As the evolution of payment digitization and tokenization speeds up, an even greater shift is prompting a big change within the global payments industry. More card users than ever, and more issuers entering the space, have led to a shortage of bank identification numbers (BIN), which help identify the geographical location, type, and brand of the card being used. As a result, the International Standards Organization (ISO) mandated in 2016 that banks switch from 6-digit to 8-digit BINs on all debit and credit cards starting in April 2022. Now that the deadline is here, let’s review what is happening, why, and how this change might impact online merchants. 

What is happening and why?

Starting in April, the payment industry is slowly phasing in a shift from the current 6-digit BIN to an 8-digit BIN. The BIN, that number at the start of the personal account number (PAN) or card number, indicates which card network, issuing bank, and issuing country the card is associated with. 

Right now, digits two to six of a BIN identify the issuing bank. Card networks like Visa and Mastercard that have cards with thousands of issuers, are running out of BIN combinations, so they’re asking their issuing partners to shift to 8-digits BINs. Visa is the first card network to have announced a plan for rolling out changes starting next month. Existing 6-digit BINs will continue to be in use while new credit cards may be issued 8-digit BINs starting in April and onwards. While all 6-digit BINs will not automatically convert into 8-digit BINs overnight, merchants need to start preparing for the impact of this change. 

How does this impact eCommerce merchants?

As more card networks and issuing banks issue 8-digit BINs, merchants won’t be able to rely solely on the first six digits of the PAN. Merchants who don’t adequately prepare for this change could negatively impact the following operations:

1) Fraud management: BINs are frequently used in fraud detection to identify mismatches between the location of the cardholder and the person placing the transaction. Adjusting the structure of the BIN will change the way that fraud models are able to detect country of origin, which would adversely affect approval rates. 

2) Payment data processing: Some merchants use a tokenization service to tag customer credit cards with a unique identifier. They do this to protect the cardholder’s privacy and store the card on file without the actual card number. This 8-digit BIN shift will impact the format in which customers’ BIN data are retrieved from the tokenized systems. That means merchants’ ability to discern good customers from fraudsters may also be impacted. 

3) Gateway routing: Merchants accepting transactions in multiple countries will often work with a different gateway in each one. Since these get routed based on the BIN, these merchants will need to update their systems to be able to handle both 6- and 8-digit BINs and ensure that the data sources they use for BIN values are also up to date.

Ultimately, any lapse in these operations can negatively impact customer experience. Without payment processes that adequately factor in this BIN transition, cardholders could be subjected to false declines or miss benefits offered through specific card networks. 

What do merchants need to do?

To keep customers happy and business sailing smoothly, merchants should actively assess the impacts this change will have across the organization as soon as possible. Start by talking to your payment providers and gateway partners to ensure they are aware of the change and ready to handle it. Check if any changes are expected in the payload data returned by your gateway or tokenization providers. Review any logic specific to the 6-digit BIN and amend to allow for processing of both 6-digit and 8-digit BINs in the near future. While it may take years for the industry to fully switch to 8-digit BINs, merchants need partners who are on top of this change to avoid losing revenue and alienating good customers. 

For more questions about how to leverage a Riskified partnership, reach out to [email protected].