Authorize.net Test CVV: Sandbox CVV Values and Codes

Short answer

The Authorize.net sandbox uses the test card numbers listed in its developer documentation. The CVV that goes with them is 123. Use any expiration date in the future. The gateway returns a card code result in the transaction response. The values are M, N, P, S, U, and X.

Which CVV the sandbox expects

Authorize.net documents 123 as the CVV for test transactions. Send it in the card code field of the request. The sandbox checks the format of the value. It does not call an issuing bank.

Values other than 123 are not covered in the published sandbox guide. If your code branches on a no-match result, test that branch against your own rules and confirm the current behavior with Authorize.net.

Test card numbers

These numbers come from the Authorize.net developer documentation.

• Visa: 4007000000027
• Mastercard: 5424000000000015
• American Express: 370000000000002
• Discover: 6011000000000012
• JCB: 3088000000000017
• Visa decline: 4012888818888

Set the expiration date to a month and year ahead of the current date. The sandbox does not check the billing address against an issuer record. Address verification results in the sandbox come from the test rules, not from a bank.

Card code response codes

• M: match. The code sent matches the code on file.
• N: no match.
• P: not processed.
• S: the code should have been on the card, but the request left it out.
• U: the issuer could not verify the code.
• X: the card has no code, or the code does not apply.

The transaction response holds one letter. Store it with the transaction record. A CVV result is tied to one authorization request.

Card Code Verification filter

The Fraud Detection Suite in the Authorize.net merchant interface has a Card Code Verification filter. It can reject a transaction when the code does not match. It can also reject a transaction when the code is missing from the request.

Filter actions are allow, reject, or review, depending on the filter. Settings apply at the account level. A change affects live traffic.

Sandbox versus production

The sandbox uses its own gateway host, API login ID, and transaction key. Production credentials do not work in the sandbox, and sandbox credentials do not work in production.

Production accounts also have a Test Mode setting. Transactions submitted in Test Mode are not sent to the card networks. Confirm the current status of that setting in the merchant interface.

What a test CVV cannot tell you

The sandbox does not model issuer CVV behavior. A real N result comes from the issuing bank, not from the gateway. Test data does not measure your approval rate, your interchange cost, or how a processor handles a mismatch. Those numbers require live traffic.

Card code basics

Visa, Mastercard, Discover, and JCB print a 3-digit code. American Express prints 4 digits on the front. The code is not stored on the magnetic stripe or the chip. A merchant that stores card data for recurring billing keeps the account number, not the code.