Fake CVV for Testing: Sandbox Test Values

What a fake CVV for testing is

A fake CVV for testing is a 3 or 4 digit number that pairs with a published test card number in a payment sandbox. It links to no bank account and no cardholder. The value comes from the gateway documentation. A sandbox runs the same code path as a live charge but sends no data to a card network.

Three gateways publish test card numbers and the matching CVV values: Stripe, Braintree (PayPal), and Adyen.

Published test values

• Stripe: card 4242 4242 4242 4242, any 3 digit CVC, any future expiry date.
• Stripe decline test: card 4000 0000 0000 0127 returns an incorrect CVC decline.
• Braintree: card 4111 1111 1111 1111, CVV 123, expiry 05/2025 or later.
• Adyen: test card 4111 1111 1111 1111, CVC 737, expiry 03/2030.

What the sandbox checks

Some sandboxes accept any 3 digit CVV for a passing card. Others compare the CVV to the published value and fail the charge when the digits differ. Stripe accepts any CVC on card 4242 4242 4242 4242, but card 4000 0000 0000 0127 fails on purpose. Test the CVV mismatch path with a card built for that decline.

CVV length depends on the brand. Visa, Mastercard, and Discover use 3 digits. American Express uses 4 digits on the card front. Test cards for Amex use 4 digit test values, for example 3782 822463 10005 with CVC 1234 in the Stripe sandbox.

Why a fake CVV fails on a live card

The issuer checks the CVV against the value printed on the card. A wrong value returns decline code N7 on the ISO 8583 response, or the gateway label for a CVC mismatch. The check runs at authorization. A number that works in a sandbox has no entry in an issuer database, so a live charge with it fails.

PCI DSS requirement 3.2 blocks storage of the CVV after authorization. A merchant cannot look up a CVV later. That rule removes any path to reuse a test value on a live card.

Legal status in the US

18 U.S.C. § 1029 covers trafficking in access devices. A card number with its CVV counts as an access device under the statute. Sale of live card data is a federal crime. Test values printed in gateway documentation are public strings, not access devices, and carry no account.

Test plan checklist

1. Use sandbox API keys, not live keys.
2. Run one charge with a passing test card.
3. Run one charge with an incorrect CVC test card.
4. Confirm the decline code reaches your error handler.
5. Log the response code, not the CVV.