MasterCard Questions Need For 8-Digit BIN

It happened to the internet in 2011.

In February of 2011, it was announced that the internet protocol most commonly used to route traffic over the web, IPv4, had all but exhausted its supply of numbers for North America. Initially established in 1983 as ARPANET rolled into production, IPv4 was initially developed to support 4.2 billion addresses. At the time, that seemed more than adequate.

About a decade later, it was obvious that 4.2 billion addresses wouldn’t be nearly enough to support the growth of the commercial internet. In the late 1990s, the standards body that oversees global IP address allocation went to work creating a new standard that would allow the internet to continue its expansion and growth. IPv6 was that standard, and today supports the provisioning of 340 undecillion addresses.

It wasn’t an easy change to implement. Network and systems engineers inside of their own organizations were tasked with devising transition plans so that their IPv4 sites would remain compatible with the operating systems that provided access to their sites. The migration to a new standard that gives businesses more flexibility to use the commercial web to expand their own businesses has taken decades and hundreds of millions of man hours to operationalize and continues to this day.

Payments is now facing a similar crossroads.

The Bank Identification Number (aka BIN) – the analog to the internet protocol that tells the worldwide web how to route traffic – is facing its own shortage of numbers.

BINs are the numerical sequence that serve as unique cardholder account identifiers that support the authorization process when a card is presented for payment. BINs carry critical information related to card programs and program benefits and tells processors how to route the payment – to what issuer for authorization and what card network for clearing and settlement. BINs are also the first line of defense in identifying fraud online – matching the geographic location of the cardholder with the individual presenting it for payment.

In other words, BINs are the backbone for how the payments industry communicates with each other when cardholders present a card credential for payment.

But in order to accommodate the growing number of issuers and use cases that will want and need to issue a variety of unique accounts in a rapidly expanding digital payments world, BIN ranges and protocols need to be expanded – and some even believe, totally rethought.

A BIN BY ANY OTHER NUMBER …

MasterCard has been preparing for this digital demand since November 2014 when it announced that it was acquiring a new block of BIN numbers that would work within the existing 6-digit BIN standard. MasterCard SVP for Franchise Development, Andrea Gilman, tells Karen Webster that MasterCard will be adding BIN ranges that begin with “twos” in addition to the “fives” that currently exist for MasterCard issuers to use beginning in October 2016. Merchants will have until June 2017 to ready their POS systems to accommodate this new set of cardholder account numbers.

Gilman says that this move is critical since the use of existing BINs has accelerated to the point of activation that nobody would have envisioned several years ago. Gilman pointed out that just a few decades ago, there were 38,000 cards in the field; today there are roughly 9 billion. As more digital end points involving commerce emerge, she emphasized that the ability to issue more cardholder accounts and support new types of digital credentialing via tokenization becomes paramount. Adding their new BIN range is one important step in giving issuers those tools and that flexibility.

To that end, said Gilman, MasterCard has been working on a multi-pronged approach to bringing the new BINs to the field through education and consistent dialogue with stakeholders so that the impact to their day-to-day payments activities is minimized.

One such initiative has been to build on account range functionality, something MasterCard has been doing for more than a decade. Account ranges allows MasterCard issuers to use a single BIN across portfolios that may have previously extended across several BINs. Flexibility of range and data groupings means the ability leverage information across product groups, from prepaid cards to travel to student debit cards with easier reconciliation while freeing up BIN number for issuers to use as needed.

Gilman emphasized that MasterCard has been active in informing their acquiring customers that they must be ready by October for the changeover, with “incremental” rollouts, and more importantly, reassurance that using these new BINs requires no switch needed or change in architecture that would cause disruption at the point of sale.

SHIFTING THE BIN PARADIGM?

The second BIN initiative is one MasterCard has been keeping close tabs on as part of the ISO working group assembled to study the looming worldwide shortage of BINs. ISO – the International Organization for Standardization – will release its recommendation for expanding the existing BIN structure later this week after examining a number of alternatives.

ISO’s recommendation will be to adopt an eight-digit BIN for all new BINs issued by ISO. The account number standard will not change from 16 digits to 19, although that was contemplated and widely expected. It will be up to each payment network to decide if and when to implement this change.

While some in the industry view the ISO recommendation to move from a six-digit BIN to an eight-digit BIN a necessary move, Gilman says MasterCard does not.

Although the worldwide BIN shortage is of real concern, she says that the “heavy lift” required for the entire payments industry to retool its entire payments infrastructure will take years – possibility even decades — and will create system-wide implementation challenges. Other less time and resource intensive options, she asserts, that leverage technologies and existing resources are available for issuers to consider and implement, and that solve for the problem of more BINs in a digital commerce world.

Unlike MasterCard’s move to the “twos,” which is essentially the equivalent of a software update to remain compliant, Gilman said that the move to an eight-digit BIN will require that every single system across every single player in the payments ecosystem change in order to process these new cards. For example, Gilman points out that issuers today that use a six-digit BIN use “the two open slots” – positions 7 and 8 – to derive intelligence about their cardholders and their transactions. Eliminating those slots will mean that their own systems and operations must be reconfigured and business processes rethought so as not to lose what they already have and use to run their businesses.

Gilman likened the expansion of BINs, beyond six digits to eight digit major industry identifiers to a “one for 100 stock split,” wherein a little bit of expansion produces a lot of available inventory for new BINs. But, as Gilman explained, there are less disruptive alternatives that can solve for the shortage of BINs yet not force a decade (or more) worth of investment in operational changes that could also mean taking the industry’s eye off more important and value-adding digital initiatives.

So despite the ISO working group’s recommendation, it is just that – a recommendation. This October we’ll see MasterCard take one big step to usher in a new kinder and gentler warm-up act to solving for the realities of transacting in the digital age.

Unlike the internet back in the 1990s that didn’t anticipate any other option but to totally reconfigure how internet access would happen, it seems that at least the payments industry has other less disruptive options to consider.