Learn more about non-3DS BINs

[AntiCarder]

What are non-3DS BINs?​

Non-3DS BINs (or non-VBV / non-MSC BINs) are Bank Identification Numbers (the first 6-8 digits of the card) that do not require mandatory 3D Secure authentication (3DS) for online transactions. 3DS is a protocol (Verified by Visa for Visa, SecureCode for Mastercard, SafeKey for Amex, etc.) that adds a verification layer (usually OTP via SMS / push / biometrics). Non-3DS BINs allow transactions to proceed without an additional challenge (only basic authorization: number, CVV, expiry, address).

In 2026, such BINs still exist, but their share has sharply decreased (from ~50-70% in the 2010s to <10-20% in developed regions) due to the global migration to 3DS 2.x (EMV 3-D Secure). Visa and Mastercard are actively pressuring issuers to ensure that all cards are 3DS-enabled, especially in the EU/US (PSD2, SCA regulations). Non-3DS BINs are more common in legacy systems, developing countries, or on prepaid/virtual cards with low security.

Why do they exist?​

• Legacy/old cards: Many BINs were issued before 2018–2022, when static or missing 3DS was the norm. Banks don't always forcefully migrate old cards.
• Regional peculiarities: In countries with weak regulation (parts of Asia, Africa, and Latin America), 3DS is not always required. For example, in the US/Canada, non-3DS BINs are still available on some debit/prepaid cards (Chase legacy, Citi legacy bins).
• Non-VBV/MSC types:
  • Debit/Prepaid: Often without 3DS for simplicity (eg, some US debit with BIN 414720 — legacy Chase debit with non-VBV ~8.4%).
  • Virtual/Disposable: From services like Privacy.com or bank virtual numbers - sometimes non-3DS.
  • Corporate/Business Cards: May be exempt from 3DS in some scenarios (low-risk MCC).
• Exemptions in 3DS 2.x: Even 3DS-enabled BINs can be "frictionless" (without challenge) in 70–95% of cases based on risk-based analysis (device fingerprint, transaction history). But pure non-3DS is when a 3DS is not enrolled at all.

Where are non-3DS BINs still common in 2026?​

• USA: Legacy Chase (BIN 414720, 546657), Citi, Wells Fargo old debit. Non-VBV % ~4–8% on tested cards.
• Asia (India, Philippines, Pakistan): Some local banks (eg, SBI, BDO) have legacy non-3DS, but RBI/regional regulators are pushing for migration (SMS OTP → biometrics).
• LatAm (Mexico, Brazil): Bradesco, Banco do Brasil old bins (eg, 414720-like).
• Africa (Nigeria, Egypt): GTBank, Zenith with non-3DS prepaid.
• Europe/EU: Almost gone (PSD2/SCA requires 3DS for all online transactions >€30). Rare exemptions for low-risk.

Complete lists of non-3DS BINs are published in open/underground sources (forums, PDFs), but they quickly become outdated as banks migrate their BINs. Here's a rough list as of 2026 (from tested sources):

BIN	Type	Country/Bank	Non-3DS Probability	Notes
414720	Debit Legacy	USA / Chase	~8.4%	High limit ($15K–90K), old cards.
546657	Credit Traditional	USA / Chase	~4.2%	Old loan, success rate 91%+.
492000	Debit	India / SBI	Average	Legacy non-VBV.
406029	Credit	Brazil / Bradesco	Low	Often without 3DS in local.
414709	Debit	Mexico / Banorte	Average	Prepaid non-3DS.
510000	Mastercard Debit	Nigeria / GTBank	High	African legacy.

(Lists of 2026 tests - check on BIN-checkers like binx.vip or binlist.net or payment gateways, as they change monthly).

Risks and nuances of use​

• For merchants/shops: Non-3DS transactions carry a high risk of fraud —without 3DS, liability shift falls on the merchant (they pay for the chargeback). Many shops (Amazon, Walmart) block non-3DS BINs or require a manual review.
• Migration: Visa/MC require 3DS for everyone (deadlines 2022–2026 in regions). Non-3DS BINs are often upgraded when the card is reissued.
• Testing: On Stripe/PayPal/Shopify, non-3DS BINs work without a 3DS redirect. But in 2026, many gateways force 3DS even on non-enrolled BINs.

Non-3DS BINs are a thing of the past; a complete phase-out is expected by 2030 (Visa goal). If you need country-specific lists, please inquire.