CVV Test UnionPay: How to Validate UnionPay Card Verification in Sandbox

What is a CVV test for UnionPay?

A CVV test for UnionPay checks the 3-digit card verification value on the back of a UnionPay card inside a test or sandbox environment. It confirms your payment form reads and sends the CVV field without errors, using only test credentials from your payment processor. Never test with real customer cards.

How does UnionPay CVV verification work?

UnionPay cards carry a 3-digit CVV2 code on the back, separate from the data on the magnetic stripe. Online merchants ask for this code during card-not-present transactions to reduce fraud. Under PCI DSS rules, merchants must not store the CVV after authorization.

The CVV2 is not the same as the CVV on the magnetic stripe. The stripe CVV is used when a card is swiped; the CVV2 is for online or phone orders. UnionPay follows this pattern for its card-not-present transactions.

Steps to test UnionPay CVV in a sandbox

1. Get sandbox API keys and test card numbers from your payment processor.
2. Set your checkout form to send the CVV field as it would in production.
3. Submit a test transaction with a valid UnionPay test card and matching CVV.
4. Check the response code for approval or decline.
5. Repeat with a wrong CVV to confirm your form handles errors.

Run each test in a separate sandbox environment so you do not mix test and live data. Log the response codes for each scenario.

Test scenarios to cover

• Valid UnionPay test card and matching CVV: expect approval.
• Valid test card and wrong CVV: expect a CVV mismatch error.
• Missing CVV field: expect a validation error from your form or the processor.
• Expired test card: expect a decline for expired card.
• Invalid card number format: expect a format error.

Where to find UnionPay test card numbers

Payment processors publish test card numbers for UnionPay in their developer docs. Stripe, Adyen, and Checkout.com list sandbox cards with fixed CVV values. Use those numbers only in test mode and never in a live charge.

Common errors during CVV testing

• Invalid CVV: the form sends the wrong length or non-numeric characters.
• CVV missing: the field is not included in the API request.
• CVV mismatch: the test card number does not match the CVV in the processor's list.
• Card not supported: the processor sandbox does not enable UnionPay as a card brand.

Fix these by checking your form validation, the processor's test card table, and your sandbox settings for UnionPay support.

Understanding CVV response codes

Processors return specific codes for CVV checks. Common responses include "CVV match", "CVV mismatch", "CVV not present", and "CVV not verified". Your integration should map each code to a user-friendly message.

For UnionPay test transactions, use the response code to confirm your form sends the CVV field. A "CVV not present" code means the field is missing from the request. A "CVV mismatch" code means the test card number and CVV do not match the processor's test data.

How UnionPay differs from other card networks in testing

UnionPay is a major card network in China and parts of Asia. Some payment processors enable UnionPay in sandbox only with specific merchant country settings. Check your processor's docs for any regional restrictions.

UnionPay test cards may use BIN ranges that differ from Visa or Mastercard. Your form should accept 16 to 19 digit card numbers, as UnionPay cards can have varying lengths. Test with multiple card lengths to confirm your validation rules work.

Setting up a sandbox for UnionPay testing

Create a separate sandbox account with your payment processor. Enable UnionPay as a card brand in the sandbox settings. Use the processor's test card numbers and fixed CVV values for each test scenario.

Keep your sandbox API keys out of production code. Use environment variables to switch between test and live keys. Log only the response codes, not the CVV values.

Why buying or selling CVV data is illegal

Real CVV data is sensitive cardholder information. Buying or selling it violates card network rules, PCI DSS, and laws in most countries. Use only sandbox test data for any CVV testing.

If you run a payment integration, store no CVV data after authorization. Tokenization replaces the CVV with a token that you can use for recurring payments without keeping the original code.

Legal penalties for carding or trafficking CVV data include fines and prison time. Report suspected fraud to your payment processor and local authorities.

Security practices for CVV testing

• Use a sandbox environment isolated from production.
• Never log CVV values in plain text.
• Follow PCI DSS requirements for any system that handles card data.
• Use test card numbers from your processor, not real cards.
• Rotate sandbox API keys and restrict access to test credentials.

Frequently asked questions

Can I test UnionPay CVV with a real card?

No. Real card testing risks fraud and violates card network rules. Use sandbox test cards only.

What is the CVV length for UnionPay?

UnionPay CVV2 is 3 digits on the back of the card.

Do all payment processors support UnionPay test cards?

Most major processors do. Check your processor's documentation for the exact test card numbers and CVV values.

What should I do if my test transaction fails?

Check the error code, confirm the test card number and CVV match the processor's list, and verify your form sends the CVV field.

Is CVV testing the same as CVV validation?

Testing checks your integration in a sandbox. Validation is the live check of a real CVV during a transaction. Both use the same field but different data sources.