BINs for Facebook, Google and TikTok: bank, country and approval — an open passport format

Card numbers are issued under ISO/IEC 7812; the first six or eight digits are the issuer identification number, the BIN, and the very first digit separately encodes the industry (the major industry identifier). Since April 2022 Visa assigns eight-digit BINs and requires acquirers to support them, so checkers working off six digits get the new ranges wrong — the issuer and the product are baked into eight.

Processing hands a merchant more than you would think. Stripe returns funding (credit, debit, prepaid, unknown), country, brand and a fingerprint in the card object, and the fingerprint shows that the same number is attached to different customers. Adyen returns fundingSource, issuingCountryCode and isCardCommercial through cardDetails — whether it is a business or a consumer card. binlist.net returns the network, type, country, currency and bank from the first 6–8 digits. So before the first charge the ad network knows almost everything about the card: who issued it, in which country, prepaid or debit, and how many ad accounts already sit on that number.

One BIN is one product from one issuer. When hundreds of grey-vertical ad accounts settle on it, declines, chargebacks and bans go up; platform antifraud and the processors (Stripe and Adyen work on Meta's side) raise the risk on the whole range, and rejections start hitting every holder of that BIN, the clean ones included. That is how a “burnt payment method” turns from slang into a measurable problem.

Sources name different thresholds: the vc.ru review (25.08.2026) advises against a BIN whose share of successful transactions over a month is below 60–70%, and warns separately about the first bill — the first charge after attachment, the most dangerous one, where the norm is 90%+. Traffic Cardinal names a BIN “that has already spent tens of millions” as a ban cause outright. Providers treat this with rotation and fresh BINs, hence the premium on them and the “trusted BIN” marketing. There is no official list of burnt BINs and there cannot be one: it changes every week. e.PN shows in the dashboard which BINs went through on a given platform, and Brocard added a BIN-by-merchant auto filter in September 2026 — both closer to the truth than a static “list of working BINs” from a chat.

• Facebook. Tier-1 (US, UK, EU), 3DS optional. What decides it is the BIN country matching the account geo, the IP and the billing address. Hong Kong as the Asian alternative comes from AdsCard, Brocard and Multicards.
• Google Ads. Non-prepaid only: “Google does not accept prepaid cards for postpay”. You need a card with a standing history for postpay; Google runs an AVS check on name, address and postcode, so billing details have to be complete and match the BIN country.
• TikTok. 3DS is mandatory — cards without OTP confirmation get rejected; the issuer country has to match the Business Center country. Switching to automatic payment is irreversible.
• Microsoft Advertising. Prepaid is accepted only on prepay accounts; cards that require a PIN are not accepted at all.

Prepaid or debit is decided by the BIN, not by the provider's promise — check an issued test card in a BIN checker (binlist.net, and for new ranges by eight digits). One BIN “for everything” is the cheapest option and the fastest route to declines on Google, where prepaid does not pass.

Providers type their cards by network. Multicards assigns a BIN per platform and forbids changing what a card is used for. PST splits the lines: “Advertisement” without 3DS for Facebook and “Universal” with 3DS for subscriptions and services. e.PN shows a BIN-per-platform checker. The point is that Google and TikTok want non-prepaid BINs with 3DS and history, while Facebook does not require 3DS — and one range is rarely good for all of it at once.

Cards “without 3DS” are prized because you can attach them and charge them with no live person holding a phone, which suits ad account farms. But that comes at two prices. Without 3DS there is no liability shift, so fraud chargebacks stay with the merchant — Meta and Google make up for it with hard BIN scoring, so some first attachments simply do not go through. And leaked card details with no 3DS mean instant fraud, while a chargeback on it hits both the ad account and the whole BIN. Providers who keep 3DS deliver the codes to the dashboard, to email or to a Telegram bot, so the code does not go to a real owner's phone in another time zone.

Of the 26 competitor landing pages we went through, not one names the issuing bank behind a BIN. The most you get is a “50+ BINs” counter and a region; cpa.rip gives country codes, e.PN a figure of “36 banks” with no list, Pay2.House a country breakdown (UK 8, HK 12, EE 8, US 10, CA 5, SG 7). The NeCard BIN passport gives, per BIN, the bank, country, network, the date it went in, which platforms it is tested on and approval over 30 days. The format is on the main page; it arrives with the direct bank programmes.