How to Test a Payment Gateway CVV
Learn how to effectively test a payment gateway CVV for secure online transactions.
CVV Test Mode: How Sandbox Card Verification Works
Answer
CVV test mode is a sandbox setting at a payment gateway. The checkout form collects a CVC value, but the gateway does not forward it to a card issuer. No card is charged. Test mode accepts fake card numbers and fake CVC values from the gateway's published test list. Real card data fails in test mode, and test card numbers fail in live mode.
What happens in test mode
A test API key routes the request to the gateway's sandbox. The sandbox returns a simulated response: approved, declined, CVC check failed, or CVC not checked. The issuer, the card network, and the acquiring bank are not involved. Because no issuer is contacted, test mode cannot confirm that a real card's CVV is correct.
Test CVC values
Each gateway publishes its own list. Values differ. A value that works at one gateway may fail at another.
- Stripe: card 4242 4242 4242 4242, any 3-digit CVC, any future expiration date.
- Stripe CVC failure: card 4000 0000 0000 0101 returns a failed CVC check.
- Authorize.net: test card 4007000000027 accepts any 3-digit CVV unless you are testing a specific response code.
- Braintree: sandbox test cards pair with documented CVV values for simulated responses.
No gateway publishes a universal test CVV. The number comes from that gateway's own test card documentation.
Test keys and live keys
Gateways issue two key pairs, one for test mode and one for live mode. Test keys with a live card number produce an error. Live keys with a test card number produce an error. The two environments do not share data, so test transactions never appear in live reports or settlement files.
Error states test mode reproduces
- Invalid CVC length.
- Failed CVC check.
- Declined card.
- Expired card.
- Insufficient funds.
Developers use these states to check form validation, error text, and retry logic before switching to live keys.
CVV storage rules
PCI DSS classifies the CVV as sensitive authentication data. Merchants and service providers may not store the CVV after authorization, in any form. Test mode values are not real account data, so PCI DSS scope does not cover them. That distinction ends the moment a real card is used.
What test mode cannot do
Test mode cannot verify a real card. It cannot check a real CVV against an issuer. It cannot move funds. A service that claims to verify real CVV values without an authorization request is not running a gateway sandbox.