CVV Test Data: What It Is and Where to Get It

What CVV test data is

CVV test data is a set of card numbers, expiry dates, and 3 or 4 digit security codes that payment processors publish for sandbox accounts. The numbers pass format checks and the Luhn checksum. They are not tied to a bank, a cardholder, or a credit line. They work in test mode. A live transaction with the same digits fails with an error such as "invalid card number" or "do not honor."

CVV Test Data Free: How to Use and Where to Find It

Where test data comes from

Each processor maintains its own table. The table lists a PAN per card brand, a fixed expiry, and a CVC value that triggers a pass or a decline.

related article

• Stripe publishes test PANs for Visa, Mastercard, American Express, Discover, JCB, and UnionPay, plus decline codes.
• Adyen, Braintree, and Checkout.com publish similar tables.
• Card networks reserve BIN ranges for test use. Those ranges never route to an issuer.

CVV format rules in a sandbox

Visa, Mastercard, and Discover use 3 digits printed on the back of the card. American Express uses 4 digits on the front. A sandbox checks digit count first. Some processors then accept any 3 digits. Others require a specific value to force a decline, for example 000 or a paired error code.

CVV Test Data Download: A Comprehensive Guide

Luhn check

The Luhn algorithm is a mod 10 checksum over the digits. It catches typos and single digit errors. It does not prove a card is live. Test PANs are built to pass Luhn, so a passing checksum says nothing about validity.

Test mode vs live mode

API keys set the mode. Keys that start with sk_test_ route to the sandbox. Live keys route to the card networks. Test data sent with a live key returns a decline. Sandbox keys cannot move money. A 16 digit test PAN submitted to a live endpoint produces the same result as a random number: an authorization failure and, at some issuers, a fraud flag on the merchant account.

PCI DSS and stored CVV

PCI DSS Requirement 3.2 classifies CVV2, CVC2, CAV2, and CID values as sensitive authentication data. Merchants may not store them after authorization, in any form, including encrypted. A production database column labeled cvv is an audit finding and a path to fines and loss of card acceptance. No legitimate system keeps a "CVV test data" file outside a sandbox.

Marketplaces that sell CVV data

Forums and shops that list real card numbers, CVV values, and cardholder names are not test data. In the US, 18 U.S.C. 1029 covers trafficking in access devices. A first offense carries up to 10 years; a second carries up to 15 years, plus fines. Card network rules and state laws add separate claims. The data in those shops comes from breaches, skimmers, and phishing kits, and buyers face charges for possession and use.

How to check if a dataset is test data

1. Compare the PAN to the processor's published test table.
2. Run a Luhn check on the digits.
3. Check the BIN against the reserved test ranges.
4. Send it through a sandbox key, never a live key.
5. Check the source. Processor docs list test data. A chat channel does not.

Key numbers to remember

CVV length: 3 digits for Visa, Mastercard, Discover; 4 for American Express. Storage window for sensitive authentication data after authorization: zero. Statutory maximum for access device trafficking: 10 years for a first offense. Sandbox keys: prefixed sk_test_ at most processors. Live keys: every authorization you run counts against your approval rate.