Advanced BIN Risk Scoring 2026: Reduce Fraud by 67% While Boosting Conversions

// Example BIN data structure from Bin Search Lookup API
{
    "bin": "411111",
    "issuer": "JPMORGAN CHASE BANK, N.A.",
    "scheme": "visa",
    "type": "CREDIT",
    "brand": "VISA PLATINUM",
    "country": {
        "name": "UNITED STATES",
        "code": "US",
        "currency": "USD"
    },
    "prepaid": false,
    "commercial": false,
    "virtual": false,
    "risk_score": 15, // Added risk scoring
    "risk_factors": ["low_risk_issuer", "established_bank"]
}

// Detecting BIN attack patterns
function detectBinAttack(transactions) {
    const recentBins = new Set();
    const attackThreshold = 10; // 10 unique bins in 5 minutes

    return transactions.filter(tx => {
        const bin = tx.cardNumber.slice(0, 8);
        if (recentBins.has(bin)) {
            return false;
        }
        recentBins.add(bin);
        return recentBins.size > attackThreshold;
    });
}

// PSD2 SCA Exemption Logic with BIN Risk Scoring
async function determineSCARequirement(transaction) {
    const riskScore = await calculateRiskScore(transaction);
    const amount = transaction.amount;

    // TRA Exemption Thresholds (PSD2 compliant)
    if (amount <= 100 /* €100 */ && riskScore < 25) {
        return { "sca_required": false, "reason": "TRA exemption: low risk" };
    }

    if (amount <= 250 /* €250 */ && riskScore < 15) {
        return { "sca_required": false, "reason": "TRA exemption: very low risk" };
    }

    if (amount <= 500 /* €500 */ && riskScore < 10) {
        return { "sca_required": false, "reason": "TRA exemption: minimal risk" };
    }

    // 3DS2 Frictionless Flow for medium risk
    if (riskScore < 40) {
        return { "sca_required": true, "method": "3DS2_frictionless" };
    }

    // 3DS2 Step-up for higher risk
    return { "sca_required": true, "method": "3DS2_step_up" };
}

// Bin Search Lookup API Integration for Risk Scoring 2026
// Base URL: https://api.binsearchlookup.com
// Required Headers: X-API-Key, X-User-ID

const BinSearchLookup = {
    // Your API credentials from dashboard
    apiKey: 'bsl_4eC39HqLyjWDarjtT1zdp7dc1234567890abcdef1234567890abcdef12',
    userId: 'a1b2c3d4-e5f6-7890-abcd-ef1234567890',
    baseUrl: 'https://api.binsearchlookup.com',

    // Single BIN lookup with enhanced data
    async lookupBin(bin) {
        const response = await fetch(
            `${this.baseUrl}/lookup?bin=${bin}`,
            {
                method: 'GET',
                headers: {
                    'X-API-Key': this.apiKey,
                    'X-User-ID': this.userId,
                    'Content-Type': 'application/json'
                }
            }
        );

        if (!response.ok) {
            const error = await response.json();
            throw new Error(`BIN lookup failed: ${error.error || response.statusText}`);
        }

        return await response.json();
    },

    // Batch BIN lookup (max 50 BINs)
    async lookupBatch(bins) {
        if (!Array.isArray(bins) || bins.length === 0) {
            throw new Error('BIN array is required');
        }

        if (bins.length > 50) {
            throw new Error('Maximum 50 BINs per batch request');
        }

        const response = await fetch(
            `${this.baseUrl}/lookup/batch`,
            {
                method: 'POST',
                headers: {
                    'X-API-Key': this.apiKey,
                    'X-User-ID': this.userId,
                    'Content-Type': 'application/json'
                },
                body: JSON.stringify({ bins })
            }
        );

        if (!response.ok) {
            const error = await response.json();
            throw new Error(`Batch lookup failed: ${error.error || response.statusText}`);
        }

        return await response.json();
    },

    // Check quota usage
    async getQuota(publicUserId) {
        const response = await fetch(
            `${this.baseUrl}/api/quota/${publicUserId}`,
            {
                method: 'GET',
                headers: {
                    'X-API-Key': this.apiKey,
                    'Content-Type': 'application/json'
                }
            }
        );

        if (!response.ok) {
            throw new Error(`Quota check failed: ${response.status}`);
        }

        return await response.json();
    },

    // Advanced BIN Risk Scoring Implementation
    async scoreTransactionRisk(transaction) {
        // Extract BIN from card number (first 6-8 digits)
        const bin = transaction.cardNumber.slice(0, 8);

