What is a BIN attack on a credit card? Understanding this type of credit card fraud

19.08.2024 - 17:45 / thepointsguy.com

Seeing unauthorized charges on your credit card can be a headache. Removing these charges from your account and getting a replacement card isn't fun, either.

The root cause of why you have unauthorized charges on your credit card can vary, as there are multiple types of credit card fraud.

We've previously seen reports online and received emails from readers with surprise charges on their accounts. In fact, some TPG employees checked their accounts to find surprise charges on their Bilt Mastercard® (see rates and fees).

These fraudulent charges are part of what's known as a BIN (bank identification number) attack. But what is that? And is there anything you can do to protect yourself? Let's take a closer look.

Related: How to identify and prevent credit card fraud

The first six digits of your credit card are the bank identification number. A BIN attack uses brute-force computing to attempt to guess a valid combination of credit card number, expiration date and card verification value, or CVV, number.

While a person can attempt to guess one number at a time, a software program can try thousands of combinations in a matter of seconds. Once it finds a number that works, it can try other (similar) variations and then use those at online merchants — assuming that other cards will have the same initial six digits.

Many of these purchase attempts are blocked without customers seeing any activity on their accounts. However, a spokesperson for Wells Fargo (which issues the Bilt Mastercard) told TPG that purchase "attempts from trusted merchants" have affected some customers.

A statement from Bilt confirmed those unauthorized transactions stemmed from a BIN attack:

From our research, we found that these recent attacks affected more than just the Bilt Mastercard. Ultimately, a BIN attack doesn't care about the type of card you have, nor does it need to get inside a company's software. It's simply trying to find a combination of numbers that will result in a successful transaction. Once it does, the fraudsters hope the affected cardmember won't notice until the fraudsters can make additional purchases or cash withdrawals.

Thus, it doesn't matter what bank issues your credit card or what type of rewards your card earns. BIN attacks also don't require hacking into the bank website or the loyalty program website to succeed.

This reinforces the importance of checking your credit cards regularly for fraudulent charges. This ensures that problems are detected as quickly as possible and prevents further unauthorized transactions.

It's also important to understand who to contact if you do find unauthorized charges on your credit card: the issuing bank. For example, if you detect fraud on your Marriott credit card, you