Answer

A dummy credit card number is a test PAN that a payment processor publishes for its sandbox environment. The digits pass the Luhn checksum. The number routes to a simulator, not to a card network. It gets declined in live mode every time. Stripe's standard test Visa is 4242 4242 4242 4242. Pair it with any future expiry date, any 3 digit CVC, and any ZIP code the sandbox accepts.

valid credit card test number

How test PANs differ from real card data

A live PAN maps to an issuing bank, a credit line, and a cardholder. A test PAN maps to nothing. The BIN ranges below sit outside live issuance. Gateways flag them at the authorization step and return a canned response. No funds move. No cardholder exists.

read more

Real card data carries three obligations: PCI DSS scope, network rules, and criminal law. Test data carries none of these. That gap is the whole point of sandbox testing.

What is a Credit Card Test Number?

Common sandbox numbers by brand

  • Visa credit: 4242 4242 4242 4242
  • Visa debit: 4000 0566 5566 5556
  • Mastercard credit: 5555 5555 5555 4444
  • Mastercard credit: 5200 8282 8282 8210
  • American Express: 3782 822463 10005
  • Discover: 6011 1111 1111 1117
  • JCB: 3566 0020 2036 0505

These strings are published in public developer docs from Stripe, PayPal, Adyen, and Braintree. Each processor keeps its own list. Numbers work in the sandbox of the processor that published them and nowhere else.

more on this topic

The Luhn check

Luhn, or mod 10, is a checksum. Start at the rightmost digit. Double every second digit moving left. If a doubled value exceeds 9, subtract 9. Sum all digits. If the total divides by 10 with no remainder, the number passes.

Every test PAN above passes. Luhn catches typos, not fraud. A random 16 digit string passes about 10 percent of the time. Stripe and other gateways run Luhn before they run anything else, so a failing number returns a format error instead of a decline.

CVV, expiry, and ZIP in sandbox mode

The CVC field takes 3 digits for Visa, Mastercard, Discover, and JCB. American Express takes 4 digits. Sandbox simulators accept any value in the correct length. Use 123 for a 3 digit test and 1234 for Amex.

Expiry dates must sit in the future. Use 12/34 or any month and year ahead of today. A past date returns an expired card code on most gateways. ZIP and postal code checks accept 12345 in US test mode, or any 5 digit string when AVS simulation is off.

Numbers that trigger declines

  • 4000 0000 0000 0002: generic decline
  • 4000 0000 0000 9995: insufficient funds
  • 4000 0000 0000 0069: expired card
  • 4000 0000 0000 0127: incorrect CVC

Decline tests matter as much as success tests. Every payment flow needs a failure branch. Test the retry path, the error copy, and the order state after a failed charge.

Limits and the legal boundary

Test numbers only work in sandbox mode. Swap in a live API key and the same digits return a decline or a card not supported error. Do not ship a test PAN to production by accident. Gateways block the known ranges, but the order still fails.

Using a real card number without authorization is a federal crime in the US under 18 U.S.C. 1029. PCI DSS also bars storing the full PAN and the CVV after authorization. Test data sits outside both rules because no account is attached.

Checklist

  1. Confirm the sandbox API key, not the live key.
  2. Pick a test PAN from the docs of the processor you use.
  3. Set a future expiry date.
  4. Set a CVC of the correct length.
  5. Run one success case and one decline case.
  6. Check the order record after each run.