BIN Intelligence Platform

Neutrino API Integration

The core enrichment module bin_enricher.py accepts BIN values as 6-digit or 8-digit inputs and queries the Neutrino BIN Lookup API over HTTPS. The API returns a structured response containing the issuing bank name, bank phone number, bank URL, card brand (Visa, Mastercard, Amex, Discover, JCB, UnionPay), card type (credit, debit, prepaid, charge), card category (classic, gold, platinum, business, corporate), issuing country with ISO 3166-1 alpha-2 code, and 3D Secure enrollment status. Each response is validated against a JSON schema before being persisted, ensuring data integrity even when the upstream API introduces new fields or changes response formats.

The enrichment pipeline implements a multi-tier caching strategy. Fresh lookups hit the Neutrino API and are cached in a Redis-compatible local store with a configurable TTL (default: 30 days). Subsequent lookups for the same BIN return cached results instantly, reducing API costs and lookup latency to under 1 millisecond for cache hits. Bulk enrichment jobs process BIN ranges in batches of 100 with configurable rate limiting (default: 3 requests per second) to stay within API quotas. Failed lookups are retried with exponential backoff and logged for manual review if they exhaust the retry budget.

Enrichment Versioning

Every enrichment result is stored with a timestamp, creating a versioned history for each BIN. When a re-enrichment job runs (typically monthly), the system compares the new response against the most recent stored version and flags any changes: issuer name updates (indicating bank acquisitions), 3DS enrollment status changes (indicating security posture improvements), or card type reclassifications. These change events are surfaced in the dashboard as alerts and are available through the API's changelog endpoint, enabling fraud teams to track how the card landscape evolves and adjust their rules accordingly.

Fraud Feed Scraping and Classification

The fraud feed module fraud_feed.py monitors publicly accessible breach notification services, paste sites, and threat intelligence feeds for BIN-related fraud indicators. When new BIN data appears in a monitored source, the scraper extracts the BIN values along with contextual metadata: the type of fraud activity (fullz for sale, virtual card generation, carding target lists, account-linked BIN dumps), the publication date, the source category, and any associated pricing or volume indicators that signal the severity of the exposure.

Each extracted BIN is cross-referenced against the enrichment database to append issuer, country, and card type information. The system then classifies the exposure using a rule-based taxonomy that categorizes incidents by exploit type, risk severity (low, medium, high, critical), and affected card population size. A BIN appearing in a fullz dump from a major issuer with 3DS disabled receives a critical severity rating, while a single prepaid card BIN appearing in a low-volume paste receives a low rating. These classifications feed directly into the dashboard's threat timeline and the API's risk scoring endpoint.

Extensible Exploit Taxonomy

The classification taxonomy is defined in a configuration file that maps pattern signatures to exploit types. New exploit categories can be added without code changes: operators define the pattern (regex or keyword set), the severity mapping, and the display name, then reload the configuration. This extensibility ensures the platform can adapt to emerging fraud vectors as they appear without requiring engineering cycles to update classification logic.

Flask Application Architecture

The application entrypoint main.py initializes the Flask application with Blueprint-based route organization. The dashboard routes serve server-rendered templates using Jinja2 with Bootstrap 5 for responsive layout. The API routes return JSON responses with consistent envelope formatting: every response includes a status, data, and meta field. API consumers authenticate using API keys passed in the X-API-Key header, with per-key rate limiting tracked in-memory using a token bucket algorithm.

SQLAlchemy Data Model

The data model in models.py defines three primary entities: BINRecord stores the core BIN data with indexed columns for BIN value, issuer name, country code, card brand, and card type; EnrichmentResult stores the full Neutrino API response with a foreign key to BINRecord and a timestamp for versioning; FraudFeedEntry stores classified exploit data with BIN cross-references, severity ratings, source metadata, and publication timestamps. Composite indexes on (BIN value, enrichment timestamp) and (exploit type, severity, publication date) ensure that the most common query patterns execute in single-digit milliseconds even at tables exceeding 500,000 rows.

REST API Endpoints

The API exposes five primary endpoint groups. GET /api/v1/bin/{bin} returns the latest enrichment for a single BIN with issuer, country, card type, 3DS status, and any associated fraud feed entries. POST /api/v1/bin/batch accepts a JSON array of up to 500 BINs and returns enrichment results in a single response, queuing any unenriched BINs for background processing. GET /api/v1/fraud-feed supports filtered queries by exploit type, severity, date range, and country. GET /api/v1/changelog returns enrichment changes for a BIN or issuer over a date range. GET /api/v1/stats returns aggregate analytics including total BINs indexed, enrichment coverage percentage, fraud feed entry counts by severity, and top-10 affected issuers.

Dashboard Visualizations

The Bootstrap-based dashboard provides three primary views. The BIN Explorer offers a search interface with autocomplete that returns enrichment data, fraud history, and a risk summary for any BIN. The Fraud Feed Timeline presents a chronological view of exploit entries with severity-coded badges, filterable by type, country, and date range. The Analytics view renders Chart.js visualizations: a doughnut chart showing card type distribution across indexed BINs, a choropleth-style country grid showing BIN concentration by issuing country, a stacked bar chart tracking exploit types over time, and a line chart plotting 3DS enrollment rates by issuer tier. All views support CSV and JSON export for offline analysis.

Flask app factory, Blueprint routes, API endpoints

SQLAlchemy schema: BINRecord, EnrichmentResult, FraudFeedEntry

Neutrino API client, caching, batch processing, versioning

Feed scrapers, exploit classifier, severity engine

Jinja2 dashboard templates with Bootstrap 5 and Chart.js

Exploit taxonomy, API rate limits, enrichment TTL settings