Sandbox Test CVV: Test Card Values Explained

Short answer

A sandbox test CVV is a fake 3 or 4 digit value. It works inside a payment gateway test environment. It is not tied to a bank, a cardholder, or an account. No charge is created. Most gateways ignore the digits you type and return a result based on the test card number instead.

How test card numbers work

Payment processors give developers a set of test card numbers. Stripe lists 4242 4242 4242 4242 as a card that always approves. PayPal and Adyen publish their own lists. Each number maps to a fixed outcome: approval, decline, insufficient funds, or a fraud rule hit.

The CVC field on those test cards accepts any value in most cases. Some gateways require 3 digits for Visa and Mastercard test cards, and 4 digits for American Express test cards. A few gateways use a fixed value such as 123 to trigger a CVC mismatch error.

What the sandbox checks

• Length and format: 3 digits for most brands, 4 for Amex.
• Presence: an empty field can return a CVC check failure code.
• Response mapping: the gateway returns codes such as CVC check failed or postal code failed, so you can test your error handling.

A sandbox does not run a real authorization. It does not contact an issuer. It does not store cardholder data.

Real CVV data

A CVV on a live card is cardholder data under PCI DSS. Requirement 3.2 bars storage of the CVV after authorization, including in encrypted form. Buying, selling, or holding CVV data from cards you do not own is a federal crime in the US under 18 U.S.C. 1029. A first offense carries up to 10 years in prison. A repeat offense carries up to 20 years.

Sandbox test values have no cash value. They work in one test account. They fail on a live gateway.

Common mistakes

1. Using a test card on a live endpoint. The charge fails or the account gets flagged.
2. Hardcoding a test CVV in production code.
3. Using your own real card for load tests. This creates real charges and real disputes.