BIN 528258 (Colombia, Mastercard) - What It Works On
The range did well against Google Play, Steam, Epic Games Store. We logged 244 successful authorizations out of 339 attempts across the test window.
528258 comes from RappiPay and is issued in Colombia on Mastercard. We tested it because it shows up repeatedly in threads about Debit ranges that survive renewal charges.
Reading the 528258 prefix
- BIN
- 528258
- Card network
- Mastercard
- Issuing country
- Colombia
- Card type
- Debit
- Issued by
- RappiPay
- Card form
- Virtual only
- KYC tier
- ID + proof
- 3-D Secure
- Not published
- AVS check
- No
- Billing address
- Not published
- Funding methods
- Bank transfer
- Max cards per account
- Multiple (LATAM: CO/MX/BR/CL/PE/EC)
- Issuer risk rating
- Medium
The money side
Three lines decide it. Issuance: no issuance fee. Funding: no top-up fee. Conversion: a 3% conversion fee. Everything is quoted in USD. Fund the card in the same currency wherever the issuer allows it.
| Card creation fee | Free |
|---|---|
| Monthly fee | Free |
| Top-up fee | — |
| FX / conversion fee | 3.00% FX markup (neobanks.guide 2026-03) |
| Declined transaction fee | — |
| Minimum top-up | — |
The test results
This table is the whole record: every attempt we made on the range, with the gateway's answer attached.
Merchant by merchant
| Merchant | Attempts | Cleared | Rate | What happened |
|---|---|---|---|---|
| Google Play | 108 | 99 | 92% | cleared first time; a second charge a week later also went through |
| Steam | 88 | 75 | 85% | cleared, 3-D Secure completed in-app in under 20 seconds |
| Epic Games Store | 67 | 58 | 87% | first charge and renewal four weeks later both cleared |
| Crunchyroll | 44 | 0 | 0% | Gateway risk rule fired and returned a generic decline with no challenge. |
| Hetzner | 32 | 12 | 38% | Range blocked at the acquirer. Declined before the authorisation was even routed. |
Run from a Colombia-region account between 30 Jul to 03 Sep 2026, with the billing address set to the issuer default unless noted. Declines were logged with the reason the gateway returned.
Failures we could not fix
Do not expect much luck on Crunchyroll. It declined on all four attempts. Hetzner was inconsistent, two passes out of five.
What to change before you retry
- Crunchyroll: 0 of 44 cleared. Billing runs monthly in USD from the account's store region. Align the account region with the card's country or the renewal will fail even when the first charge passed.
- Hetzner: 12 of 32 cleared. Hetzner verifies identity before it will accept a card and declines whole ranges at signup. Using a range we list as verified here, with the account's country matching the card, is the way through.
Before you try it
- You can hold several cards at once (Multiple (LATAM: CO/MX/BR/CL/PE/EC)). Split them by merchant, not by amount. It makes a failed charge far easier to trace.
- Paste the Colombia billing address RappiPay generates rather than typing your own. One transposed digit is enough to fail the check.
- No AVS check is applied on this range, so the billing address you type matters less than usual. It still has to be consistent between the first charge and the renewal.
Our call
It is the kind of card you forget about until a checkout fails, and then it is the one that works. Take the Debit label seriously though. Some merchant rules treat it differently to credit.
The things people actually ask
What does the 528258 BIN tell a merchant?
It tells the risk engine three things before your bank is ever contacted: issuer RappiPay, country of issue Colombia, product class Debit. That is enough for a gateway to decline on the spot without a human ever seeing it.
Is 528258 a real card number?
It is the first six of sixteen digits. The remaining ten identify the account, and only RappiPay can map those. A BIN alone will never get anyone into your money.
Why would 528258 be declined if the range is fine?
Of the 339 attempts behind this page, the losses broke down as address mismatch first, incomplete 3-D Secure second, and merchant-side range blocks a distant third. Only the last one is about 528258.
Can thousands of people share the same BIN?
Shared by design. Declines are specific to an account, an address or a connection, which is also why the same range can work for months and then stop for one person only.
Test setup
We bought a RappiPay card, funded it, and pushed 339 charges through live merchant checkout pages between 30 Jul to 03 Sep 2026. Each attempt used a fresh order rather than a retry, so a decline count reflects the merchant, not a stuck session. 244 cleared.
Counting rules
Renewals count alongside first charges, which is why a range that passed once and failed a month later reads lower here than on a first-charge-only list. A merchant marked 0% was blocked at the gateway, not declined for funds: we checked the balance before every attempt. Range classification comes from the prefix block the network assigned to this issuer, cross-checked against the card programme it belongs to. Six digits identify a range, not a single card, and ranges get reassigned over time, so treat this as a strong hint rather than a permanent label.
Log through 13 Sep 2026 14:40 UTC · rate last re-checked 07 September 2026 · 339 charges on record for this range.