CVV Test for PCI DSS Process: Sandbox Values and Storage Checks

Short answer

A CVV test for a PCI DSS process checks two things. The payment form accepts a CVV value. The system does not store the CVV after authorization. Use sandbox test card numbers and the test CVV values from the payment processor. Do not use a live card number or a real CVV.

CVV Test for PCI DSS: A Comprehensive Guide

What the test covers

Input and validation

The test sends a test PAN and a test CVV to a sandbox endpoint. It checks field length, field type, and error handling. Visa CVV2 and Mastercard CVC2 use 3 digits. American Express CID uses 4 digits. The form should reject a blank CVV and a CVV with the wrong length.

cvv test for pci dss steps

Storage and logs

The test checks the database, application logs, API payloads, receipts, and analytics events after authorization. A CVV field in any of these locations is a fail. The test also checks that the payment page does not write the CVV to browser storage or support tickets.

cvv test for pci dss process

PCI DSS rule for CVV

PCI DSS calls CVV, CVV2, CVC2, and CID sensitive authentication data. PCI DSS v4.0 Requirement 3.3.1 states that sensitive authentication data is not stored after authorization. The rule applies to databases, logs, receipts, error messages, and analytics events. Encryption does not make post-authorization CVV storage compliant.

Test setup

1. Get test card numbers from the acquirer or payment gateway. Use the test CVV values in the gateway documentation.
2. Point the test payment page to the sandbox endpoint. Use a test merchant account.
3. Run one approved test transaction and one declined test transaction.
4. Check the form response, the database, the logs, and the receipt for the CVV value.
5. Save the request ID, timestamp, test PAN, and test result in the PCI DSS file.

Pass and fail evidence

• Pass: the form rejects a blank CVV and accepts the test CVV.
• Pass: database columns, logs, and event payloads show no CVV field after authorization.
• Fail: the CVV appears in application logs, database rows, receipts, or support tickets.
• Fail: the test page sends a live PAN or a real CVV to the sandbox.

Limits

A CVV test is one control check. It does not prove PCI DSS compliance. A full assessment covers network segmentation, access control, encryption, logging, and scans. Keep test evidence with the PCI DSS file.