BIN
The first six to eight digits of a payment card, identifying the issuing bank, the country and the card product. Not stolen data in itself, but the index the trade is organised around: cards are advertised, sorted and priced by BIN.
Why it matters to you
A BIN tells a fraudster which of your controls they are about to meet, because issuer, country and product predict how a transaction will be authorised. A sudden concentration of attempts on a narrow BIN range is somebody testing one issuer's behaviour, and it usually precedes the volume rather than accompanying it.
Where we meet it
Lists circulate recommending which BINs work against which merchants, and they are maintained. That maintenance is the useful signal: a BIN appearing on a fresh list says something has recently changed about how that issuer decides.
Connected terms
CVV
Card-not-present data: number, expiry, security code and usually the billing address, sold per record for online use. The bulk commodity of card fraud, priced by country, issuer and freshness.
Card dump
The magnetic-stripe data read off a payment card, sold for cloning into a physical one. Distinct from card-not-present data, priced higher, and slowly becoming a legacy good as chip and contactless spread.
Carding
The trade in stolen payment card data and the craft of turning it into goods: testing cards, choosing merchants, shipping to reshippers. An economy with its own schools, slang and reputations.
Checker
A tool that tests stolen credentials against a target service in bulk and sorts the live ones from the dead. The industrialized step between a combolist and an account takeover.
Where this term stops being vocabulary
Dragnet is where you watch it happen to you
Knowing the word is the cheap half. The platform is the half where the term arrives attached to your domain, with a timestamp and the source it came from.
More from the goods
Bank log
Access to a compromised online banking account, sold with the balance quoted in the listing. Priced as a fraction of what it holds, because the buyer still has to get the money out.
Card dump
The magnetic-stripe data read off a payment card, sold for cloning into a physical one. Distinct from card-not-present data, priced higher, and slowly becoming a legacy good as chip and contactless spread.
Combolist
A recycled email:password list compiled from old breaches and other people's logs, resold in bulk. The fast food of the credential economy: cheap, stale, everywhere.
Crypto drainer
A kit sold to fraudsters that empties a cryptocurrency wallet the moment its owner signs a transaction on a malicious site. The victim believes they are minting, claiming an airdrop or connecting to a service, and the signature they give away authorises transfer of everything.