        // Get BIN data from API
        let binData;
        try {
            const result = await this.lookupBin(bin);
            binData = result.data;
        } catch (error) {
            // Fallback to default risk assessment if API fails
            console.warn(`BIN lookup failed for ${bin}: ${error.message}`);
            return this.calculateFallbackRiskScore(transaction);
        }

        // Combine BIN data with transaction context
        const riskFactors = this.analyzeRiskFactors(binData, transaction);

        // Calculate comprehensive risk score (0-100)
        let riskScore = 50; // Start with neutral score

        // Geographic risk factors
        if (binData.isoCode2 !== transaction.ipCountry) riskScore += 15;
        if (binData.isoCode2 !== transaction.billingCountry) riskScore += 20;
        if (transaction.shippingCountry && binData.isoCode2 !== transaction.shippingCountry) {
            riskScore += 10;
        }

        // Card type risk adjustments
        if (binData.Type === 'PREPAID') riskScore += 25;
        if (binData.Type === 'DEBIT') riskScore += 5;
        if (binData.Type === 'CREDIT') riskScore -= 5;

        // Country risk tiers (2026 updated list)
        const highRiskCountries = ['PK', 'NG', 'ID', 'VN', 'BD', 'IR', 'RU'];
        const lowRiskCountries = ['LU', 'DK', 'FI', 'NO', 'NL', 'SE', 'CH', 'SG'];

        if (highRiskCountries.includes(binData.isoCode2)) riskScore += 30;
        if (lowRiskCountries.includes(binData.isoCode2)) riskScore -= 15;

        // Transaction amount risk
        if (transaction.amount > 500) riskScore += 10;
        if (transaction.amount > 1000) riskScore += 15;

        // Time-based risk (high-risk hours 00:00-06:00)
        const hour = new Date().getHours();
        if (hour >= 0 && hour < 6) riskScore += 10;

        // Clamp score between 0-100
        riskScore = Math.max(0, Math.min(riskScore, 100));

        // Determine action based on risk score
        let action = 'approve';
        let requires3DS = false;
        let recommendation = '';

        if (riskScore > 75) {
            action = 'decline';
            recommendation = 'High risk - Recommend decline';
        } else if (riskScore > 50) {
            action = 'review';
            requires3DS = true;
            recommendation = 'Medium risk - Require 3DS2 step-up authentication';
        } else if (riskScore > 25) {
            action = 'approve_with_3ds';
            requires3DS = true;
            recommendation = 'Low-medium risk - Use frictionless 3DS2';
        } else {
            action = 'approve';
            recommendation = 'Low risk - Auto approve with SCA exemption';
        }

        // PSD2 SCA optimization check
        const scaRequirement = this.checkSCARequirement(riskScore, transaction.amount);

        return {
            transactionId: transaction.id,
            bin: bin,
            riskScore: Math.round(riskScore),
            action: action,
            requires3DS: requires3DS,
            scaExempt: scaRequirement.exempt,
            recommendation: recommendation,
            riskFactors: riskFactors,
            binData: binData,
            timestamp: new Date().toISOString(),
            processingTime: Date.now() - transaction.startTime
        };
    },

    // Analyze BIN-specific risk factors
    analyzeRiskFactors(binData, transaction) {
        const factors = [];

        // Geographic mismatch detection
        if (binData.isoCode2 !== transaction.ipCountry) {
            factors.push({
                type: 'geographic_mismatch',
                severity: 'medium',
                description: `Card issued in ${binData.CountryName} but IP from ${transaction.ipCountry}`
            });
        }

