BIN Lookup

Identifies the issuer, brand, type and country of a payment card from its first digits and tells you whether the BIN is valid.

Overview#

The BIN (Bank Identification Number, also called IIN) is the first six to eight digits of a card number. lookup/bin takes it in the bin parameter and returns isValid, a reason when it is not, blacklisted, and an info object with the card scheme (name, brand, type, currency, prepaid and commercial flags), the card number syntax, the issuing bank (name, city, URL, phone, coordinates) and the issuing country.

Send only the leading digits; never send a full card number to this method.

When to use it#

• Validate a card at checkout before calling the payment gateway.
• Compare the card's country with the customer's billing or IP country.
• Detect prepaid or commercial cards where your policy treats them differently.
• Route payments by scheme or issuer.

Reading the result#

• isValid: false means the number is not a known BIN; reason explains why. Treat repeated invalid BINs from one customer as card testing.
• info.country.alpha2 is where the card was issued. A mismatch with the customer's country is a classic risk signal but also common for travellers, so weigh it with other evidence.
• info.scheme.isPrepaid cards are harder to trace and are used more often in abuse; isCommercial indicates corporate cards.
• info.scheme.type separates debit from credit, which can affect how you price risk.
• blacklisted reflects your own blacklists.

Coverage#

info is always present. For a BIN in our reference data you get the scheme, card type (debit, credit or charge), brand/category (Classic, Platinum, Infinite, World Elite...), prepaid and commercial flags, and the issuing bank's name, URL and phone. Saudi mada cards are recognised by range, including co-badged Visa and Mastercard debit cards. For a BIN we have no record of, you still get the scheme and card syntax derived from the number itself, with the bank and country fields set to null, and isValid reflects the scheme and, when a full number is sent, the Luhn check. Issuer names are normalised to Title Case.

Notes#

• Counts as one request. Test mode returns fake data, is free and raises no events.
• Included in every plan, including Standard.
• Custom rules for the BIN group can test the scheme, card type, prepaid and commercial flags, issuing country and bank, and can mark the BIN as valid or invalid; applied rules show in custom_rules_applied.
• An invalid_bin event is raised when the BIN is judged invalid and goes to your webhooks.
• A missing or malformed value returns error 120 (invalid_bin_number) with HTTP 200. The payment fraud method runs this check itself when you pass a card number.

Request#

• Authenticate with the key parameter or an Authorization: Bearer header.
• Counts as 1 request.
• Available on: Free trial Standard Premium Pay-as-you-go

Parameters#

Every method also accepts format, lang, mode, userID, callback. See Options.

Code samples#

curl -G "https://gurdx.cretip.com/api/lookup/bin" \
  --data-urlencode "key=YOUR_API_KEY" \
  --data-urlencode "bin=45717360"

<?php

$response = file_get_contents('https://gurdx.cretip.com/api/lookup/bin?'.http_build_query(['key' => 'YOUR_API_KEY', 'bin' => '45717360']));
$result = json_decode($response, true);

if ($result['status'] === 'success') {
    print_r($result['data']);
} else {
    echo $result['code'].': '.$result['description'];
}

const params = new URLSearchParams({"key":"YOUR_API_KEY","bin":"45717360"});
const res = await fetch(`https://gurdx.cretip.com/api/lookup/bin?${params}`);
const result = await res.json();

if (result.status === 'success') {
  console.log(result.data);
} else {
  console.error(result.code, result.description);
}

import requests

res = requests.get("https://gurdx.cretip.com/api/lookup/bin", params={"key": "YOUR_API_KEY", "bin": "45717360"})
result = res.json()

if result["status"] == "success":
    print(result["data"])
else:
    print(result["code"], result["description"])

Response#

Success#

{
    "data": {
        "reason": "",
        "isValid": true,
        "blacklisted": false,
        "bin": "456789",
        "info": {
            "scheme": {
                "name": "Visa",
                "coName": "Mada",
                "isLuha": true,
                "isPrepaid": false,
                "isCommercial": false,
                "type": "debit",
                "brand": "Traditional",
                "currency": "SAR"
            },
            "detected_digits": "4",
            "syntax": {
                "gaps": [
                    4,
                    8,
                    12
                ],
                "lengths": [
                    16,
                    18,
                    19
                ],
                "code": {
                    "name": "CVV",
                    "size": 3
                }
            },
            "bank": {
                "id": "588847",
                "identifier": "80",
                "name": "AL RAJHI BANKING AND INVESTMENT CORP.",
                "city": "Riyadh",
                "url": "https://www.alrajhibank.com.sa",
                "phone": "+96611211600",
                "logo": "https://gurdx.io/img/banks/al-rajhi.jpg",
                "latitude": "25",
                "longitude": "45"
            },
            "country": {
                "alpha2": "SA",
                "name": "Saudi Arabia",
                "code": "966",
                "numeric": "682",
                "emoji": "🇸🇦",
                "continent": "Asia",
                "languageCode": "ar",
                "languageNative": "العربية"
            }
        },
        "custom_rules_applied": {
            "total": 0,
            "rules": []
        }
    },
    "status": "success",
    "executionTime": 2
}

Error#

Errors are delivered with HTTP 200 — always check the status field.

{
    "status": "error",
    "code": 101,
    "type": "invalid_key",
    "description": "The API Key is missing or invalid."
}

Response fields#