CVV 3-Digit Test Tutorial for Sandbox Payments

What a CVV 3-digit test does

A CVV test confirms that your checkout form reads, validates, and passes along the 3-digit security code printed on the back of a Visa, Mastercard, or Discover card. You run the test in a payment gateway sandbox with published test card numbers, so no real cardholder data is involved. In test mode the gateway accepts any 3-digit value, which lets you verify that the field takes input, rejects bad formats, and hands the value to tokenization without storing it.

related article

The CVV is not covered by the Luhn check. Luhn applies to the 16-digit primary account number only. A 3-digit code of 000 passes a format check, so your validation has to be explicit.

CVV 3-Digit Test Overview: A Comprehensive Guide

Prerequisites

• Sandbox API keys from your payment gateway.
• The test card numbers listed in your gateway's developer documentation.
• A staging checkout form already wired to the test endpoint.
• Browser dev tools open on the Network tab.

Steps

1. Swap your live API keys for sandbox keys in the staging environment config.
2. Open the staging checkout page.
3. Enter a test card number from your gateway's list, such as a Visa test PAN.
4. Enter any 3-digit value in the CVV field, for example 123.
5. Enter an expiry date in the future.
6. Submit the form and confirm the sandbox returns a successful charge response.
7. Open the Network tab and check that the CVV value appears only in the outbound tokenization request.
8. Repeat the submission with a 2-digit value and confirm the form blocks it before any network call.
9. Repeat with a 4-digit value on a Visa test card and confirm the form rejects it.
10. Repeat with letters and with an empty field, then confirm each case returns a clear inline error.
11. Switch to an Amex test card and confirm the field accepts 4 digits and relabels itself as CID.
12. Confirm the CVV field never appears in your application logs or database rows after the charge settles.

Negative cases worth a separate test run

• Whitespace before or after the digits.
• Leading zeros such as 007.
• Pasted values with a trailing space from a clipboard.
• Autofill from a saved browser card.
• Mobile numeric keypad behavior on iOS and Android.

Why the value must disappear after authorization

PCI DSS Requirement 3 forbids storing the card verification code after authorization, in any form, encrypted or hashed. The CVV goes to the gateway, comes back as part of the authorization result, and is then discarded. If your staging build writes the submitted form body to a log file, that log is now out of scope compliance and needs purging. Check the log sink before you run production traffic through the same code path.

related article

Reading a failed sandbox response

A decline in sandbox mode usually means a mismatched test card number, an expired test expiry date, or a request sent to the live endpoint by mistake. Compare the card number against the gateway's current test list first, then check which endpoint the request hit.