What Is a Dummy Card Number? A Guide to Test Cards

A dummy card number is a fake card number built to match the format of a real Visa, Mastercard, Amex, or Discover card. It passes basic validation, including the Luhn checksum, so a payment form accepts it as valid input. It has no bank behind it, no balance, and no cardholder. Payment gateways publish these numbers for sandbox testing.

The string quoted most often is 4242 4242 4242 4242. That number shows up in payment tutorials because Stripe, PayPal, and other processors accept it in test mode.

What does a dummy card number look like?

Test numbers copy the shape of a real card, digit for digit. The first digits signal the network, and the last digit acts as a checksum.

• 16 digits for Visa, Mastercard, and Discover.
• 15 digits for American Express.
• A leading digit that points to the network: 4 for Visa, 5 or 2 for Mastercard, 3 for Amex, 6 for Discover.
• A final Luhn check digit.
• A future expiry date and any 3 or 4 digit CVC.

How is a dummy card number different from a real one?

Three things set them apart: no issuer, no funds, and no link to a person. A real card number maps to a bank account, and a charge routes through the card network to that bank. A dummy number lives only inside a test database.

Outside test mode, a dummy card number fails. Live networks reject it because no issuer recognizes the sequence.

Do dummy card numbers need to pass the Luhn check?

Yes, if you want a checkout form to accept them. The Luhn algorithm adds a check digit so a system can catch typos and swapped digits. That is all it does. A number that passes Luhn can still be fake, and every published test card works that way.

Why do developers test with dummy card numbers?

Test cards let a team exercise a payment flow without touching live money or live card data. Each published number triggers a specific outcome, so you can see how your code handles both good and bad results.

• Approval paths: confirm an order completes and a receipt sends.
• Decline paths: check the message a shopper sees when a card fails.
• Authentication: test 3D Secure prompts and step-up flows.
• Refunds, voids, chargebacks, and subscription renewals.
• Data safety: keep live card numbers out of staging servers and logs.

How do you use a dummy card number in a test flow?

1. Switch your gateway account to test mode and copy the sandbox API keys.
2. Load your checkout page with those keys in place.
3. Enter a test card number from the gateway docs, plus a future expiry and any CVC.
4. Submit the order and read the response code the gateway returns.
5. Repeat the run with decline, authentication, and refund numbers.
6. Clear test data before you push the build to production.

How do I pick a CVC and expiry for a dummy card?

Use any three digits for Visa, Mastercard, and Discover, or four digits for Amex. Set the expiry to a date in the future. A sandbox skips the issuer check, so the values only need to match your form rules.

Do test numbers work across gateways?

No. A test number belongs to the gateway that published it. A Stripe test card will not behave the same way at Authorize.Net, and a number from one region may fail on another region's sandbox. Always pull numbers from your own provider's docs.

Are dummy card numbers legal?

Yes. Using numbers that a gateway publishes for testing is normal practice and breaks no law. What is illegal is using a card number that belongs to someone else, or trading real card data. In the US, 18 U.S.C. Section 1029 covers fraud tied to access devices, and card numbers fall inside that definition.

Selling or buying stolen card data can lead to federal charges, fines, and restitution. It also sits outside PCI DSS, the standard that governs how merchants store, process, and transmit cardholder data. If you need a number to test a checkout, take one from your provider's official test list.

Common mistakes with dummy card numbers

• Pointing a test number at a live endpoint. You get a decline and a failed order.
• Testing only approvals. Breakage shows up on decline and timeout paths.
• Hard-coding a number into source. Put test values in config or fixtures instead.
• Assuming a Luhn pass means a card is real. It does not.
• Copying a customer's live card into a staging database. That pulls your team into PCI scope for no reason.

FAQ

Can I buy something with a dummy card number?

No. Real merchants run in live mode, and the card networks reject any number with no issuer. A site that claims to accept one is either a test environment or a scam.

Where do I find dummy card numbers?

Check the documentation of the provider you use. Stripe, PayPal, Adyen, and Authorize.Net each list test numbers, test expiry dates, and the result every number produces.

Is a dummy card number the same as a virtual card number?

No. A virtual card number is real. Banks issue virtual cards tied to a funded account, and they can pay for goods and services. A dummy card number links to nothing and works only in a sandbox.

Why does my form still reject a test number?

Check three things: the number passes Luhn, the length matches the network, and your account is in test mode. A mismatch on any of the three throws a validation error before the gateway ever sees the request.