Carding Fundamentals: BIN Analysis & List Building

[Blacksec]

Carding Fundamentals: BIN Analysis & List Building ​

---

> Posted by: card_veteran | Rank: Elite Member | Joined: 2022 [/I]

---

Spoiler: For Educational Purposes

This guide is for security research and authorized testing only.

Let's talk about the fundamentals. Most beginners skip this and go straight to checking - that's how you get burned.

BIN (Bank Identification Number) analysis is the foundation of everything. Understanding how cards work, how BINs are structured, and how to build quality lists separates the professionals from the tourists.

---

━━━ UNDERSTANDING CARD STRUCTURE ━━━[/B]

┌─────────────────────────────────────────────────────────────┐
│                    CREDIT CARD STRUCTURE                     │
├─────────────────────────────────────────────────────────────┤
│  MMMM MMMM MMMM M         L = Luhn Check Digit              │
│  └──┬──┘ └────────────────┘                                 │
│     │        └──────┬──────┘                                 │
│     │               └── issuer identification (BIN)         │
│     └── account number (variable length)                    │
│                                                             │
│  BIN Length: 6-8 digits (most common: 6)                    │
│  Total Length: 13-19 digits (most common: 16)               │
└─────────────────────────────────────────────────────────────┘

Major Card Networks & BIN Ranges:

┌──────────────┬─────────────────┬──────────────────────────────┐
│   Network    │    BIN Range    │      Common Types            │
├──────────────┼─────────────────┼──────────────────────────────┤
│ Visa         │ 4xxx            │ Credit, Debit, Prepaid       │
│ Mastercard   │ 51-55, 2221-2720│ Credit, Debit                │
│ Amex         │ 34, 37          │ Credit (4-digit CVV)         │
│ Discover     │ 6011, 644-649   │ Credit, Debit                │
│ JCB          │ 3528-3589       │ Credit                       │
│ UnionPay     │ 62, 81          │ Credit, Debit                │
│ Maestro      │ 50, 56-58, 63  │ Debit (UK focused)           │
└──────────────┴─────────────────┴──────────────────────────────┘

---

━━━ BIN ANALYSIS TOOLS ━━━

What BIN Info Tells You:

┌─────────────────────────────────────────────────────────────┐
│              BIN Lookup Results                              │
├──────────────────┬──────────────────────────────────────────┤
│ Bank             │ Chase, Wells Fargo, Citi, etc.           │
│ Country          │ US, UK, DE, FR, BR, etc.               │
│ Type             │ Credit, Debit, Prepaid, Gift             │
│ Level            │ Classic, Gold, Platinum, Infinite      │
│ Category         │ Commercial, Consumer, Travel           │
│ Internet         │ PAN Present (Online) - Yes/No          │
│ Contactless      │ Tap to Pay - Yes/No                    │
│ Chip             │ EMV Chip - Yes/No                      │
│ Country Code     │ ISO 3166-1 numeric code                │
│ Currency         │ USD, EUR, GBP, BRL                     │
└──────────────────┴──────────────────────────────────────────┘

Free BIN APIs:

# BIN Lookup API Examples
https://api.binlist.net/{BIN}
https://github.com/wadewang/binlist/raw/master/bins.json

# Python Example
import requests

def get_bin_info(bin_number):
    url = f"https://api.binlist.net/{bin_number}"
    response = requests.get(url)
    return response.json()

# Usage
info = get_bin_info("411111")
print(f"Bank: {info['bank']['name']}")
print(f"Country: {info['country']['alpha2']}")
print(f"Type: {info['type']}")
print(f"Level: {info['level']}")

---

━━━ LIST QUALITY ASSESSMENT ━━━

Key Quality Indicators:

1. Freshness
   - When was the list created?
   - Are cards still active?
   - Check with $1 validation

2. Format Quality
   - Correct Luhn checksum?
   - Proper formatting (XXXX XXXX XXXX XXXX)?
   - Complete CVV2/CVV2 data?

3. Source Reliability
   - Where did the list come from?
   - Is it from a known leak?
   - Check breach databases

4. BIN Distribution
   - Mix of countries?
   - Mix of card types?
   - Healthy percentage of premium cards?

Automated Quality Checker:

#!/usr/bin/env python3
"""
Card List Quality Analyzer
"""
import hashlib
import json
import requests
from datetime import datetime

def luhn_check(card_number):
    """Validate card number using Luhn algorithm"""
    digits = [int(d) for d in str(card_number) if d.isdigit()]
    checksum = 0
    reverse_digits = digits[::-1]
    
    for i, digit in enumerate(reverse_digits):
        if i % 2 == 1:
            digit *= 2
            if digit > 9:
                digit -= 9
        checksum += digit
    
    return checksum % 10 == 0

def analyze_list(file_path):
    """Analyze quality of a card list"""
    results = {
        "total_cards": 0,
        "valid_luhn": 0,
        "invalid_luhn": 0,
        "bins": {},
        "countries": {},
        "formats": {
            "full_cvv": 0,
            "cvv_only": 0,
            "no_cvv": 0,
        }
    }
    
    with open(file_path, 'r') as f:
        for line in f:
            line = line.strip()
            if not line:
                continue
            
            results["total_cards"] += 1
            
            # Extract card number
            parts = line.split(':')
            card_num = parts[0] if parts else line
            
            # Luhn check
            if luhn_check(card_num):
                results["valid_luhn"] += 1
            else:
                results["invalid_luhn"] += 1
            
            # BIN analysis
            bin_code = card_num[:6]
            results["bins"][bin_code] = results["bins"].get(bin_code, 0) + 1
            
            # CVV check
            if len(parts) >= 3 and parts[2]:
                results["formats"]["full_cvv"] += 1
            elif len(parts) >= 2 and parts[1]:
                results["formats"]["cvv_only"] += 1
            else:
                results["formats"]["no_cvv"] += 1
    
    return results

if __name__ == "__main__":
    import sys
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <list_file>")
        sys.exit(1)
    
    results = analyze_list(sys.argv[1])
    print(json.dumps(results, indent=2))

---

━━━ LIVE vs DEAD CARDS ━━━

Understanding Card Status:

LIVE Cards:
• Active and valid
• Have available credit/balance
• Can be used for purchases
• CVV2 matches

TEST/FAILED Cards:
• Declined during validation
• May be invalid, expired, or frozen
• Usually indicates bad list quality
• Not necessarily dead - could be AVS mismatch

DEAD Cards:
• Reported lost/stolen
• Closed accounts
• Frozen by bank
• Cannot be used

GAP Cards:
• Unknown status
• Need validation to determine
• Usually the majority of fresh lists

Validation Methods:

# Paperless methods (safer)
• $0.00 auth checks
• CVV2 verification
• AVS (Address Verification) checks
• Chip vs磁条 checks

# Paper methods (higher risk)
• Physical card validation
• ATM checks
• POS terminal tests
• Carding machines

# Always use proxy rotation for validation
# Never reuse IPs
# Rotate user agents

---

━━━ QUICK REFERENCE ━━━

✅ Always check Luhn validity first
✅ Use BIN lookup for card details
✅ Fresh lists = higher success rate
✅ Mix of BINs = better results
✅ $1 validation before bulk operations
✅ Track your validation results
✅ Never share lists publicly

---

Questions? Drop 'em below.
Next: Checkout automation techniques.

Last edited by card_veteran; 2 hours ago.

---

[SIG]━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
card_veteran | Elite Member | List Analyst
"Quality over quantity - always"
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━[/SIG][/b][/b][/b][/b]