CVV Test Cases Template Free: Payment Form QA Guide

A free CVV test cases template is a spreadsheet or checklist that lists every input a payment form must handle for the card security code: 3 digits for Visa, Mastercard, and Discover, 4 digits for American Express, plus blank, short, long, and non-numeric entries. You can build one in an hour using the sandbox card numbers your payment processor publishes. The template tells a tester what to type, what to expect, and which result counts as a pass.

cvv test cases example

What goes into a CVV test case template?

Every row needs the same six fields so results stay comparable across builds and browsers.

CVV Test Cases Download: How to Create and Utilize Them for Secure Online Transactions

• Case ID: CVV-001, CVV-002, and so on.
• Title: one line, such as "Reject letters in the CVV field".
• Precondition: sandbox account, test card, cart with one item.
• Steps: what to type and which control to press.
• Expected result: the message or state you want.
• Actual result and status: pass, fail, or blocked.

Aim for 25 to 40 cases for a single checkout page. That covers format, brand rules, error copy, and storage checks without burying the team in rows.

read more

Which CVV test cases matter most?

Format and length checks

• 3 digits accepted for Visa and Mastercard.
• 4 digits accepted for American Express.
• 2 digits rejected with a clear message.
• 5 digits rejected or trimmed, based on your rule.
• Letters, spaces, and symbols blocked at the field level.
• Leading zeros kept, since "007" is a valid code.
• Paste of "1234" into a 3-digit field handled with a message.
• Field left blank returns a required-field error, not a crash.

Number-only input masks cut most of these failures. Test the mask with a keyboard and with a paste, because the two paths behave in different ways.

more on this topic

Brand rules

The card number decides how many digits the CVV field expects, so test the switch after the buyer types the first few digits.

• Type a Visa prefix, then a 4-digit code. The form should flag it.
• Type an Amex prefix and confirm the field accepts 4 digits.
• Change the card number from Visa to Amex mid-entry and watch the field reset.

Decline and error paths

Sandboxes let you trigger a CVV mismatch on purpose. Stripe, for example, publishes test card numbers where any CVC passes and others where a specific CVC fails.

• CVC mismatch returns a decline with the right code.
• Wrong code three times in a row triggers your retry policy.
• Network timeout during authorization shows a retry option, not a blank screen.
• Duplicate submit with the same code does not create two orders.

Storage, logs, and PCI scope

PCI DSS forbids storing the CVV after authorization, so the test plan has to prove it is gone.

• Search the database for the code right after a test order. No match.
• Check application logs and error traces for the code. No match.
• Confirm the field clears after submit and after a browser refresh.
• Confirm the code is not sent to analytics or session replay tools.

How do you write one CVV test case?

1. Name the single behavior you want to check. "CVV-014: reject a 2-digit code on checkout" beats "test CVV".
2. Write the steps in the order a buyer takes them, starting from an empty cart.
3. State one expected result. If you need two, split the case.
4. Record the browser, device, and build number with the result.
5. Mark the case as automated or manual so the next sprint knows what to script.

Keep the wording short. A tester who has never seen the product should run the case without asking questions.

Where do free test card numbers come from?

Payment processors publish test card numbers, expiry dates, and CVC values in their developer docs for sandbox use. Stripe, Adyen, Braintree, and Authorize.Net each keep a page for this.

Use the processor's numbers. Never test with a live card number, your own or a customer's, because that pulls real data into your test environment and widens your PCI scope. Sites that promise "real CVV lists" are not offering test data, and using them carries legal risk.

What tools can hold the template for free?

• Google Sheets or Excel with one tab per checkout flow.
• Gherkin files in the repo, so the cases live beside the code.
• Postman collections for API-level CVV checks.
• Playwright or Cypress specs for the browser checks.

Pick one place and keep it there. Two sources of truth for test cases means one of them rots.

How do you keep the template current?

Payment rules shift with new card brands and processor updates. Review the sheet each quarter and after every checkout release.

• Delete test cards your processor retires.
• Add a case for each bug that reached production.
• Tag cases by browser so mobile-only failures surface.

Common mistakes in CVV testing

• Testing only the happy path with a valid 3-digit code.
• Forgetting Amex, which breaks the 4-digit rule.
• Skipping the log check, which is where PCI findings show up.
• Hard-coding a test card that your processor will retire.
• Leaving the code in the session object after checkout.

FAQ

Is a 3-digit CVV valid for American Express?

No. American Express prints a 4-digit code on the front of the card, while Visa, Mastercard, and Discover print 3 digits on the back. Your form should switch the expected length once it reads the card brand.

Can you test CVV handling without a payment processor?

You can test format rules, masks, and field behavior with a stub. You need a processor sandbox to test decline codes, 3D Secure steps, and the authorization reply.

Should the CVV ever be saved in the database?

No. PCI DSS states that sensitive authentication data must not be stored after authorization, and the CVV sits in that group. Save the authorization result and a processor token instead.