4

We currently check a credit card number with a Reg Ex to find the card type using ranges from Wikipedia but this is not up to date.

This SO article is similar to the requirement and provides a good link to a Barclaycard Resource, however this would require being manually checked to make into a Reg Ex or other system.

Does anyone use or know of a maintained / updated Regex or csv that can be easily imported when changes are made to these ranges, for example when the new Mastercard debit cards are rolled out.

Update

We now get an IIN xml file from Verifone who do our card processing. The file is read top down until the first range that matches the leading 6 digits of the card number is found.

Community
  • 1
  • 1
PMC
  • 4,698
  • 3
  • 37
  • 57
  • The credit card number allocation change from time to time. Instead of maintaining your own list, why not leverage on 3rd party API for checking, such as http://www.fraudlabspro.com. It's updated and free. – Chris Lim Mar 17 '14 at 05:36

1 Answers1

5

If all you need is a card type, then an algorithmic approach is probably best (e.g. a "4" prefix is Visa, "5" is Mastercard, etc.). But if you require the issuing country, institution, etc. then access to a regularly updated BIN list is a must.

If you have a merchant relationship with a bank you should be able to obtain one from them, probably under some non-disclosure arrangement. Without a relationship most banks are likely to just say "no". Access to a BIN list is not a big security risk, but the banks do love to have their secrets :-) I know RBS has one available to select customers.

At a previous company I worked with, we scheduled a monthly download from their bank's password-protected web site, and then imported it into our risk management database. The risk management team still needed manual processes for unlisted BIN ranges, since there is a delay between when a range is activated and when your bank's data is updated.

Depending on your requirements you may need to handle sub-BIN ranges (9 or 10 digit prefixes) as a major bank may assign part of a range to minor players or branding services. This is especially important when differentiating between debit cards and credit cards (risk level is usually higher for credit cards).

Some banks don't have very good data validation on these lists (one I saw was just a very long Excel spreadsheet) - encountering duplicate, split and merged ranges is very likely, so you'll need a range-based merge algorithm - a bit tricky to get all the edge conditions right.

A decent version of the BIN list will include the prefix range, card type (with separate credit and debit types), the country, card number length and institution name. You'll probably have to programatically manage a "last modified" field in the importer logic.

If you need to perform a risk assessment you may also want to look into MaxMind's online MinFraud subscription service (I'd recommend the extra results from the Premium version). It provides a good risk score for around $0.01 per query.

devstuff
  • 8,277
  • 1
  • 27
  • 33
  • Thanks for this in-depth reply. I have a document from HSBC but this isn't as accurate as the Barclaycard link above. I need to seperate credit and debit cards and I'm currently writing a long regex with the updates as probably the best solution and will keep an eye on updates (and nag the bank again). – PMC Jan 28 '11 at 15:34