CVV Test Mode: How Sandbox Card Verification Works
CVV test mode is a payment gateway sandbox. It accepts fake CVC values, contacts no issuer, and charges no card.
Dummy CVV: Test Card Codes for Payment Sandboxes
What a dummy CVV is
A dummy CVV is a 3-digit or 4-digit code tied to a test card number. Payment processors publish these codes for sandbox testing. The code passes the format check at the gateway and returns a fixed test result. It has no link to a bank account, a cardholder, or a credit line.
Visa, Mastercard, and Discover cards use 3 digits. American Express uses 4. The gateway checks the length, then sends the value to the processor. In test mode the processor replies with a set result instead of contacting an issuer.
Where dummy CVV values come from
Each gateway publishes its own test card list. Stripe documents test card 4242 4242 4242 4242 and accepts any 3-digit CVC with it. Braintree documents test card 4111 1111 1111 1111 and pairs it with CVV 123. Adyen, Square, and Checkout.com publish similar lists. The processor assigns the code. It is not derived from the card number.
Test cards and their CVV values
- Stripe: 4242 4242 4242 4242, any 3-digit CVC, any future expiry date.
- Braintree: 4111 1111 1111 1111, CVV 123.
- American Express test number 3782 822463 10005, 4-digit CVV such as 1234.
- Mastercard test number 5555 5555 5555 4444, 3-digit CVV such as 123.
Forcing a CVV failure
Gateways map some CVV values to decline responses. Stripe test card 4000 0000 0000 0101 returns a CVC check failure. Braintree documents CVV 200 as a mismatch and CVV 201 as not verified. These values let a developer test the decline path in checkout code.
Dummy CVV compared with a real CVV
A real CVV2 is printed on the card and generated by the issuer from the card number and an issuer key. It does not change for the life of the card. Issuers do not publish it. No formula, script, or generator can produce a valid CVV from a card number alone.
Some sites use the phrase to advertise sets of card numbers with CVV values. Those sets contain stolen account data. US law covers this under 18 U.S.C. 1029, which sets penalties for trafficking in access devices. Card network rules bar merchants from storing CVV data after authorization.
Limits of test data
Dummy CVV codes work in sandbox mode. A live gateway rejects them because the card number was never issued. Test keys and live keys sit in separate environments, so a test card cannot charge a live account. Do not ship code that depends on fixed CVV values.