cvv-test-environment-guide-how-to-safely-evaluate-and-buy-cvvs-online
Learn how to navigate a CVV test environment and responsibly buy CVVs online, ensuring a safe and legal experience.
PayPal Sandbox CVV: What to Enter in Test Payments
Short answer
In the PayPal Sandbox, the CVV box takes any 3-digit number for Visa, Mastercard, and Discover test cards. Use 4 digits for American Express. The value 123 is common. The Sandbox does not send the CVV to a card issuer, so no value is matched against a real account.
What the PayPal Sandbox is
The Sandbox is a copy of the live PayPal API. Developers create test accounts in the Developer Dashboard. A personal account acts as the buyer. A business account acts as the seller. Balances are simulated. No funds move. Card numbers are test numbers, not cardholder accounts.
Test card numbers
- Visa: 4111 1111 1111 1111
- Mastercard: 5555 5555 5555 4444
- American Express: 3782 822463 10005
These numbers sit in ranges the card networks reserve for testing. The networks publish them for developers. They return an approval or a decline in the Sandbox. They do not draw on a credit line.
CVV and expiry fields
Enter a future expiry date in MM/YY form. The CVV field takes 3 digits for Visa, Mastercard, and Discover, and 4 digits for American Express. The checkout form rejects 2-digit values, letters, and expired dates. That check runs in the form, not at a card network.
Forcing a decline on purpose
PayPal and Braintree publish test values that return set responses, such as a CVV mismatch or a decline. The current list lives in the Developer Dashboard under card testing. PayPal changes that list, so read the dashboard page instead of a copy on another site. The exact values in force today are not known from outside the dashboard.
What Sandbox cards cannot do
A Sandbox card cannot be charged. It cannot run on a live PayPal checkout. It has no credit limit and no billing address on file. Results show in the Sandbox transaction history, and on no bank statement.
How CVV works in live payments
In live payments the CVV is a verification value. PCI DSS groups it as sensitive authentication data. A merchant may not store it after authorization. The value proves the person holds the physical card. Nothing else in a checkout replaces that check.