A card test case is a scripted check of how a payment form, gateway, or API handles one card input and returns a result. Each case fixes one input, states the expected result, and records pass or fail. Coverage splits into three groups: card data format, authorization response, and security handling.

read more

Format cases

Card numbers pass a check digit test. The Luhn formula, defined in ISO/IEC 7812, doubles every second digit from the right, sums the digits, and requires a total divisible by 10. Test cases cover:

related article

  • Valid number, valid expiry, valid CVV. Expect approval.
  • Number with a changed last digit. Expect check digit failure.
  • 16-digit number where 15 or 19 digits are required.
  • Leading zeros and spaces. Expect trimming or rejection.
  • Letters and mixed alphanumeric input.
  • Empty field and single-digit input.

Expiry and CVV cases

Expiry and CVV fields carry fixed lengths. Build cases for each boundary.

Card Test Cases Script

  • Expiry in MM/YY and MM/YYYY formats.
  • Expiry set to the current month and the current year.
  • Month 00, month 13, year in the past.
  • CVV of 3 digits. Visa, Mastercard, and Discover use 3.
  • CVV of 4 digits. American Express uses 4.
  • Blank CVV, 2-digit CVV, 5-digit CVV, non-numeric CVV.

Authorization response cases

Gateways return a response code. Stripe and other processors publish test cards that force a given result. Common cases:

card test cases generator

  • Approval, then capture.
  • Generic decline. Order not created.
  • Insufficient funds. Response code 51.
  • Expired card. Response code 54.
  • CVV mismatch, with the CVV check switched on.
  • 3-D Secure challenge passed, then abandoned.
  • Timeout with no response from the issuer.
  • Duplicate submission of the same request. Expect an idempotency key to block a second charge.

Amount and currency cases

Amount fields add cases. Test zero amount, negative amount, a minimum charge near 0.50 USD, and a currency the gateway does not settle. Test retry after a soft decline and refund after a capture. Test level 2 and level 3 data fields when they apply.

Test data rules

PCI DSS requires that live card numbers not appear in test or development environments. Use test PANs supplied by the processor. Mark test records so they stay out of settlement reports. Log the last four digits and the response code. Store no full PAN. Two values stay unknown per gateway: its exact decline code list and its timeout window. Read the processor documentation for those.