cvv test psd2 steps

Testing a card verification value inside a PSD2 Strong Customer Authentication flow is a sandbox exercise, not a live-transaction drill. This guide sets out the steps developers and QA teams follow to confirm that CVV handling, 3-D Secure challenges, and exemption logic behave correctly before an integration goes live. Every step runs against gateway-issued test cards and test merchant accounts, never real cardholder data.

cvv test psd2 steps

What Does a CVV Test Cover Under PSD2?

It verifies that your integration passes the CVV only to the acquiring gateway, handles the approve, soft-decline, and hard-decline responses correctly, and keeps sensitive authentication data out of your own systems for the whole authentication challenge.

more on this topic

Key Features

• Sandbox card sets mapped to CVV match, CVV mismatch, and CVV-not-checked outcomes
• 3-D Secure challenge and frictionless simulations for SCA coverage
• Exemption checks: low-value, transaction risk analysis, trusted beneficiary, and merchant-initiated
• Decline-code verification for both soft and hard CVV failures
• Confirmation that CVV and full track data never reach your servers, logs, or database
• Reusable test scripts plus a results template you can keep as audit evidence
• Checklist aligned to PCI DSS rules on sensitive authentication data

What Specs Does the Test Environment Need?

You need a sandbox merchant account, sandbox API credentials, a current TLS stack, and the test card set published by your acquirer or gateway. The tester also needs access to the 3-D Secure simulator, the logging pipeline, and the decline-code configuration so each outcome can be traced end to end. Keep the scripts in version control so results stay reproducible across releases.

cvv test psd2 information

Which Steps Should Be Run, and in What Order?

Start with a frictionless authentication and a matching CVV, then replay the same transaction with a mismatched value and with the CVV field left empty. Finish with the exemption paths and merchant-initiated transactions, confirming each one produces the expected authorisation result and the expected log entry.

What Must Never Be Stored?

Full track data, the CVV/CVC2, and the PIN block must not be retained after authorisation in any form, including databases, application logs, and error-tracking tools. Sample your raw logs before sign-off to prove it.

This guide is delivered digitally as a PDF checklist and an editable results template, available immediately after checkout, so there is no physical shipment. If the files do not match the description, contact support within 14 days for a replacement or a refund.