What Is a CVV Test Credit Card?
A CVV test credit card is a card number, expiry date, and security code published by a payment processor for use in test mode. The number works only against a sandbox API, so no real account is charged and no money moves. Stripe, Braintree, Adyen, and Authorize.Net all list these numbers in their public developer docs.
What the CVV Field Checks
CVV (also written CVC or CVV2) is the three-digit code on the back of a Visa or Mastercard, or the four-digit code on the front of an American Express. It confirms the person entering the card has the physical card in hand. The code is never stored with the card number, so it cannot be pulled from a database leak.
In test mode, that check follows the processor's rules instead of the issuer's. Sandboxes accept any three digits for a passing card, and reject specific values when you want to simulate a mismatch.
Why Developers Use Test Cards
You cannot ship a checkout page without proving it handles failure. Test cards trigger defined results: a clean approval, a decline, a fraud flag, a 3D Secure prompt, or an expired card error. Each number maps to one outcome, so a developer can verify every branch of the code.
- Verify the happy path with an approval card.
- Verify error handling with decline and expired cards.
- Verify fraud rules with a card flagged for review.
- Verify 3D Secure with a challenge card.
Where Published Test Numbers Come From
- Processor documentation pages (Stripe, Braintree, Adyen, Square)
- Open-source checkout libraries that ship sample fixtures
- The sandbox dashboard inside your own merchant account
These numbers are public. Anyone can read them without an account, and that is what separates them from real card data.
Common Test Card Numbers and Their Results
Stripe's set is the one most developers copy. These numbers work in test mode across many gateways that follow the same convention.
- 4242 4242 4242 4242: approved Visa, any future expiry, any CVC
- 4000 0000 0000 0002: card declined
- 4000 0000 0000 9995: insufficient funds
- 4000 0000 0000 0069: expired card
- 4000 0000 0000 0127: incorrect CVC
- 5555 5555 5555 4444: approved Mastercard
- 3782 822463 10005: approved American Express
Test numbers do not carry a real account. The same digits sent to a live endpoint return a decline or a block.
How to Run a Test Transaction
- Copy the sandbox API keys from your payment provider's dashboard.
- Point your checkout at the test endpoint, which is a separate base URL from live.
- Enter a published test card number, a future expiry date, and a test CVC.
- Submit the charge and read the response code.
- Repeat with decline and error cards to cover the failure paths.
Log every response code. A passing charge that returns the wrong code often points to a mapping error in your gateway handler.
Never Test With Real Card Data
Running a real card number through a sandbox creates PCI scope problems and can trip fraud rules at the issuer. Test cards exist so you avoid that. Putting live card data into a test system also breaks the terms of most processor agreements.
Test Card vs Real Card: What Changes
- Test cards reach a sandbox; real cards reach the card network.
- Test CVV validation follows vendor rules, not issuer rules.
- No authorization hold appears on a test charge.
- Test numbers never expire, so any future date works.
- Test numbers cannot be used to buy goods or services.
Frequently Asked Questions
Do test credit card numbers work on live sites?
No. Live gateways reject published test numbers or return a decline. Test numbers are tied to sandbox endpoints and test API keys.
Is using a CVV test credit card legal?
Yes, when you use published test numbers in your own sandbox. Using another person's card data to obtain goods, authorization, or money is fraud under 18 U.S.C. section 1029 in the US and similar statutes elsewhere.
What CVC should I use with a test card?
Any three digits for Visa and Mastercard, and four digits for American Express. Use the vendor's flagged value when you want to force a CVC failure.
Can I create my own test card numbers?
Some processors allow custom test numbers through the dashboard. Stripe supports card tokens that mimic a saved card. Otherwise, use the published list.
Why did my test charge fail with a valid card number?
Common causes are live API keys, a wrong endpoint, a missing CVC, or a past expiry date. Check the keys first, then the request payload.
Where the Legal Line Sits
Test card numbers are safe because they cannot move money. Real card data is a different matter. Buying, selling, or testing stolen card numbers is a federal crime in the US and a fast route to account termination with any processor.
If a site offers to sell CVV or dumps, treat it as a scam and a crime. The numbers are either stolen or invented, and either way the buyer carries the risk.