Answer First
A PayPal sandbox CVV sample is a three-digit code you type into a sandbox test card form. It is not a real card value and it is not tied to any bank account. The sandbox is a copy of the live PayPal environment that runs on fake money and fake accounts, so the card verification value is treated as test data. In most PayPal sandbox setups you can enter any three digits. Most developers type 123. The field is not verified against an issuer because no issuer is involved.
The sample CVV only matters when you pair it with a sandbox test card number. A live card number in the sandbox will fail, and a sandbox card number on the live site will fail. Keep both sides in the same environment.
Prerequisites
- A PayPal Developer account linked to a sandbox-enabled login
- A sandbox Business account to receive the payment
- A sandbox Personal account to send the payment
- A browser profile that is signed out of any live PayPal session
Steps
- Sign in to the PayPal Developer Dashboard with your developer credentials.
- Open the Sandbox menu and select Accounts.
- Pick an existing sandbox Business account or create a new one.
- Open that account and locate its test credit card numbers.
- Copy one test card number, or generate a new one for the account.
- Set the expiry date to a month and year in the future.
- Enter 123 in the CVV field, or any other three-digit value.
- Fill the cardholder name and billing address with sandbox test data.
- Open your sandbox checkout page and start a test purchase.
- Submit the payment and confirm the success or failure message.
- Check the sandbox account activity log to verify the transaction posted.
- Delete the test card from the sandbox profile when you finish testing.
Why the CVV Field Is Not Checked
Card verification exists to prove the person typing the number holds the physical card. The sandbox has no physical card and no issuing bank, so there is nothing to prove. PayPal simulates the authorization response instead. That is why a sample CVV such as 123 is accepted and why a random string of digits often works too. Some sandbox configurations return a decline on purpose so you can test your error handling. If you see a decline, check the sandbox account settings before you change the CVV.
Common Reasons a Sandbox Payment Fails
- A live card number was used instead of a sandbox card number
- The test card expiry date is in the past
- The billing address does not match the sandbox profile when address verification is on
- The browser is still signed in to a live PayPal account
- The test card was removed from the sandbox account
Sandbox Data Is Not Real Card Data
Sandbox cards carry no value and cannot be charged. They exist so developers can test checkout, refunds, subscriptions, and error paths without moving money. Real card data follows different rules. The PCI Security Standards Council prohibits storing the card verification value after a transaction is authorized, and merchants who handle live card numbers must meet PCI DSS controls. Using someone else's card data is a crime in the United States and is prosecuted as access device fraud and identity theft. Practice on sandbox values, then leave real card handling to a compliant payment provider.