What is a BIN attack and why is your very small business at risk?

If your business accepts card payments online, it could be targeted by a BIN attack, a type of payment fraud where criminals use automated tools to test stolen or generated card details on e-commerce websites. While cardholders are the primary victims, small businesses can also be affected through transaction fees, chargebacks, customer disputes, and reputational damage.

Key takeaways

• A BIN attack is a form of payment fraud where criminals use bots to test stolen or generated card numbers.
• Small businesses can lose money through transaction fees, chargebacks, and reputational damage.
• Warning signs include unusual low-value purchases, repeated card declines, and spikes in transaction attempts.
• Secure payment processors, CAPTCHA, transaction limits, and employee awareness can help reduce risk.
• In 2023, $677.5 million was stolen through fraudulent card transactions, according to Australian Payments Network.
• The first half of 2024 saw 215,000 cases of credit card fraud reported to the FTC, marking a 6% increase from the previous six months.

What is a BIN attack and how does it work?

Every bank card, whether it's a credit or debit card, contains a unique identifier known as a Bank Identification Number (BIN). It’s the first 6 digits of a credit card and it identifies the bank that issued the card. Think of the BIN as a sort of "calling card" for the bank. It tells the online store or payment processor where the card is from and which financial institution is handling the transaction.

Fraudsters, however, can exploit these numbers through a method called a BIN attack, which involves guessing the remaining digits and card details to use or sell it further as a cracked card.

BIN attacks involve three specific steps: collection, generation, and testing.

First, cybercriminals steal or buy card data from the dark web and then try guessing the remaining details to gain access to a card. Even after having guessed the numbers, they cannot tell which cards are still active. That’s why they test these numbers by making small, frequent purchases through online stores, often using automated bots to attempt multiple transactions rapidly (and the risk is that your online shop could be one of those).  When a transaction goes through, they know they’ve successfully cracked a card. From here, the fraudsters can use the card for purchases or sell the valid card information to other criminals.

Even though each card contains a 16-digit number, it’s surprisingly easy for fraudsters to generate thousands of guesses in a short time. Tools like bots and AI make this process quick and efficient.

By the time you realize what’s happening, your business could have already been hit with dozens of fraudulent transactions, leaving you to deal with the fallout.

Why BIN attacks are a serious risk for small businesses

There are two major risks:

1.      Financial Losses: Depending on your agreement with your payment processor, you might be charged for each attempted transaction. Even if the transaction is declined, you could still face fees. Imagine hundreds or thousands of attempts in just a few days—those fees can add up quickly.

Related: Top 10 Scams Targeting Very Small Businesses: How to Stay Safe and What to Do If You're Scammed

2.      Reputation Damage: If customers discover that fraudulent transactions are linked to your online shop, your reputation could take a serious hit. When people see unfamiliar charges from your store on their card statements, they might report it to their bank, leading to chargebacks, refunds, and negative reviews.

Related: 8 Ways to Protect Your Very Small Business Reputation Online

Signs your business may be experiencing a BIN attack

If your business is targeted by a BIN attack, you might not notice right away unless you know what to look for. Here are some warning signs:

• Unusual low-value transactions: Fraudsters often test small amounts to check if a card is working.
• Frequent card declines Multiple failed transactions in a short period can signal an attack.
• Validation errors. Most purchases require the input of other information normally found on the card, like the CVV or expiration date. A card that’s reporting multiple validation errors is possibly in the middle of being cracked in a BIN attack.
• Use of international cards: If you don’t usually have international customers, this could be suspicious.
• A surge in transaction attempts: If you see a sudden spike in both successful and failed transactions, it’s time to investigate.
• Odd transaction times: For example, if your customers typically shop in the afternoon but you’re seeing purchases at 3 a.m., this is a red flag.
• Increased transaction fees: If your bank suddenly charges you higher fees due to numerous attempted transactions, a BIN attack may be the cause.

One of the clearest indicators of a BIN attack is a sudden increase in customers disputing charges they didn’t make. If a group of customers all notice their cards have been successfully used on your website, they may contact you and/or their bank to dispute the payment as fraudulent and process a refund or chargeback.

