICK ANSWERS
RELATED
Six digits of any card number are the issuer header: network (Visa, Mastercard, Amex), issuer bank, product tier (debit, credit, prepaid, business), and issuing country. Everything after that header is the account block — typically ten digits on a sixteen-digit PAN, of which the final digit is a Luhn check digit computed from the preceding fifteen. A BIN attack is a numbers game played against that structure: enumerate the account block inside a chosen range, keep every candidate Luhn-valid, fire it at a gateway that answers with real issuer responses, and treat every decline code as a data point about which numbers in the range are alive.
The economics are brutal and simple. Most generated numbers decline — wrong account, closed card, or a fraud score high enough to stop it before the issuer ever sees it. A small slice authorizes. The method lives or dies on three things: picking a BIN whose product profile matches the goal (prepaid behaves nothing like a business credit line), reading decline codes correctly instead of treating every failure as equal, and staying under the velocity thresholds that turn a productive run into a dead IP, a burned gateway, or a fraud alert against the whole range.
STEP 1 - BIN SELECTION
- Product profile first: prepaid and debit BINs authorize against real balances and clear differently from credit BINs; business BINs sit behind different scoring; virtual card BINs often skip shipping checks entirely. Match the BIN's product to the exit you plan to use — a prepaid BIN is useless for a payout rail that requires a credit product, and a business BIN flags faster on consumer checkouts.
- Issuing country and rails: same-network BINs from different countries hit completely different fraud models. Domestic BINs against domestic gateways see the softest scoring; cross-border combinations attract the hard path by default — currency checks, geo-distance scoring, and issuer-side velocity rules tuned for foreign traffic.
- Range health before range size: a BIN that has been hammered shows it. Mass decline codes with zero authorizations across thousands of attempts means the range is saturated — every alive account already flagged, every dead account still dead. Move to a fresh range instead of forcing volume onto a cold one.
- Public header sources: BIN lookup services, network issuer directories, and card-pattern databases all publish the six-digit header. The header is free and legal — the attack begins entirely inside the account block after it.
STEP 2 - RANGE MAPPING AND GENERATION
- Structure before volume: sixteen digits total — six-digit BIN, nine-digit account block, one Luhn digit (Amex uses fifteen digits total with a fifteen-digit structure — fifteen-fourteen-fifteen accordingly). Generate the account block first, then compute the check digit; never randomize all sixteen and hope — most candidates die at the Luhn gate before any issuer sees them, which wastes request budget and skews your live-rate statistics.
- Sequential vs random within range: sequential walks cluster your attempts by account number, which pattern-matches trivially — the same range, same source, same hour, monotonically increasing PANs. Random draws from the range look like organic traffic; sequential walks look like a script because they are one. If walking sequentially is unavoidable, stride it — random offsets, no arithmetic progression, no restart from zero after an interruption.
- Exclusion hygiene: skip known-reserved blocks (test numbers, issuer control accounts, ranges published as dead), skip the last few digits of every block where issuers park special-purpose accounts, and dedupe before firing — a candidate you have already declined once carries zero new information.
STEP 3 - GATE BEHAVIOR AND REQUEST DISCIPLINE
- Auth-only vs auth-capture: the two gate modes answer differently. Auth-only ($1, £1, or zero-auth verification) validates and releases — it tells you the number is alive without capturing funds; auth-capture attempts to move money and fails harder and louder when it does. Read the mode before firing: zero-auth checks are the reconnaissance phase, capture is the exploitation phase, and mixing them in one run muddies every statistic you are collecting.
- Decline-code reading: 05 (do not honor), 51 (insufficient funds — the number is alive), 14 (invalid number — structurally dead), 61 (exceeds withdrawal limit — alive), N7 (issuer reject — alive but scored), 96 (system malfunction — try later, not a verdict). The codes that matter most are the ones that prove life: insufficient-funds and limit-exceeded responses are positives wearing failure clothes. A run that produces only 14s is hitting structure; a run that produces 51s and 61s is hitting live accounts.
- Answer asymmetry: some gates return generic errors for everything (protecting the oracle), others pass issuer codes straight through. A generic gate still leaks timing — structurally dead numbers reject at the gateway, alive numbers take the extra hop to the issuer and back. Response-time deltas are a decline code of their own when the body text refuses to speak.
- Payment page reality: hosted checkout pages, tokenized browsers, and 3-D Secure all sit in front of the raw gateway. 3-D Secure on the BIN kills enumeration cold — the challenge either fails for every candidate (useless) or authenticates stolen session context (different method entirely). Non-3D and lax checkout flows are where this method still runs in 2026.
