CVV Test Values for PCI DSS: Test Cards and Rules

Short answer

A CVV test value is a fake 3-digit or 4-digit code used with a test card number in a sandbox or QA system. PCI DSS does not publish test CVV values. Payment processors and gateways publish them. Common test codes are 123, 999, and 1234 for American Express.

What PCI DSS says about CVV

The card verification code is sensitive authentication data. PCI DSS v4.0 Requirement 3.3.1 states that sensitive authentication data is not stored after authorization, even if encrypted. Requirement 3.3.1.2 names the card verification code or value as data that cannot be kept.

This rule applies to test systems as well as production. A test CVV does not change the classification. If a test environment handles a real card number, the CVV that came with it is still sensitive authentication data.

• CVV2: Visa, 3 digits, back of card.
• CVC2: Mastercard, 3 digits, back of card.
• CID: American Express, 4 digits, front of card.
• CID: Discover, 3 digits, back of card.

PCI DSS Requirement 6.4.3 and test data

Requirement 6.4.3 says production PANs are not used for testing or development. Test data comes from the processor, a sandbox, or a number generator that fails the Luhn check on purpose. Pen testers under Requirement 11.4 use test accounts, not live card numbers.

Where test CVV values come from

Each processor sets its own sandbox rules.

• Stripe: any 3 digits for Visa, Mastercard, and Discover test cards. Any 4 digits for Amex test cards. The card 4242 4242 4242 4242 accepts 123.
• PayPal and Braintree: sandbox card numbers accept 123 or a value the sandbox defines.
• Adyen, Worldpay, and Fiserv publish test cards in merchant portals.

No issuer validates a CVV in a sandbox. The gateway decides pass or fail. A CVV of 123 returns an approval on a test PAN and a decline on a test PAN built for a decline response.

Test card numbers that pair with test CVVs

• 4242 4242 4242 4242: Visa, CVV 123.
• 5555 5555 5555 4444: Mastercard, CVV 123.
• 3782 822463 10005: American Express, CID 1234.
• 6011 1111 1111 1117: Discover, CVV 123.

These numbers pass the Luhn check. They are public. They do not belong to any cardholder.

Common mistakes

1. Using a live PAN in a staging database. That is a Requirement 6.4.3 finding.
2. Logging a CVV from a test transaction. Logs are storage. Requirement 3.3.1 applies.
3. Copying production data into QA to make tests look real. Masking does not make a CVV safe to keep.
4. Assuming a sandbox proves PCI DSS compliance. A sandbox proves the integration works. Compliance comes from an assessment.

What PCI DSS does not cover

PCI DSS has no list of approved test CVV values. It has no test card list. Those come from the processor. The standard covers how card data is stored, sent, and accessed. Test values are a tool for developers. They are not a control.

If a test value is unknown, ask the processor. Do not guess with a live card.