CVV Test UI: Test Security Code Fields in Checkout

What a CVV test UI verifies

A CVV test UI checks that your payment form handles the card security code correctly: it accepts only 3 or 4 digits, masks the entry, passes the value to your processor for authorization, and never stores or logs it. Run every test with sandbox card numbers from your payment processor. Real card numbers and real security codes do not belong in a test environment.

The code is sensitive authentication data under PCI DSS. It can be used to authorize one transaction and then must not be retained after authorization in any form, including databases, log files, and support tickets.

Prerequisites

• Sandbox or test merchant account with your payment processor
• Processor test card numbers, including a 3-digit code card and a 4-digit code card
• Browser with developer tools open on the Network and Console tabs
• Access to your form source and your server-side request logs

How to test the CVV field

1. Collect the test card numbers from your processor documentation, noting which brands use 3-digit codes and which use 4-digit codes.
2. Set the input to inputmode="numeric", maxlength="4", and autocomplete="cc-csc" so mobile keyboards and autofill behave correctly.
3. Submit a test card with a valid 3-digit code and confirm the authorization succeeds in the sandbox.
4. Submit a test card with a valid 4-digit code and confirm the field accepts the extra digit and the authorization succeeds.
5. Enter letters, symbols, and spaces. Confirm the field rejects or strips them before submission.
6. Try a 2-digit code and a 5-digit code. Confirm the form blocks submission and shows an error tied to the field.
7. Leave the field blank and submit. Confirm the error message names the security code and does not clear the rest of the form.
8. Watch the Network tab during a valid submission. Confirm the code travels only to the processor endpoint or tokenization iframe, never to your own analytics or logging calls.
9. Search your server logs and database for the value you entered. Confirm it appears in neither.
10. Trigger a declined authorization and a 3-D Secure challenge in the sandbox. Confirm the form handles both without exposing the code in the UI or in error text.
11. Reload the page after a failed submission. Confirm the field is empty and no value is restored from storage.

Common failures

• Field accepts more than 4 digits and forwards the overflow to the processor
• Code echoed back in an error message or debug banner
• Code included in a client-side analytics event or session replay recording
• Form posts the code to your server instead of the processor's tokenization endpoint
• Input type set to text without numeric constraints, so paste and autofill bypass validation