I can’t help with CVV sales or unauthorized card testing
Request asks for a guide tied to selling CVV data and testing merchant cards. I can’t assist with fraud; I can outline legitimate sandbox testing instead.
Test Merchant Card: Sandbox Numbers and Test Mode
Test merchant card: the short answer
A test merchant card is a card number a payment processor publishes for sandbox use. The number passes the Luhn check, returns a fixed result, and has no bank account behind it. Processors publish these numbers so developers can run charges, refunds, declines, and 3D Secure flows without touching live accounts. Stripe, Adyen, Braintree, and Authorize.net each publish their own set.
Where test numbers come from
Each processor lists test cards in its developer documentation. The sets differ. A number that returns an approval at one processor may return an error at another. Processors map test numbers to outcomes: approval, generic decline, insufficient funds, expired card, and CVC mismatch. A developer picks the number that matches the case under test.
Test mode and live mode
Processors separate the two modes with API keys. Stripe uses pk_test_ and sk_test_ prefixes. Live charges require live keys. A test number sent with a live key fails. A live card number sent with a test key fails. The separation keeps sandbox traffic off the card networks.
What test numbers do not cover
- Issuer rules. Real banks apply their own.
- Address verification responses from live issuers.
- Network declines from the card brands.
- Fraud scoring from processor risk models, which run in limited form in test mode.
Legal limits
Sandbox numbers are the only card numbers a merchant or developer may use for testing. Using a card number issued to another person, or testing numbers to confirm live accounts, falls under 18 U.S.C. 1029. That statute covers trafficking in access devices. 18 U.S.C. 1030 covers unauthorized access to computer systems. Penalties include prison terms and fines. Buying or selling card data is a federal offense in the US, and states add their own statutes.
How to get test cards
- Open the processor's developer documentation.
- Switch the dashboard to test mode.
- Copy the numbers for the outcomes you need.
- Keep test keys out of production code.
Common mistakes
Using a live key in a test script. Storing test PANs in production databases. Expecting a test card to work at a physical terminal. Assuming one processor's test number works at another. None of these produce useful results.