Identity & access
Banking data leaks
We detect the cards issued under your BINs for sale on illicit markets, and the cards and accounts (IBAN) of your domains in stealer logs and leaks, shown masked. Banking data leak monitoring detects the payment cards issued under your own bank identification numbers (BIN) put up for sale on illicit markets, for card issuers, banks, fintechs and retailers with their own cards, and the payment cards and bank account numbers (IBAN) of the people in your perimeter found in information-stealer logs and data leaks.
The problem
A stolen payment card is resold in batches sorted by issuer: the first digits, the BIN, say which bank, fintech or retailer issued it. The batch circulates for days before the first dispute, and the issuer learns of it from its customers. On the other side, a stealer log or a database leak holds the cards and accounts your employees and customers saved in their browser. Our collection partners see those batches and logs as soon as they circulate; what is missing is the match against your BINs and your people.
Client area preview
What you see
Fictional data, for illustration only: no client, no real data.
What you get: the batches carrying your BINs and the cards and accounts of your perimeter, masked (BIN and last four digits, masked IBAN), with the source, the date and the status, revealable on demand inside your perimeter.
- 01
The batches of cards for sale that carry your BINs, with the marketplace, the date, the announced volume, country and price
- 02
The cards and bank accounts (IBAN) of the people of your domains found in stealer logs and leaks, masked: BIN and last four digits, brand, expiry and issuer for a card, masked IBAN and bank for an account, with the source, the date and the device they came from
- 03
The status of every card or account: to block, blocked, issuer or bank notified, dispute opened, and the export for your fraud team
A limit stated plainly · A card seen in a batch or a log has not necessarily been used: we say that it circulates, where and since when, never that a fraud took place.
How it works
Our answer in three steps
VesperID matches every batch put up for sale against your declared BINs and every stealer log or leak against the people of your domains, shows every card masked (BIN and last four digits) and every IBAN masked, revealable on demand with a reason and only inside your perimeter, and hands you the playbook: block the card, notify the issuer or the bank, open the fraud process, document the dispute.
- 01
You declare your BINs, six to eight digits, if you issue cards (card issuer, bank, fintech, retailer with its own card), and your verified domains for the cards and accounts of the people in your perimeter.
- 02
Our collection partners follow the card marketplaces and acquire stealer logs and leaks as soon as they circulate; the platform matches every batch against your BINs and every record against the identities of your domains. The full number, the CVV, the track data and the holder’s full name are removed before any storage: we keep only the BIN, the last four digits, the brand, the expiry, the issuer, the announced country and price of the batch, the holder’s initials, a masked IBAN and the bank.
- 03
The platform sends the alert with the playbook. The full number of a card or an account is revealed on demand, with a mandatory reason, within the daily quota and only inside your perimeter: a card under one of your declared BINs, an IBAN of a verified identity. At your request, an analyst qualifies a batch and discards an old relisting.
Where this data comes from
Batches come from the card marketplaces followed by our partners’ analysts, closed spaces included; the cards and accounts of people come from the stealer logs and leaks acquired as soon as they circulate. VesperID matches, masks and keeps no full number.
Our sources in detailCross analyses
What the platform computes on top
This service’s data is crossed with the others’: here are the analyses that come out of it, all visible in the client area.
Discover the platform- 01
Prioritisation
A fresh batch carrying your BIN ranks above an old card from a compilation: severity, freshness, announced volume and criticality rank the queue.
- 02
Chain from the infected device
A card captured by an information stealer is tied to the infected device and to the credentials of the same log: the chain links the device, the accesses and the card, with the isolation playbook.
- 03
“Card exposure” playbook
Block the card, notify the issuer, open the fraud process, document the dispute: the steps in the order in which they cut the exposure.
What you receive
Banking data leaks
- 01
One alert per batch for sale and per card or account found, with the expected action
- 02
Table of exposed cards and accounts, masked (BIN and last four digits, masked IBAN), reveal on demand under journal, CSV export for the fraud team
- 03
“Card exposure” playbook (block the cards, notify the issuer, open the fraud process, document the dispute) and “bank account exposure” playbook (notify the bank, watch the account, inform the holder, document the dispute)
- 04
Monthly follow-up of batches, blocked cards and the time between listing and blocking
Frequently asked questions
Do you keep the card numbers?
No. We keep the BIN, the last four digits, the brand, the expiry and the issuer of a card, a masked IBAN and the bank of an account; the full number, the CVV, the track data and the holder’s full name are never written to our database nor exported. The full number is revealed on demand, after re-authentication, with a mandatory reason, within twenty reveals per person per day, and only inside your declared perimeter: a card under one of your BINs, an IBAN of a verified identity. Every reveal is written to the journal.
Has a card seen in a leak been used?
We do not know, and we do not say so: we record that it circulates, where and since when. The safe answer remains blocking and reissuing the card, notifying the issuer and opening the fraud process; the record gives you the dated elements for the dispute.
How is this service priced?
Like every service of the catalogue, on an annual licence: a price per declared BIN and a flat annual detection fee, each on its own line of the proposal, never a bundle. The price is given on quote until it is set.
Request an exposure assessment.
One hour with an analyst, not a demo: what already circulates about your organisation, what to monitor, what is better left alone. Reply within one working day.
No public price list: bespoke offering, written proposal after scoping.