Payment Card Test Details: Sandbox Cards and Card Testing Fraud

What are payment card test details?

Payment card test details are the card numbers, expiry dates, security codes, and billing postal codes that payment processors publish for use in test mode. They match the format of real card data and pass checks such as the Luhn algorithm, but they run on a sandbox network that moves no money. Send one to a live payment endpoint and the processor rejects it.

payment card test tutorial

What each test detail covers

• Card number: digits that route to a test BIN (bank identification number). Each test BIN triggers a set outcome, such as approval, decline, or a 3-D Secure challenge.
• Expiry date: any future date. Test cards ignore the stored date except when you want to check your own expiry validation logic.
• Security code (CVV or CVC): a fixed value. Processors return a mismatch response if you send anything else, which lets you test your decline handling.
• Billing postal code and street address: values that produce specific AVS (Address Verification System) codes, from full match to no match.
• Cardholder name: free text. Most processors accept anything here, so use it to test receipts and dispute screens.

Test cards vs stolen card data

A test card is published by the processor for its own merchants, and anyone can read the documentation. Stolen card data is not published anywhere, and trafficking in it is a federal crime under 18 U.S.C. 1029. Buyers and sellers of CVV dumps carry the same criminal exposure, and card networks plus issuing banks watch for the traffic patterns those operations create.

payment card test guide

What is card testing fraud?

Card testing is a fraud tactic where an attacker pushes large volumes of stolen card numbers through a merchant's checkout to learn which ones still work. Charges are small, often under a dollar, so the cardholder may not notice before the number is resold. The merchant eats the fees, the chargebacks, and the risk of losing the processing account.

payment card test steps

Signals that card testing is happening

• A spike in authorization attempts from one IP range or device fingerprint.
• A high share of declines mixed with a small number of approvals.
• Many orders for low-cost items, digital goods, or donations.
• Hundreds of card numbers tried against one customer email or account.
• Bursts of attempts at odd hours, such as 3 a.m. local time.

How do you detect and stop card testing?

Velocity rules, bot challenges, and issuer authentication do most of the work. Layer them, because each control alone leaves a gap that an attacker can walk through.

1. Turn on CVV and AVS checks, and decline on mismatch for higher-risk orders.
2. Add rate limits to your payment endpoint and your login page.
3. Block known bad IPs and device IDs at the edge with a WAF.
4. Review authorization-to-sale ratios each day.
5. Route suspicious orders to manual review instead of auto-approving them.
6. Set decline thresholds with your processor so a failure burst locks the account.

How do you use payment card test details in a sandbox?

Build a checklist of outcomes, then run each one with the matching test card. Your processor's documentation lists which number produces which result. Never paste a real customer card into a test environment, since that breaks your PCI DSS obligations and the number can end up in plain-text logs.

Scenarios worth testing

• Approved payment with full AVS and CVV match.
• Declined payment for insufficient funds.
• Expired card.
• CVV mismatch and AVS street mismatch.
• 3-D Secure challenge, both passed and failed.
• Duplicate charge, partial refund, and full refund.

What are the compliance rules?

PCI DSS forbids storing the CVV or CVC after authorization, in any environment, including test systems. Test data must stay separate from production data and sit behind its own access controls. Merchants who handle real card numbers also need a written security policy and a self-assessment questionnaire that matches their transaction volume.

Frequently asked questions

Are test card numbers real?

No. They pass format checks but are tied to no account and cannot be charged.

Can I run a live test with my own card?

Some processors allow it. You pay real fees and the charge is real, so ask your processor before you try.

Why do card testers use small amounts?

Small amounts raise the approval rate and lower the chance the cardholder spots the charge before the number is sold.

What happens to a merchant who ignores card testing?

The processor adds fees, issues fines, or closes the account. Card networks track fraud-to-sales ratios per merchant and act on the numbers.

Are CVV shops legal?

No. Selling or buying stolen card data violates US federal law and the laws of most other countries, whatever the storefront claims.