Checkout.com Test CVV: Sandbox Testing Guide

Checkout.com test CVV: the short answer

A Checkout.com test CVV is a placeholder security code used only in the sandbox. It is not a real card verification value. It cannot authorize a live payment and it should never come from a customer, a card dump, or a marketplace. In test mode, you use the test card numbers that Checkout.com publishes in its documentation or dashboard. Those test cards come with matching test expiry dates and test CVVs. If a test case fails, check the official test card record first. Do not improvise with live card data.

Why test CVVs exist

Payment integrations need to exercise the same fields that a real checkout uses. The CVV field is part of that flow. A test CVV lets a developer confirm that the form sends the field, that validation runs, and that the gateway returns the expected response. The value has no financial meaning. It exists to catch integration mistakes before a live account touches real money.

How to test safely

• Use the test card numbers from the official Checkout.com sandbox docs or dashboard.
• Match the test expiry date and test CVV to the test card you selected.
• Keep test and live credentials separate. A sandbox key should never work in production.
• Log only what you need. Do not store CVV values, even test ones, in production logs.
• Run decline, success, and validation cases with the published test records.

What not to do

Buying or selling CVVs is not a testing shortcut. It is card fraud. In the US, trafficking in stolen payment card data can bring federal criminal charges and civil liability. A test CVV from a random seller is not a Checkout.com test value. It is either a fake, a stolen data point, or bait. Treat it as a legal and security risk, not a tool.

If you run a store

Use the sandbox to confirm your checkout behavior, then switch to live credentials only after review. Train staff to never ask for a CVV by email or chat. PCI rules treat the CVV as sensitive authentication data. You may pass it during authorization, but you must not store it afterward. That rule applies to test accounts too, because bad habits carry over.

For legitimate testing, the official Checkout.com test cards are enough. If you need a specific decline code, look for the test case that produces it. Do not hunt for real CVVs to make a sandbox test pass. A sandbox test should never need one.