2Checkout Test CVV: Sandbox Test Card Values Explained

The 2Checkout test CVV is 123 for Visa, Mastercard, and Discover sandbox cards, and 1234 for American Express. In sandbox mode the gateway accepts almost any CVV value, because test transactions never touch a real cardholder account or a real issuer. Use only published test card numbers, never a live card.

2Checkout CVV Verification Utility

What is a test CVV in the 2Checkout sandbox?

A test CVV is the card verification value you type into a demo checkout when using a sandbox test card number. It exists so developers can complete the full checkout flow without exposing real card data. 2Checkout, now part of Verifone, publishes a fixed set of test cards for this purpose.

2Checkout CVV Test Utility Guide

Which test card numbers pair with the test CVV?

Match the CVV length to the card brand. Visa, Mastercard, and Discover use three digits, while American Express uses four.

2checkout cvv validation

• Visa: 4111 1111 1111 1111, CVV 123
• Mastercard: 5555 5555 5555 4444, CVV 123
• American Express: 3782 822463 10005, CVV 1234
• Discover: 6011 1111 1111 1117, CVV 123

Expiration dates for sandbox cards should be a future month and year. Any future date works in most sandbox configurations.

Top Pick: SecureCVV Check Tool

Does the sandbox actually validate the CVV?

No. Sandbox transactions skip the CVV check that a real issuer performs, so a mismatched or random value usually still returns a successful order. Some integrations still run basic format validation, which rejects a 2-digit entry on a Visa card. That is why 123 is the safest default to test with.

How do you trigger a fraud or decline response in test mode?

2Checkout lets you force specific outcomes by changing order data rather than the CVV. Entering FRAUD as the customer last name places the test order in fraud review. This is the fastest way to test your webhook handling for flagged and declined orders.

When does the test CVV stop working?

The test CVV stops working the moment you switch to the live production endpoint. Live mode routes the transaction to a real issuer, which validates the real CVV and can decline the order on a mismatch. Keep test credentials and live credentials in separate configuration files to avoid mixing them.

Common CVV errors developers hit

• Format error: four digits sent with a Visa test card, or three digits with Amex.
• Wrong endpoint: test values submitted to the live URL return a hard decline.
• Stored CVV: saving the code after authorization violates PCI DSS rules and fails a compliance review.

FAQ

Is the 2Checkout test CVV always 123?

For Visa, Mastercard, and Discover sandbox cards, 123 is the documented value. Amex test cards use 1234.

Can I use any CVV in the 2Checkout sandbox?

In most cases yes, because the sandbox skips issuer verification. Use 123 anyway to keep tests consistent with the published card list.

Can I test a CVV mismatch on purpose?

You can, but the sandbox may still approve the order. For reliable decline testing, use the fraud last name trigger or a dedicated decline test card.

Only published test data belongs in a sandbox. Entering real card numbers, real CVVs, or any cardholder data from another person into a test environment breaks PCI DSS rules and can be a criminal offense.