The most commonly used test card number for payments is 4242 4242 4242 4242, a Visa number published by Stripe for sandbox testing. It approves with any future expiry date and any three digit CVC, but only inside a payment processor's test mode. Live networks reject it, so it can never move real money.
How to Use a Dummy Test Card Number
What is a test card number?
A test card number is a fake account number that a payment gateway recognizes as a simulation trigger. Processors publish these numbers in their developer docs so engineers can run charges, refunds and error paths without touching a real bank account. Each number passes the Luhn checksum, which is why it looks valid to form validation scripts.
Which test card numbers work for each brand?
These sandbox numbers are documented by major gateways and cover the four main card networks.
- Visa: 4242 4242 4242 4242, CVC any 3 digits
- Visa (PayPal sandbox): 4111 1111 1111 1111
- Mastercard: 5555 5555 5555 4444
- Mastercard 2-series: 2223 0031 2200 3222
- American Express: 3782 822463 10005, CVC 4 digits
- Discover: 6011 1111 1111 1117
- JCB: 3566 0020 2036 0505
Expiry dates should be in the future, and billing address fields accept any plausible value. Zip code checks in test mode usually pass with 42424 or any five digits the gateway specifies.
How do you test a declined payment?
Processors publish separate numbers that force a specific failure, which is how you verify your error messaging.
- Generic decline: 4000 0000 0000 0002
- Insufficient funds: 4000 0000 0000 9995
- Expired card: 4000 0000 0000 0069
- Incorrect CVC: 4000 0000 0000 0127
- Processing error: 4000 0000 0000 0119
Do test card numbers ever charge a real card?
No. A sandbox number routes to a simulated acquirer and returns a canned response, so no authorization reaches a bank. The number only behaves differently if you paste it into a live checkout page, where it fails instantly. Test mode is enabled by your secret API key or a dashboard toggle, not by the card itself.
How do you test 3D Secure and authentication flows?
Gateways provide dedicated numbers that trigger an authentication challenge. Stripe, for example, uses 4000 0025 0000 3155 to require 3DS and 4000 0000 0000 3220 to require 3DS2. Checkout.com and Adyen publish similar numbers with a fixed one-time passcode, often 1234, for the challenge screen.
Are test card numbers legal to use?
Yes, when they are used in a processor's sandbox for development and QA. They are public documentation artifacts, not stolen data, and they carry no value outside test mode. Entering a real card number you do not own is card fraud in every jurisdiction, and no test number protects you from that outcome.
What is the difference between a test card and a gift card?
A test card exists only inside a simulated environment and has zero balance by design. A gift card is a funded, live instrument, so a test number will not redeem on a real gift card portal. Keep the two separate in your QA checklist.