Short answer
A sandbox test CVV is a 3-digit or 4-digit code used with a test card number in a payment gateway's test mode. No card network sees it. Gateways accept almost any CVV in test mode, and most skip the check. The code matters in two cases: field format checks and test cards written to trigger a set result.
Sandbox Test CVV Sample: A Guide for Payment Testing
What test cards are
Payment processors publish test card numbers. Each number passes the Luhn check and sits in a range the card networks reserve for testing. Stripe, PayPal, Adyen, and Authorize.Net each publish a list. The range does not show who issued the card. It marks the number as a test value.
Common test numbers
- Visa: 4111 1111 1111 1111
- Mastercard: 5555 5555 5555 4444
- American Express: 3782 822463 10005
- Discover: 6011 1111 1111 1117
- Stripe decline card: 4000 0000 0000 0002
- Stripe 3DS card: 4000 0025 0000 3155
CVV rules in test mode
Stripe test mode accepts any 3-digit CVC for Visa, Mastercard, and Discover, and any 4-digit CVC for American Express. The field must be present. The digits do not change the result on most test cards.
Some gateways run CVC checks in test mode. A decline code such as CVC mismatch appears when the test transaction maps to a CVC failure. Stripe uses 4000 0000 0000 0101 for a CVC check failure. That card returns a failure result on the CVC field.
Braintree and Authorize.Net accept 123 for most test cards. PayPal sandbox profiles use 111 for Visa CVC2 in some test setups. Check the vendor page for the current value.
Expiry dates and other fields
Test cards accept any future expiry date. ZIP and AVS fields accept any value unless a test card is written to fail the AVS check. Stripe test card 4000 0000 0000 0036 fails the postal code check.
Errors to expect
- Invalid card number means the digits fail Luhn or the length is wrong.
- Invalid CVC means the field length does not match the card brand. Amex needs 4 digits.
- Expired card means the expiry date is in the past.
Limits
Test cards work in sandbox mode and with test API keys. A live key sends the number to the card network, and the transaction fails. Test CVV values do not apply to real cards. The card networks reserve the test ranges, and no bank issues those numbers to a customer.