        // High-risk card types
        if (binData.Type === 'PREPAID') {
            factors.push({
                type: 'prepaid_card',
                severity: 'high',
                description: 'Prepaid cards have higher fraud rates'
            });
        }

        // High-risk countries
        const highRiskCountries = ['PK', 'NG', 'ID', 'VN'];
        if (highRiskCountries.includes(binData.isoCode2)) {
            factors.push({
                type: 'high_risk_country',
                severity: 'high',
                description: `Card issued in high-risk country: ${binData.CountryName}`
            });
        }

        // Unknown or new issuers
        if (binData.Issuer.includes('UNKNOWN') || !binData.IssuerPhone) {
            factors.push({
                type: 'unknown_issuer',
                severity: 'medium',
                description: 'Issuer information incomplete or unknown'
            });
        }

        return factors;
    },

    // PSD2 SCA requirement check with BIN risk scoring
    checkSCARequirement(riskScore, amount) {
        // PSD2 Transaction Risk Analysis (TRA) thresholds
        const thresholds = {
            under_100: { amount: 100, riskScore: 25 },
            under_250: { amount: 250, riskScore: 15 },
            under_500: { amount: 500, riskScore: 10 }
        };

        if (amount <= thresholds.under_100.amount && riskScore < thresholds.under_100.riskScore) {
            return { exempt: true, reason: 'TRA exemption: low risk under €100' };
        }

        if (amount <= thresholds.under_250.amount && riskScore < thresholds.under_250.riskScore) {
            return { exempt: true, reason: 'TRA exemption: very low risk under €250' };
        }

        if (amount <= thresholds.under_500.amount && riskScore < thresholds.under_500.riskScore) {
            return { exempt: true, reason: 'TRA exemption: minimal risk under €500' };
        }

        // 3DS2 optimization based on risk
        if (riskScore < 40) {
            return { exempt: false, method: '3DS2_frictionless', reason: 'Low risk - Frictionless flow' };
        }

        return { exempt: false, method: '3DS2_step_up', reason: 'Medium risk - Step-up authentication required' };
    },

    // Fallback risk calculation if API unavailable
    calculateFallbackRiskScore(transaction) {
        let score = 60; // Default to medium-high risk when unsure

        // Basic geographic checks
        if (transaction.ipCountry !== transaction.billingCountry) {
            score += 20;
        }

        // Amount-based risk
        if (transaction.amount > 100) score += 5;
        if (transaction.amount > 500) score += 10;

        // Time-based risk
        const hour = new Date().getHours();
        if (hour >= 0 && hour < 6) score += 15;

        return {
            transactionId: transaction.id,
            riskScore: Math.min(score, 100),
            action: score > 70 ? 'review' : 'approve_with_3ds',
            requires3DS: true,
            recommendation: 'Using fallback risk assessment - BIN data unavailable',
            timestamp: new Date().toISOString()
        };
    }
};

// Example usage
async function exampleUsage() {
    const transaction = {
        id: 'txn_123456',
        cardNumber: '5510291234567890',
        amount: 149.99,
        ipCountry: 'US',
        billingCountry: 'CA',
        shippingCountry: 'CA',
        startTime: Date.now()
    };

    try {
        const riskAssessment = await BinSearchLookup.scoreTransactionRisk(transaction);
        console.log('Risk Assessment:', riskAssessment);

        // Check quota usage
        const quota = await BinSearchLookup.getQuota('a1b2c3d4-e5f6-7890-abcd-ef1234567890');
        console.log('API Quota:', quota);

        // Batch lookup example
        const batchResult = await BinSearchLookup.lookupBatch(['551029', '411111', '371449']);
        console.log('Batch Result:', batchResult.summary);

    } catch (error) {
        console.error('Error:', error.message);
        // Implement fallback logic here
    }
}

