Card Number Test: Sandbox Test PANs and What They Verify
Buy Gift Cards from Google®, Apple®, Steam® or your choice from our store. Pay securely with your preferred payment method.
A card number test uses a sandbox number supplied by a payment processor. Sandbox numbers pass the Luhn check and return simulated results in test mode. They link to no real account. A test number cannot charge a customer, and it cannot validate a card that belongs to someone else.
The Luhn algorithm is a checksum on the digits. Start at the right and double every second digit. Subtract 9 from any result above 9. Add all digits. The total divides by 10 with no remainder. 4242424242424242 passes. 4242424242424241 fails.
Luhn catches typing errors. It does not tell you if an account exists, holds funds, or is open.
Processors also publish decline numbers. Stripe lists 4000 0000 0000 0002 for a generic decline and 4000 0000 0000 9995 for insufficient funds. Expiry dates on test cards are arbitrary. The CVC is any three digits, or four for American Express.
Test numbers route to a simulator. The simulator returns approve, decline, or error based on the number you enter. Live mode rejects test PANs. Sandbox mode rejects live PANs. Processors keep the two environments separate for that reason.
Card testing is the practice of sending real card numbers to a payment page to learn which ones approve. Attackers use small amounts and many numbers. Issuers and processors watch for this pattern. Signals include a burst of authorization attempts from one IP address, a high decline rate, and mismatched billing data.
In the US, 18 U.S.C. section 1029 covers the use and trafficking of unauthorized access devices. Penalties rise with the number of devices and the loss amount. Card networks fine merchants for chargebacks that follow a testing run.
PCI DSS covers card data. Requirement 3.2.1 bars storage of sensitive authentication data after authorization. That data includes the full magnetic stripe, the CVV2, CVC2, and CID values, and PIN blocks. A merchant that keeps these values after a transaction is out of compliance.
This article does not cover buying, selling, or validating card data that belongs to other people. Test numbers come from processor documentation and cost nothing.
You will receive the digital voucher immediately.
All your data is transmitted with unbreakable SSL-RSA encryption.
You can give away, resell or keep the vouchers.
We are available for you 24 hours a day.
Be informed as soon as new vouchers are added or when there are discounts.