Pick the Authorize.net sandbox test CVV first: in test mode any correctly formatted card code is accepted, so use 123 for Visa, Mastercard and Discover, and 1234 for American Express. Lists marketed as "CVV test latest" are irrelevant inside Authorize.net, because the sandbox never sends a card code to an issuer for validation. Real card codes cannot be tested and must never be entered into a test account.
Guide to Authorize.Net Test CVV Related Issues
What is the difference between an Authorize.net test CVV and a CVV test latest list?
An Authorize.net test CVV is a placeholder that only has to pass format validation inside the sandbox. A "CVV test latest" list is a set of values published outside the gateway documentation, usually claiming to force a specific issuer response.
authorize.net test cvv alternative
Only the first is supported by the gateway. The second changes nothing in test mode because no issuing bank is contacted.
Buying Guide: How to Choose the Best CVV for Your Transactions with Authorize.Net
How does Authorize.net handle the card code field in test mode?
The field is cardCode in the current API and x_card_code in the legacy AIM connector. The sandbox checks length and character type, then returns a response without contacting a bank.
authorize.net test cvv vs worldpay
Format rules follow the card type: three digits for Visa, Mastercard and Discover, four digits for American Express. A wrong length returns a format error, not a card code mismatch.
Does the sandbox ever return a CVV mismatch?
Only where the testing guide documents a card number that produces that result. Use the documented number for the case you need, and treat any other source of CVV values as unusable in the sandbox.
Which option should you pick first?
- Send the default test CVV (123 or 1234) with a published sandbox card number. This proves the field is wired correctly.
- Switch to a documented test card number if you need a specific card code or address verification result.
- Mock the response in your own harness only for cases the sandbox cannot produce.
What are the options if the basic test CVV is not enough?
- Response mapping: choose the sandbox card number tied to the result you want your code to handle.
- Field-level tests: send a short or non-numeric cardCode to confirm your form rejects it before any request is sent.
- Certification scripts: card brands publish their own test matrices for terminal and processor certification.
Can you test a real CVV in the sandbox?
No. Real card data in a test environment breaks PCI DSS scope rules and card network agreements. Store only what the gateway returns, and never retain a CVV after authorization.
Sandbox values are tied to the environment, not your integration version, so re-check the current testing guide after any upgrade.
FAQ
Is the Authorize.net test CVV always 123?
No. 123 is a common default, but any correctly formatted value passes unless the test card number is documented to return a specific result.
Does a CVV test latest list change anything in Authorize.net?
No. The gateway does not read external lists, and the sandbox does not validate a card code against an issuer.