CVV Test Integration: Sandbox Guide for Payment Forms

Answer

CVV test integration means testing the CVV field inside a payment form. You do this in a sandbox. A sandbox is a test environment that never reaches a real card network. Processors publish test card numbers for this purpose. No real card data is needed.

What a CVV is

CVV is a 3-digit code. Visa, Mastercard, and Discover print it on the back of the card. American Express prints a 4-digit code on the front and calls it CID. The code checks that the buyer holds the physical card. It is not a password and it is not a substitute for authentication.

Test numbers come from your processor

Stripe, Braintree, Adyen, and Authorize.net list test card numbers in their developer docs. Each number triggers a fixed result. Any future expiry date and any 3-digit CVC work with these numbers.

• Stripe 4242 4242 4242 4242 returns an approval.
• Stripe 4000 0000 0000 0127 returns an incorrect CVC decline.
• Stripe 4000 0000 0000 0002 returns a generic decline.
• Braintree 4012 8888 8888 1881 returns a successful sandbox authorization.
• Amex 3782 822463 10005 exercises the 4-digit CID path.

Test every decline path

A form that accepts a valid code is half a test. Cover each failure branch.

1. Blank CVV field. Expect a client-side validation error before the request leaves the browser.
2. Two digits, then five digits. Expect a length error.
3. Correct format, wrong code. Expect a processor code such as incorrect_cvc.
4. Network timeout. Expect a retry path with no duplicate charge and no duplicate order row.

Storage rules

PCI DSS Requirement 3.2 bans storage of sensitive authentication data after authorization. The CVV sits in that category. Do not log it. Do not write it to a database column. Do not paste it into a support ticket or an error tracker. Pass it to the processor, then discard it. Render the field with autocomplete set to off and clear it after submit.

What is not a test

Running a CVV that belongs to someone else is not integration testing. It is card fraud. 18 U.S.C. 1029 covers the use, sale, and transfer of unauthorized access devices. Issuers flag the traffic, merchants file chargebacks, and the conduct carries federal penalties. Sandbox numbers exist so that no live account is touched.

Checklist

• Use only documented sandbox numbers.
• Confirm the field accepts 3 digits for Visa, Mastercard, and Discover, and 4 for Amex.
• Verify the decline code reaches your error handler.
• Confirm the CVV is absent from logs, database rows, and analytics events.