# Compromised Payment Credential Monitoring

URL: https://www.deepinfo.com/platform/cti/compromised-payment-credential-monitoring/

## Each Leaked Card Comes With Its Paper Trail.

Card numbers turn up in leak dumps, market listings and paste sites. A number on its own tells a fraud team very little.

The Deepinfo Platform records each leaked card with the attributes your team filters on (BIN, issuer, brand, expiry, whether a CVV came with it) and with its trail: where it was listed, when it was first and last seen, and how many times.

[Request demo](https://www.deepinfo.com/request-demo/) · [Platform guide: Compromised payments](https://docs.deepinfo.com/guide/cti/compromised-payment-credentials/)

### What Each Card Record Carries.

- **Masked number and last four**: The card number with its middle digits hidden, and the last four digits for matching
- **BIN**: The issuer identification number, for filtering to your ranges
- **Issuer and country**: The issuing bank and its country
- **Brand, type and level**: Card brand, card type and card level
- **Expiry**: Expiry month and year, and whether the card has already expired
- **CVV present**: Whether a CVV was listed with the number
- **Luhn valid**: Whether the number passes the Luhn checksum, a quick filter for junk
- **Source**: Leak name, source URL and network, with a hackishness score for the page
- **Sightings**: When the card was first and last seen, and how many times
- **Co-listed cards**: How many other cards appeared in the same listing

Fields as documented in the [Compromised Payment Credential Search reference](https://docs.deepinfo.com/reference/cti/compromised-payment-credential-search/).

### Read a Card Record Like a Fraud Analyst.

The fields are there to rank the queue. These readings do most of the work.

- A number that passes Luhn, has not expired and came with its CVV is ready for card-not-present fraud. It goes to the top.
- A recent last-seen date and a high times-seen count suggest the card is still being passed around.
- A high co-listed count points to a bulk dump. Group those cards by leak name and BIN to work them as one event.

### Issuers and Merchants Read It Differently.

#### [Card Issuers](https://www.deepinfo.com/solutions/industries/financial-services/)

Filter to your BINs, then decide card by card: reissue, block or watch. Issuer name and country keep portfolios and subsidiaries apart.

#### [Merchants and Payment Providers](https://www.deepinfo.com/solutions/industries/retail-ecommerce/)

Group cards by leak name and source to see which listings they came from, and pass that evidence to your acquirer or the issuers concerned.

#### [Fraud and Risk Teams](https://www.deepinfo.com/solutions/use-cases/fraud-prevention/)

Pull matching records into the rules engine or case management you already run, through search or export.

### Close a Whole BIN in One Request.

New cards arrive as `newly_detected` and move through the states used for other CTI credentials: resolved, risk accepted, ignored or false positive, with a revert. Each action takes a search filter, so the cards you review are exactly the cards you change.

Find:

```bash
curl -X POST \
  "https://api.deepinfo.com/v1/cti/compromised-payment-credentials/search" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d @bin.json
```

Resolve:

```bash
curl -X POST \
  "https://api.deepinfo.com/v1/cti/compromised-payment-credentials/search:mark-resolved" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d @bin.json
```

Export:

```bash
curl -X POST \
  "https://api.deepinfo.com/v1/cti/compromised-payment-credentials/search:export?format=csv" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d @bin.json
```

bin.json:

```json
{
  "filters": {
    "must": [
      { "name": "bin", "type": "eq", "value": "YOUR_BIN" }
    ]
  }
}
```

[Compromised Payment Credential Search reference](https://docs.deepinfo.com/reference/cti/compromised-payment-credential-search/)

### Look at Card Data From Other Angles.

- [Compromised Client Credential Monitoring](https://www.deepinfo.com/platform/cti/compromised-client-credential-monitoring/) (CTI): Your customers’ logins to your services, found in leaked data.
- [Dark Web Search](https://www.deepinfo.com/platform/cti/dark-web-search/) (CTI): Search card numbers directly with the `ccn` indicator.
- [Data Breach Index](https://www.deepinfo.com/platform/cti/data-breach-index/) (CTI): Known breaches, with the data types each one exposed.

### Query This Data Through the API

Credentials and dark web findings stay in the Deepinfo Platform. The domain and vulnerability data around them is open through the API.

- [Vulnerability Search API](https://www.deepinfo.com/data-api/apis/vulnerability-search/)
- [Vulnerability Detail API](https://www.deepinfo.com/data-api/apis/vulnerability-detail/)
- [Domain Detail API](https://www.deepinfo.com/data-api/apis/domain-detail/)
- [WHOIS History API](https://www.deepinfo.com/data-api/apis/whois-history/)

### Questions About Compromised Payment Credential Monitoring

**Can we filter to our own BIN ranges?**

Yes. BIN is a searchable field, alongside issuer name, issuer country, card brand, card type and card level. Filters combine with `must`, `should` and `must_not`, and that filter also drives exports and bulk state changes.

**What does Luhn valid mean?**

The Luhn checksum is the check digit built into every card number. A number that fails it was mistyped or made up, so it can be set aside before anyone looks further.

**Can we close every card from one leak at once?**

Yes. Filter on `leak_name`, check the result with a search, then send the same filter to the state change, and every card from that leak moves in one request.

**Can we see how many cards have leaked over time?**

Yes. Payment credential statistics return the total number of card records and a count per year, through the [CTI API](https://docs.deepinfo.com/reference/cti/compromised-payment-credential-stats/).

**How does card data reach our fraud systems?**

Through the CTI API. Search returns matching records as JSON, and export returns all matching records as CSV or JSON without pagination. The endpoints are documented in the [CTI reference](https://docs.deepinfo.com/reference/cti/).

### See Which Cards on Your BINs Have Leaked.

Book a demo. We’ll walk your fraud team through card records, filters and the state workflow on your scope.

[Request demo](https://www.deepinfo.com/request-demo/)