CVV Test Cases: Payment Form Validation QA Guide

What are CVV test cases?

CVV test cases are QA scenarios that verify whether a payment form accepts, formats, and rejects card verification values correctly. A CVV or CVC is the 3-digit code on the back of most cards and the 4-digit code on the front of American Express cards. Testers run these cases against sandbox card numbers issued by a payment processor, never against live cardholder data.

How do you run CVV tests without real card data?

Use the test card numbers published by your payment gateway or acquirer. Each sandbox card returns a defined result, such as an approval, a CVV mismatch decline, or a generic decline. Sandbox data carries no real cardholder value, so it stays outside PCI DSS storage restrictions.

Never collect, store, or reuse a live CVV to test a form. PCI DSS classifies the CVV as sensitive authentication data that cannot be retained after authorization.

Which CVV test cases should every suite include?

Positive cases

• Valid 3-digit CVV on a Visa, Mastercard, or Discover test card.
• Valid 4-digit CID on an American Express test card.
• Correct CVV paired with an approved test card number and a future expiry date.
• CVV entered after the card number autofills the field.

Negative cases

• Two digits, five digits, or an empty CVV field.
• Alphabetic characters, symbols, or mixed input such as 12a.
• Leading zeros such as 007 on a card that expects three digits.
• Spaces or hyphens pasted from a clipboard.
• A valid-format CVV that does not match the card number, which should trigger a mismatch decline.

Boundary and format cases

• Maximum and minimum length for each card brand.
• An Amex card number submitted with a 3-digit CVV, which should fail brand validation.
• A non-Amex card number submitted with a 4-digit CVV.
• Masked field behavior, plus paste, autofill, and mobile numeric keypad input.

What result should a failed CVV check return?

A mismatch should produce a decline, not an approval, and the response should never echo the submitted code. Gateways typically map the issuer response to a CVV result of match, no match, or not processed. Your suite should assert that a no-match result blocks the transaction and that the customer-facing message stays generic enough to avoid guiding an attacker.

How do you keep CVV testing compliant?

Restrict CVV handling to the authorization request and drop it immediately afterward. Log the result code rather than the value, and mask the field in every screenshot or test artifact. If your team archives test evidence, use sandbox values only.

FAQ

Is a CVV test case the same as an AVS test case?

No. CVV cases validate the verification code, while AVS cases compare the billing address and postal code. Most suites run both because an issuer can decline on either check.

Can you automate CVV test cases?

Yes. Format, length, and input-type checks fit UI automation well, while approval and mismatch responses require sandbox card numbers that return those specific outcomes.