The short answer
Any three digits work as the CVV on a Stripe test card. Put 123 in the field, use 4242 4242 4242 4242 as the number, and pick any expiration date in the future. The charge succeeds. Stripe does not send test mode requests to a real card network, so there is no issuer on the other end deciding whether 123 matches anything. The value is checked for format, not for truth.
Why any test CVV is accepted
Test mode lives entirely inside Stripe. The card number is recognized as a test PAN, the payment is simulated, and the response is generated from Stripe's own rules. Some cards are wired to fail on purpose so you can build error handling. For those, the CVC outcome is decided by the card number you chose, not by the digits you typed. That is why you can test a declined CVC without hunting for a specific three-digit code.
Numbers I keep around
- 4242 4242 4242 4242: Visa, three-digit CVC, succeeds with any future expiry.
- 5555 5555 5555 4444: Mastercard, same rules.
- 3782 822463 10005: American Express, four-digit CID, not three.
- 6011 1111 1111 1117: Discover.
- 4000 0000 0000 0002: generic decline, useful for the sad path.
- 4000 0000 0000 9995: insufficient funds.
- 4000 0000 0000 0069: expired card.
Testing a CVC failure on purpose
Use 4000 0000 0000 0127 and the charge declines with an incorrect CVC code. 4000 0000 0000 0101 is the one that comes back with a failed CVC check rather than a hard decline. Both are worth wiring into your test suite once. I put them in a table with the rest of the failure cards, because hunting for them later is annoying. Stripe adds and retires these numbers over time, so confirm against the current docs before you hard-code anything.
Stripe Test CVV Example: Test Card Numbers and CVV Values
Where people trip up
- Pasting a test card into a live key. Test PANs do not authorize against a real account.
- Typing a three-digit CVC on an Amex card. Amex uses four.
- Entering a real card number while testing. There is no reason to, and it drags real cardholder data into a sandbox.
- Assuming 4242 tests everything. It skips the interesting failures.
Quick checklist
- Switch to test mode and confirm you are using a test key.
- Use 4242 4242 4242 4242 with any future date and 123.
- Add a decline card and an incorrect CVC card to your suite.
- Keep test keys out of production builds and out of your repo.
That covers it. The CVV field on a successful test charge is decorative. The card number is what drives the result.