CVV test integration guide
A CVV test integration checks a payment form with test card numbers from a gateway sandbox. You do not use real card numbers. Stripe test cards use CVV 123 or 000. The test CVV passes inside the sandbox only. A live CVV check goes to the card issuer. Testing real card numbers with guessed CVVs is card testing. Card testing is fraud. Visa and Mastercard rules prohibit it. The FTC treats it as fraud.
What CVV means in a test
CVV is the 3-digit or 4-digit code printed on a card. In a sandbox, the gateway accepts fixed test CVVs. Stripe lists 123 as a passing CVV for most test cards. The value 000 triggers a CVV failure response. The test CVV stays in the test environment.
Sandbox keys vs live keys
Sandbox keys start with pk_test and sk_test at Stripe. Live keys start with pk_live and sk_live. A test CVV works with test keys. A live key sends the CVV to the acquirer. Do not send test CVV values to a live endpoint. Do not send live card data to a test endpoint.
What a CVV test should verify
- The form accepts 3 digits for Visa and Mastercard.
- The form accepts 4 digits for American Express.
- The gateway returns a CVV match, no-match, or unchecked code.
- A failed CVV response blocks the charge.
- The error message does not echo the CVV back to the page.
Rules and limits
PCI DSS requires masking of the CVV after authorization. The CVV must not be stored. Testing live card numbers with generated CVVs triggers issuer fraud alerts. Issuers may block the merchant account. Card networks publish test card numbers for sandbox use only.
What is not covered
This guide does not provide live CVV values. No source provides live CVV data. A CVV test integration uses test card numbers from your payment processor.