This means you’ll have to deal with both the BIN attack and the time and money dealing with each individual customer.

Why small businesses are common targets for BIN fraud

If your business accepts online payments, you’re automatically at risk for a BIN attack. Criminals target businesses of all sizes, but small businesses are often easier targets because they often lacking the cybersecurity resources of larger companies.

 A few factors make a small business more vulnerable:

• Lack of cybersecurity measures: Without protections in place, it’s easier for fraudsters to test card numbers on your website.
• Limited resources: Small businesses may not have the budget for advanced fraud detection systems.
• Reliance on third-party payment processors: If your payment processor doesn’t offer adequate protection, your business could be at risk without you even knowing it.

Related: Most Common Cyber Threats on Small Businesses and How to Prevent Them (Without Hiring an IT Team).

How to protect your business from BIN attacks

Choose a secure payment processor: Look for a payment processor that can identify these types of attacks and has built-in fraud detection tools - features like 3D Secure (3DS), which requires customers to verify their identity through a secondary step, like entering a code sent to their phone. This means a genuine customer can make their purchase but a scammer using software to test various credit card numbers may not be able to get through.

Use CAPTCHA: Implementing CAPTCHA on your checkout page can block bots from running multiple fraudulent card tests on your website.

Set transaction limits: Limit the number of transactions that can come from a single IP address within a given time frame. This can stop fraudsters from bombarding your website with thousands of attempts at once and will not impact your genuine customers.

Monitor transaction patterns: Pay attention to any unusual activity, such as spikes in transaction attempts or purchases made outside your typical business hours. Set up alerts for any abnormal behavior so you can catch potential fraud early.

Know the signs and train your employees: Monitor your accounts frequently to spot suspicious activity, such as high volumes of small transactions, recurring account numbers with different expiration dates, or errors in CVV validation. Make sure your team knows what signs to look for and how to respond to potential fraud.

What to do if your business is under a BIN attack

If you suspect your business is experiencing a BIN attack, here are the steps to take immediately:

1.      Temporarily close your online store: If the attack is ongoing, you might need to shut down your payment system to stop the fraudsters from continuing.

2.      Contact your bank: Your bank’s fraud department can offer immediate guidance and help contain the situation.

3.      Notify your payment processor: They need to be aware of the attack so they can strengthen your defenses.

4.      Report the attack to authorities: Contact local fraud authorities and report the incident.

How Bitdefender helps protect small businesses from online fraud

Bitdefender Ultimate Small Business Security is here to help you with comprehensive protection designed specifically for small businesses. Here's what it offers:

• Phishing and Email Protection: Stops phishing scams and fraudulent emails before they reach your inbox.
• Malware Defense: Keeps your Windows PCs, Macs, iPhones, Android phones, and Windows servers safe from malware, including ransomware.
• Password Manager: It helps you create strong passwords and keeps them secure.
• VPN: Provides unlimited VPN traffic to keep your remote connections safe.
• Scam Copilot: Uses AI to help your team spot scams and avoid threats while boosting your cybersecurity skills.
• Easy to Use: Features a straightforward dashboard that anyone can manage, with no IT expertise needed.

Bitdefender Ultimate Small Business Security is an easy-to-use, all-in-one, affordable solution that protects your business.

Check it out at bitdefender.com/solutions/small-business-security.

FAQs

What is a bin attack?

A BIN attack is a type of payment fraud where criminals use automated tools to test stolen or generated card numbers on online stores. Successful transactions help them identify valid cards that can later be used for fraud.

How do bin attacks affect small businesses?

BIN attacks can lead to transaction fees, chargebacks, reputational damage, customer complaints, and increased fraud monitoring costs for small businesses.

How can I prevent a bin attack on my website?

You can reduce the risk by using a payment processor with fraud detection tools, enabling 3D Secure, adding CAPTCHA, monitoring transaction activity, and limiting repeated payment attempts.

What are the signs of a bin attack?

Common signs include many low-value purchases, repeated payment failures, unusual transaction spikes, increased chargebacks, and transactions from unexpected locations.

Are small businesses targeted by bin fraud?

Yes. Small businesses are frequently targeted because they often have fewer fraud prevention controls than larger organizations.