This article helps understand what nonvbv bins entails:
What are non-3DS BINs?
Non-3DS BINs (or non-VBV / non-MSC BINs) are Bank Identification Numbers (the first 6-8 digits of the card) that do not require mandatory 3D Secure authentication (3DS) for online transactions. 3DS is a protocol (Verified by Visa for Visa, SecureCode for Mastercard, SafeKey for Amex, etc.) that adds a verification layer (usually OTP via SMS / push / biometrics). Non-3DS BINs allow transactions to proceed without an additional challenge (only basic authorization: number, CVV, expiry, address).
In 2026, such BINs still exist, but their share has sharply decreased (from ~50-70% in the 2010s to <10-20% in developed regions) due to the global migration to 3DS 2.x (EMV 3-D Secure). Visa and Mastercard are actively pressuring issuers to ensure that all cards are 3DS-enabled, especially in the EU/US (PSD2, SCA regulations). Non-3DS BINs are more common in legacy systems, developing countries, or on prepaid/virtual cards with low security.
Why do they exist?
Legacy/old cards: Many BINs were issued before 2018–2022, when static or missing 3DS was the norm. Banks don't always forcefully migrate old cards.
Regional peculiarities: In countries with weak regulation (parts of Asia, Africa, and Latin America), 3DS is not always required. For example, in the US/Canada, non-3DS BINs are still available on some debit/prepaid cards (Chase legacy, Citi legacy bins).
Non-VBV/MSC types:
Debit/Prepaid: Often without 3DS for simplicity (eg, some US debit with BIN 414720 — legacy Chase debit with non-VBV ~8.4%).
Virtual/Disposable: From services like bank virtual numbers - sometimes non-3DS.
Corporate/Business Cards: May be exempt from 3DS in some scenarios (low-risk MCC).
Exemptions in 3DS 2.x: Even 3DS-enabled BINs can be "frictionless" (without challenge) in 70–95% of cases based on risk-based analysis (device fingerprint, transaction history). But pure non-3DS is when a 3DS is not enrolled at all.
