CVV Test Scenario Guide: Safe Card Verification Testing
A CVV test scenario checks how your checkout handles card verification values. Run them in a sandbox with test cards, never with live card data.
Test Card Buying Guide: Safe Sandbox Cards for Payments
Your first decision is to skip third-party sellers and use the test cards your payment processor publishes for its sandbox. Legitimate test cards are free, tied to a sandbox account, and designed to trigger specific responses such as approvals, declines, and 3D Secure challenges. Never buy card numbers from a marketplace. Selling or buying real cardholder data is illegal and violates card network rules. This guide explains how to evaluate a test card set for development and QA.
What to look for in a test card suite
A useful test card suite covers the payment flows your application must handle. Check that the provider documents every card number with the expected result.
- Network coverage: Visa, Mastercard, American Express, Discover.
- Response coverage: approvals, soft declines, hard declines, insufficient funds, expired card, incorrect CVC.
- Authentication: 3D Secure 2 test cards that simulate frictionless and challenge flows.
- Regional rules: cards that behave like US, EU, or other issuer markets if your business needs that.
- Documentation: a clear mapping of card number to expected result.
- Maintenance: provider updates cards when network rules change.
Parameter bands to compare
Test cards are not interchangeable. Compare these parameters before you build a test plan.
- Card number ranges: official sandbox numbers often use known test BINs. Do not rely on random numbers.
- Expiry dates: use far-future dates the provider lists. Some processors require any future date.
- CVC: use the exact value in the docs. CVC length is 3 digits for most cards and 4 for Amex.
- Amount thresholds: test small amounts for approvals and specific amounts for declines if the processor supports that.
- Velocity limits: sandbox rate limits may differ from production.
Pitfalls to avoid
- Buying test cards from forums or messaging apps. These are often stolen card data or scams.
- Using production card numbers in a sandbox. This can violate PCI rules and provider terms.
- Assuming one test card fits every scenario. You need a matrix of cards.
- Ignoring 3D Secure and Strong Customer Authentication test paths.
- Hardcoding test cards in source code. Use environment variables and test fixtures.
FAQ
Are test cards free?
Yes. Payment processors publish them for free in their developer documentation. If someone charges you for test card numbers, that is a red flag.
Can I use test cards in production?
No. Test cards only work in sandbox or test mode. Production requires real payment credentials and live card data from the cardholder.
What is the difference between a test card and a real card?
A test card is a synthetic number issued by a processor for testing. A real card is linked to a cardholder account and cannot be used without authorization.
How many test cards do I need?
Start with one approval card per network, then add decline, 3D Secure, and regional scenario cards as your test plan grows.
Bottom line
Choose official sandbox test cards from your payment provider. They are free, legal, and maintained. If a site offers CVV or card numbers for sale, leave it. That is not a test card source, that is fraud.