CVV Test Cases Example: Payment QA Test Matrix

The fastest way to build a CVV test suite is a four-part matrix: format validation, mismatch handling, missing or unreadable values, and issuer response code mapping. Run every case inside a processor sandbox, never against live card numbers, and judge the suite on three criteria: coverage of real decline paths, repeatability without manual cleanup, and whether card verification values stay out of your logs. The sections below list concrete cases you can drop into a test plan today.

cvv test cases report

Case group 1: format and input validation

These cases resolve on the client or the server before any authorization request leaves your system. They are cheap to automate and they catch most checkout bugs.

cvv test cases study

• Digits only: a 3-digit numeric value passes for Visa, Mastercard, Discover, and JCB test cards.
• Length rules: a 4-digit value passes for American Express and fails for 3-digit brands; a 2-digit value fails everywhere.
• Non-numeric input: letters, spaces, hyphens, and symbols are rejected with a field-level message.
• Leading zeros: values such as 012 and 007 are accepted and transmitted without truncation.
• Empty field: submitting with a blank CVV returns a required-field error and does not trigger an authorization request.
• Paste behavior: pasting a 6-digit string into a 4-digit field trims or rejects according to your stated rule.
• Masking and autofill: the field stays masked on screen and still allows legitimate browser autofill.

Case group 2: mismatch and decline handling

Here you exercise the acquirer and issuer paths. Most processors publish sandbox card numbers that force a specific CVC outcome, so you do not invent data or reuse another provider's numbers.

CVV Test Cases Template Free: Payment Form QA Guide

• CVV mismatch: the gateway returns a CVC failure rather than a generic decline, and your UI explains it without exposing the reason to fraudsters.
• CVV mismatch with retry: a second attempt with the correct value for the sandbox card succeeds and does not double-charge.
• Retry limit: three failed CVV attempts on the same order lock the order or route it to manual review.
• Soft decline vs hard decline: your system distinguishes a CVV mismatch, which the customer can fix, from a stolen-card or pickup-card decline, which it cannot.
• Idempotency: replaying the same request with the same idempotency key returns the original result and creates no second authorization.

Case group 3: missing, unreadable, or unsupported CVV

These cases matter for mail order, telephone order, recurring billing, and card-on-file flows, where the value may be absent by design.

CVV Test Cases Scenario: QA Guide to Card Verification Validation

• Not present: the authorization succeeds or fails according to your acquirer's policy for missing verification data, and the response code reflects that (typically S, for should have been present).
• Not processed: the issuer returns P and your order logic does not treat it as a match.
• Unsupported brand: a card type with no CVV field is routed to the correct fallback path.
• Stored-card flow: the merchant-initiated transaction sends the correct indicator rather than a fabricated CVV.

Case group 4: response code mapping

Assert that each raw code maps to the right internal state. The standard set is M for match, N for no match, P for not processed, S for should have been present, U for issuer unable to process, and X for no response. Test each code independently, then test the combinations that matter: M with an AVS match, N with an AVS match, and U with a timeout. Confirm that U and X never resolve to an approval state and that they trigger a retry or review rule instead.

Two ways to run the suite

Processor sandbox test cards

The acquirer or gateway supplies card numbers that produce known CVC outcomes in its test environment. This is the default choice for end-to-end checkout testing.

• Pros: exercises the real request and response format; validates your parsing, mapping, and error copy; matches production behavior closely.
• Cons: requires network access and sandbox credentials; test data changes when the provider updates its docs; some decline paths are hard to trigger on demand.

Use this approach for checkout, tokenization, and decline-copy testing.

Mocked authorization layer

You stub the payment gateway and return canned responses, including each CVV response code.

• Pros: fast and deterministic; runs offline in CI; lets you cover rare issuer codes that sandboxes will not produce.
• Cons: proves nothing about real gateway behavior; mocks drift from the live API; skipped if your contract tests are weak.

Use this approach for unit tests, edge-case coverage, and regression suites that run on every commit.

Data handling rules that apply to every run

• Never use a real card number, even one you own, in a test environment.
• Never write a CVV to a log, a database column, or a test fixture that persists after authorization. PCI DSS treats the CVV as sensitive authentication data and forbids storing it post-authorization.
• Keep sandbox credentials out of source control and rotate them when a contributor leaves.
• Mask the field on screen and in any screenshot attached to a bug report.
• Re-verify test card lists against provider documentation before each release cycle.

Use case recommendation

If you ship a hosted checkout and want confidence in the full path, start with processor sandbox test cards and add mocked tests for the issuer codes the sandbox cannot produce. If you maintain a large regression suite that must run in seconds, invert that order: mock everything for speed and keep a small end-to-end smoke set against the sandbox. Teams under PCI assessment should add one explicit case that proves no CVV value reaches a log file or a stored record, because that single test protects more than any amount of functional coverage.