STEP 4 - VELOCITY AND BURN MANAGEMENT
- Per-source windows: every gateway, merchant, and payment service provider publishes its own tolerance through behavior — dozens of auth attempts per minute from one fingerprint will trip soft fraud rules long before any hard limit. Spread across sources, cap attempts per source per window, and never restart a cold source immediately after a block — the block window often extends on repetition.
- Range reputation: attempts against one BIN from one cluster at high speed train the issuer's range-level scoring for everyone. Burn discipline means rotating ranges before the live rate collapses, not after — watch the ratio, not the raw count, and treat a live-rate drop through the floor as the end of that range's run, not a signal to push harder.
- Statistical honesty: track attempts, positives, and time-to-positive per range. A range that never produces a positive across a meaningful sample is dead — the correct move is a different BIN, not a longer run. Ego runs are how checkers end up in fraud reports.
STEP 5 - FROM ALIVE TO USABLE
- Authorization is not chargeability: a positive auth on a zero-dollar check proves the card exists and is open — nothing about balance, credit headroom, or whether the merchant's risk model will let the capture through. Chargeability is proven by a real capture against a real cart at a merchant whose scoring matches the product profile.
- Product match at checkout: prepaid numbers against gift-card or digital-goods checkouts behave differently from credit numbers against physical goods — merchant category codes and product type are scored together. Route the alive number into a checkout category its profile supports instead of forcing every positive through the same door.
- The window after positive: alive numbers decay. Issuers catch enumeration waves, holders see alerts, and a range that paid yesterday flags today. Process positives fast, keep capture patterns human, and never stockpile — a saved alive number is a depreciating asset with a fraud clock on it.
WORKED EXAMPLE - 457173 PREPAID RANGE RUN
A six-digit prepaid debit BIN in the European region, product profile = reloadable prepaid, non-3D checkout confirmed on the target merchant. Generation: nine-digit account block drawn at random across the full range, Luhn digit computed per candidate, dedup against 40,000 previously declined entries from an older run against the same header. Firing: zero-auth checks only, twelve attempts per minute across four rotating payment fingerprints, response codes logged with timestamps. Result after 6,100 attempts: 147 positives — all carrying 51 or 61 decline codes on the capture path, zero 14s past the first 900 attempts (structure was clean from the start). Live rate 2.4%, positives moved to capture within the hour against a digital-goods cart matching the prepaid profile; range abandoned when live rate fell below 0.8% at attempt 8,900 — the issuer had begun range-level scoring, and every additional attempt was training it.
WORKING SEQUENCE
Code:
select: product profile match + non-3D gate confirmed + range health fresh -> generate: random account block + Luhn digit, dedupe against declined cache -> fire: zero-auth only, capped per-source velocity, rotating fingerprints, decline codes + timestamps logged -> read: 51/61 = alive, 14 = structure dead, timing delta = oracle when body is generic -> capture: positives only, cart matches product profile, human pace, process same window -> rotate: live-rate below 0.8% = range burned, new BIN, never resume a cooled rangeQUICK ANSWERS
- Is the BIN itself secret or illegal to know? No — the six-digit header is public infrastructure published by networks and lookup services. The entire offense sits in what you do with the account block behind it: enumeration and unauthorized capture, not possession of the header.
- Why do most generated numbers die before reaching the issuer? Luhn. Roughly one in ten candidates is structurally valid by checksum alone, and of those, the majority reference nonexistent or closed accounts. Generate clean first — every invalid candidate you fire is wasted budget that also trains gateway rate limits against you.
- What is the single most informative decline code? 51, insufficient funds. It is a failure response that confirms a live, open, funded-or-credit-enabled account. Runs that harvest 51s and 61s are working; runs that only see 14s are talking to a wall.
- Does 3-D Secure kill the method? On an enforced challenge, effectively yes — every candidate either fails the challenge uniformly (no signal) or requires live session context (a different attack). BIN selection in 2026 starts by confirming the checkout path is not enforcing 3-D Secure on that issuer.
- How do you know a range is burned before the code says so? The live rate collapses and stops recovering. A range that produced positives then flattens to zero across a few thousand fresh attempts has been range-scored — additional volume only deepens the flag for everyone using that header.
- Zero-auth or capture during enumeration? Zero-auth. Capture moves money, triggers settlement-side monitoring, and produces disputes — all before you know the range is worth it. Reconnaissance first with auth checks, exploitation second with capture, and never both in the same run.
RELATED