CVV Test Data: Sandbox Test Values Explained

What CVV test data is

CVV test data is a fixed card verification value that a payment processor publishes for sandbox use. The values pair with test card numbers, not with live accounts. Stripe lists 4242 4242 4242 4242 with CVC 123 and any future expiry. Adyen lists 4111 1111 1111 1111. Braintree lists 4012 8888 8888 1881. These return approvals when the request carries a test key, such as sk_test_. The same numbers return card_declined or incorrect_cvc against a live key.

cvv test data set

How CVV checks work in production

A merchant sends the CVV inside the authorization request. The issuing bank compares that value to the one it holds. The bank returns a result code: match, no match, or not processed. The merchant sees the code and nothing else. Card network rules and PCI DSS Requirement 3.2 bar storage of the CVV after authorization. A processor that keeps the value in a database is out of compliance.

CVV Test Data Collection Guide

Why live CVV data cannot be tested

The CVV sits on the card and in the issuer system. No public generator computes it. The field holds 3 digits for Visa and Mastercard, 4 for American Express. A random guess hits 1 time in 1,000 for a 3-digit value. Issuers block a card after a small number of failed checks, and many issuers flag the merchant account that sent them.

CVV Test Data Download: A Comprehensive Guide

Lists that circulate as cvv test data for live cards are stolen records, not test values. Buying, selling, or using them falls under 18 U.S.C. 1029, which carries up to 10 years for a first offense. Automated checks against live cards, often called card testing, produce chargebacks and account termination.

Test values in a codebase

• Keep test keys and live keys in separate configuration files.
• Add a check that rejects test card numbers when the live key is loaded.
• Log the issuer response code, not the CVV.
• Set the test expiry date to a future month so the sandbox does not return an expired_card error.

Common sandbox errors

incorrect_cvc means the value did not match the test profile for that card number. card_declined with a generic decline code means the test number is one the processor set to fail.