CVV Test Data Set: Safe Sandbox Guide

Answer

A CVV test data set is a collection of synthetic card numbers and matching test CVV values published by a payment processor for sandbox testing. It is not a list of real cardholder credentials, and it should never contain a real CVV. Use it to confirm that your checkout form, tokenization flow, and error handling accept or reject test transactions as expected.

cvv test data examples

What a CVV test data set contains

• Synthetic primary account numbers that route to a sandbox, not the live card network.
• Test CVV values tied to those synthetic account numbers.
• Expiry dates and cardholder names for form testing.
• Response scenarios such as approval, decline, and CVV mismatch.

Processor documentation defines the exact values. The values change by processor and environment.

read more

Prerequisites

• Access to the payment processor's developer sandbox.
• A test API key, not a live key.
• A checkout page or API client pointed at the sandbox endpoint.
• A log policy that excludes real card data.

How to use a CVV test data set

1. Open your payment processor's sandbox test card page.
2. Copy one published test card number and its matching CVV.
3. Paste the values into your sandbox checkout form.
4. Submit the payment and record the response code.
5. Repeat with a CVV mismatch case from the same test set.
6. Confirm that your form rejects invalid CVV formats before submission.
7. Remove test values from production logs and screenshots.

Rules for safe testing

• Use only test values published by your processor.
• Never use a real card number or real CVV in a test environment.
• Never store a CVV after authorization. PCI DSS prohibits retention of the CVV.
• Keep sandbox keys separate from live keys.
• Do not buy, sell, or share card data. Possession or sale of stolen card data is illegal.

How to verify test results

Match each test case to an expected result. An approval case should return an approval code. A CVV mismatch should return the processor's CVV failure code. A format error should stop at client-side validation. Review the response body, the status code, and your application log. Confirm that no CVV appears in the log.

read more

Common mistakes

• Using a live key in a sandbox test.
• Mixing test account numbers with live CVV rules.
• Logging the full request body with the CVV.
• Treating a published test set as a source of real card data.

FAQ

Is a CVV test data set legal?

Yes, when it contains only synthetic test values from a processor. Real card data is different. Buying or selling real CVV data is illegal.

Can I use a test CVV on a live site?

No. Test values work only in the processor's sandbox. A live site needs a live payment flow with tokenization.

Why does my test CVV fail?

Check the sandbox endpoint, the test API key, and the exact card number and CVV pair from the processor documentation.