What a sandbox CVV is
A sandbox CVV is a three-digit or four-digit code used in a test payment environment. It has no link to a bank. The test gateway compares it against rules in its own database, not against an issuer.
Visa, Mastercard, and Discover cards carry a three-digit CVC2 or CVV2 on the back. American Express carries a four-digit CID on the front. Test cards copy that layout.
Sandbox CVV Number Guide: Everything You Need to Know
Common sandbox CVV values
- 123: used in most Stripe, Adyen, and Braintree examples.
- 999, 000, 111: accepted by test gateways that ignore the field.
- Any three digits: some sandboxes pass every value when no failure rule is set.
Test gateways that skip CVC checks still require a value in the form. An empty field fails client-side validation.
CVC failure test numbers
Stripe publishes test card numbers that force a CVC failure. 4000 0000 0000 0127 returns an incorrect CVC response. 4000 0000 0000 0101 returns a CVC check failure. That list changes over time. Check the current provider docs before you build test cases.
Adyen and Braintree publish their own lists. Values differ between providers.
What the sandbox does not test
A sandbox does not contact the card network. It does not run a real authorization. A pass in test mode says the code path works, not that the card is valid.
The CVV field is not checked with the Luhn algorithm. Luhn applies to the primary account number.
Rules that apply to real CVV data
PCI DSS classifies CVV2, CVC2, and CID as sensitive authentication data. Merchants may not store it after authorization. Test values are not a substitute for that rule. Live card data does not belong in a sandbox.