# Python 3.9+ implementation for Bin Search Lookup API
import requests
import json
from typing import Dict, List, Optional
from datetime import datetime

class BinSearchLookupAPI:
    def __init__(self, api_key: str, user_id: str):
        self.api_key = api_key
        self.user_id = user_id
        self.base_url = "https://api.binsearchlookup.com"
        self.session = requests.Session()
        self.session.headers.update({
            "X-API-Key": api_key,
            "X-User-ID": user_id,
            "Content-Type": "application/json"
        })

    def lookup_bin(self, bin_number: str) -> Dict:
        """Single BIN lookup"""
        url = f"{self.base_url}/lookup"
        params = {"bin": bin_number}

        response = self.session.get(url, params=params)
        response.raise_for_status()
        return response.json()

    def lookup_batch(self, bins: List[str]) -> Dict:
        """Batch BIN lookup (max 50 BINs)"""
        if len(bins) > 50:
            raise ValueError("Maximum 50 BINs per batch request")

        url = f"{self.base_url}/lookup/batch"
        payload = {"bins": bins}

        response = self.session.post(url, json=payload)
        response.raise_for_status()
        return response.json()

    def calculate_bin_risk_score(self, bin_data: Dict, transaction: Dict) -> int:
        """Calculate risk score based on BIN data and transaction context"""
        score = 50  # Neutral starting point

        # Geographic risk factors
        if bin_data.get("isoCode2") != transaction.get("ip_country"):
            score += 15
        if bin_data.get("isoCode2") != transaction.get("billing_country"):
            score += 20

        # Card type risk
        card_type = bin_data.get("Type", "").upper()
        if card_type == "PREPAID":
            score += 25
        elif card_type == "DEBIT":
            score += 5
        elif card_type == "CREDIT":
            score -= 5

        # Country risk tiers
        high_risk_countries = {"PK", "NG", "ID", "VN", "BD", "IR", "RU"}
        low_risk_countries = {"LU", "DK", "FI", "NO", "NL", "SE", "CH", "SG"}

        country_code = bin_data.get("isoCode2")
        if country_code in high_risk_countries:
            score += 30
        elif country_code in low_risk_countries:
            score -= 15

        # Clamp score
        return max(0, min(score, 100))

    def get_quota(self, public_user_id: str) -> Dict:
        """Check API quota usage"""
        url = f"{self.base_url}/api/quota/{public_user_id}"
        response = self.session.get(url)
        response.raise_for_status()
        return response.json()

# Usage example
if __name__ == "__main__":
    api = BinSearchLookupAPI(
        api_key="bsl_4eC39HqLyjWDarjtT1zdp7dc1234567890abcdef1234567890abcdef12",
        user_id="a1b2c3d4-e5f6-7890-abcd-ef1234567890"
    )

    # Single BIN lookup
    result = api.lookup_bin("551029")
    print(f"BIN Data: {json.dumps(result, indent=2)}")

    # Batch lookup
    batch_result = api.lookup_batch(["551029", "411111", "371449"])
    print(f"Batch Summary: {batch_result.get('summary')}")

{
    "bin": "551029",
    "success": true,
    "data": {
        "BIN": "551029",
        "Brand": "MASTERCARD",
        "Type": "DEBIT",
        "Category": "STANDARD",
        "Issuer": "BANK OF MONTREAL",
        "IssuerPhone": "+18772255266",
        "IssuerUrl": "http://www.bmo.com",
        "isoCode2": "CA",
        "isoCode3": "CAN",
        "CountryName": "CANADA",
        "similarBins": [],
        "cached": false,
        "responseTime": 2
    },
    "statusCode": 200,
    "responseTime": 17
}

{
    "error": "Invalid API key or user ID",
    "code": "UNAUTHORIZED",
    "statusCode": 401
}

// ❌ DON'T: Use static rules that block entire regions
if (binData.country.code === 'NG') {
    declineTransaction(); // Blocks all Nigerian cards
}

// ✅ DO: Use risk scoring with nuanced thresholds
if (riskScore > 75 && binData.country.code === 'NG') {
    // Only decline high-risk Nigerian transactions
    if (!hasPositiveHistory() && isPrepaidCard()) {
        declineTransaction();
    } else {
        require3DS();
    }
}