2Checkout Test CVV: What to Enter in Sandbox Mode

Short answer

In 2Checkout sandbox mode, the CVV field accepts any three-digit value. Enter 123 and continue. The sandbox never sends the CVV to an issuer, so no matching takes place. CVV verification begins only when you process live cards.

Prerequisites

• A 2Checkout (Verifone) sandbox account with test mode turned on
• Your sandbox merchant code and secret key
• A test card number from the current sandbox card list
• A future expiry date written as MM/YY

Steps

1. Sign in to the 2Checkout sandbox dashboard and confirm the account sits in test mode.
2. Open your test checkout page or the hosted payment form.
3. Enter a sandbox test card number from the card list published for your account.
4. Type any three digits in the CVV box. The value 123 works for Visa, Mastercard, and Amex test profiles.
5. Enter a future expiry date, such as 12/30.
6. Fill the billing name, address, and ZIP with consistent values.
7. Submit the order and read the response code on the return page.
8. Repeat the order with a decline test card to check your error handling.
9. Compare the CVV field behavior in live mode before you publish the integration.

Why the sandbox skips CVV

A CVV is a check against the issuer's records. Sandbox transactions never reach an issuer, so there is nothing to check. 2Checkout test mode validates the card number format, the expiry date, and the order payload, then returns a simulated result. Treat test CVV input as a form-filling exercise, not a security control.

Common causes of a failed test order

• The card number is not on the current sandbox list.
• The expiry date is in the past or written in the wrong format.
• The account still points at the live endpoint.
• A required billing field is empty.
• The test card is a decline card by design.

What changes in live mode

Live transactions pass the CVV to the issuer for a match. A failed match can trigger a decline or a review flag, based on your risk settings. Card Verification Value data must not be stored after authorization under PCI DSS. Keep the field out of logs, databases, and support tickets.