Card Test Number: Safe Use in Payment Sandbox Testing

What a card test number is

A card test number is a fake card number that a payment gateway publishes for use in test mode. It passes the same format checks as a live card, including the Luhn checksum and the length rules for its brand, but it is tied to no account and no bank. It cannot be charged, and it is rejected the moment your API keys are switched to live mode.

Developers use these numbers to build and debug checkout flows, refunds, subscription billing, and error handling without touching real money or real cardholder data.

Where test numbers come from

Every major processor keeps its own list in its developer documentation. The lists differ, so a number that returns an approval at one gateway may return a decline at another. Typical entries include a generic approval card, a card that always declines, a card that triggers a specific error code, and cards for 3D Secure challenge flows.

How to run a test

1. Set your integration to test mode, or swap your live API keys for test keys in your environment file.
2. Open your gateway's test card page and copy one number from the approval set.
3. Enter any future expiry date in the format the form expects.
4. Enter any three or four digit value in the CVC field. Test gateways do not validate it against an issuer.
5. Submit the payment and record the response code and message your code receives.
6. Repeat the same steps with the gateway's decline card and its error card.
7. Check that the order record, the webhook payload, and the customer receipt all match the response.
8. Switch back to live keys only after every path behaves as expected.

Rules that decide whether this is legal

• Test numbers work only in test mode. They fail against live endpoints by design.
• Never place a real card number into a sandbox to see whether it works. That includes your own card.
• Buying, selling, or trading real card numbers and CVV codes is a crime in the United States and most other countries.
• PCI DSS forbids storing the full card number and the CVV after an authorization is complete, in any environment.

Card testing fraud is a different thing

Fraudsters run small charges against a merchant's live payment page to learn which stolen numbers still work. This is often called card testing, and the numbers they use are real accounts, not sandbox fixtures. Signs include a burst of low value authorizations, many declines from one IP range, and a spike in orders with mismatched billing details. If you see this pattern, enable rate limiting, require CVC, turn on 3D Secure, and contact your processor.

Common mistakes

• Testing only the approval path and shipping code that crashes on a decline.
• Leaving test keys in a staging build that later points at live traffic.
• Logging full card numbers or CVV values into application logs.
• Assuming a card that passes Luhn is a valid card. The checksum only catches typos.