PayPal sandbox CVV example
PayPal does not validate the CVV in the sandbox. Any 3-digit number passes for Visa, Mastercard, and Discover. Any 4-digit number passes for American Express. The value 123 appears in PayPal and Braintree test documentation, and it returns an approval on card 4111111111111111 with a future expiry date.
What the sandbox checks
The sandbox checks the field format and length. It does not send the CVV to an issuer. It does not compare the value to a stored record. A card number that fails the Luhn check returns a card number error before the CVV field gets read.
Format rules
- Visa: 3 digits, card length 16
- Mastercard: 3 digits, card length 16
- Discover: 3 digits, card length 16
- American Express: 4 digits, card length 15
Test card and CVV pairs
- 4111 1111 1111 1111, CVV 123, Visa
- 5555 5555 5555 4444, CVV 123, Mastercard
- 3782 822463 10005, CVV 1234, American Express
- 6011 1111 1111 1117, CVV 123, Discover
These numbers sit in the public test ranges for each card network. PayPal also lists sandbox card numbers inside each developer account. That list differs by country and by account type, so the values above are examples, not a full set.
Where the CVV sits in API calls
In the Orders API, the CVV goes in the payment source card object under the field name verification_value. The NVP and SOAP APIs use cvv2. A missing field returns a validation error. A field with 2 digits for Visa returns the same error.
Negative test values
PayPal sandbox accounts include test values that force declines, such as a set CVV or a set amount that triggers a processor response code. The sandbox dashboard lists the current codes for that account. PayPal changes these values without notice.
Limits
Sandbox CVV values have no use in production. Production traffic goes to an issuer, and the issuer decides the result. PCI DSS Requirement 3.2 prohibits storing the CVV after authorization. Test data falls outside that rule, but the same handling habits carry over.
Unknown: PayPal publishes no single global CVV value for the sandbox. The value depends on the test card and the API version in use.