To test CVV in an app, use your payment processor's sandbox and its official test card numbers; never test CVV by entering real card data into a custom form or by checking cards you do not own. Legitimate CVV verification happens inside the payment provider's hosted fields or tokenization flow, and your app should receive only a pass or fail result or a token, not the CVV itself.
Use the payment processor's sandbox
CVV testing belongs in a controlled test environment. Create a sandbox account with your payment provider, use only the test card numbers the provider publishes, and simulate common outcomes such as a CVV mismatch, an expired card, and a declined authorization.
- Use test cards from the provider's documentation, not real card numbers.
- Run tests in test mode, never in live mode with real card data.
- Check the sandbox response codes and error messages your app displays.
- Confirm that your app handles retries and failed CVV checks without storing sensitive data.
Keep CVV out of your app's storage and logs
CVV is sensitive authentication data. PCI DSS rules prohibit storing the CVV after authorization, and good practice is to avoid touching it in your own code at all. Use hosted payment fields, iframes, or tokenization so the card data goes directly to the processor.
- Do not write CVV to databases, files, analytics, or crash logs.
- Do not include CVV in screenshots, support tickets, or test fixtures.
- Do not build a custom CVV checker for real cards.
- Keep card data out of your app's backend whenever the provider supports hosted fields.
Validate the user experience, not real card data
In sandbox mode, test how the app behaves when the CVV field is empty, too short, or mismatched. Confirm that error messages are clear, that the form does not expose the CVV, and that the payment flow can retry without saving sensitive input. These checks improve the app without turning it into a card-testing tool.
What not to do
Do not test CVV on cards you do not own or have written authorization to use. Do not use an app to check whether a card or dump is live, and do not automate CVV checks against real card numbers. That is carding or fraud, it violates card network rules, and it can lead to account termination and legal action. If you need to confirm that your own card works, use the merchant's checkout or your bank's app instead of a third-party CVV checker.