Ultimate Guide to Card Expiry Test for Selling CVV Online
Learn everything you need to know about conducting a card expiry test to ensure a smooth transaction process when selling CVV online.
PayPal Sandbox Test Card: Where Developers Get Them Free
The short answer: a PayPal sandbox test card is not something you buy
PayPal publishes its sandbox test card numbers at no cost inside the developer documentation, and those numbers are not a product any legitimate vendor can sell. A storefront that offers "PayPal test cards" or bundles card numbers with CVV data is either reselling public documentation or operating in the stolen-card market. Test numbers resolve only inside the PayPal sandbox, so they cannot move real money. Real account numbers, including the CVV, are not test data and cannot lawfully be bought or sold in the United States. What follows covers what the sandbox numbers are, where developers obtain them, and how to judge a third-party tool that claims to supply them.
What a sandbox test card actually is
A sandbox test card is a synthetic number that PayPal's test environment accepts so you can exercise checkout, authorization, capture, refund, and vault flows without touching a live funding source. The numbers follow the same formatting rules as real cards, which lets your form validation and tokenization code run without special cases. PayPal's sandbox also supports negative testing: particular numbers, expiry values, or CVV values produce declines, processor errors, or 3D Secure challenges so you can build handling for failed payments before launch.
Where developers get them
- Create a free PayPal developer account.
- Open the dashboard, find sandbox accounts, and create a personal buyer account.
- Use the test card numbers documented for the sandbox, or the test card generator attached to that sandbox account.
- Point the integration at the sandbox API base URL and authenticate with the sandbox client ID and secret.
What to look for when a tool claims to supply test cards
- Free access. PayPal publishes the numbers. A paid product has to add something real, such as automated negative-test suites, fixtures for CI, or coverage reports.
- Scope. A credible tool names the sandbox endpoints it targets and states which card brands and decline behaviors it can reproduce.
- No real card data. A vendor that ships account numbers, CVVs, or full magnetic-stripe data is not selling test material.
- Data handling. Ask where request logs and payloads are stored, since test environments still capture personal data when you paste it in.
Parameter bands that matter
Card format rules come from the networks, and the sandbox mirrors them. Visa numbers start with 4 and run 16 digits. Mastercard uses 51 through 55 and 2221 through 2720, also 16 digits. American Express starts with 34 or 37 and runs 15 digits. The CVV is three digits, except American Express, which uses four. Expiry dates must sit in the future, and many test suites keep the name and billing address matched to the sandbox buyer account so address verification returns predictable results. Country and currency settings on the sandbox account decide which funding options appear, so test the market you plan to launch in.
Pitfalls
- Sandbox outcomes are not a forecast of live approval rates. Risk models, issuer rules, and 3D Secure behave differently in production.
- Never test with a real card number. Card network rules and PCI DSS restrict live account data to production systems that meet the standard.
- Keep test credentials on the server. A sandbox secret pasted into a browser bundle is a habit that follows teams into production.
- Sandbox accounts go stale. Recreate test buyers when tokens or linked funding sources stop working.
- CVV shop listings are a criminal market, not a supplier. Trafficking in account numbers carries federal access device penalties.
FAQ
Do I need to pay for a PayPal sandbox test card?
No. PayPal documents the numbers for free and there is no licensed reseller.
Can a sandbox test card be charged for real money?
No. Sandbox numbers resolve only inside the sandbox environment.
Why did my test card get declined?
Common causes include a sandbox account set to a different country, an expiry date in the past, a currency mismatch, or a number PayPal reserves for negative testing.
Is it safe to paste card data into a test environment?
Only synthetic data. Test systems seldom meet production security controls, and PCI DSS limits where real account data may be stored.