PayPal Sandbox CVV Process: Test Cards Explained

PayPal Sandbox CVV: Short Answer

The PayPal sandbox accepts any 3 digit CVV on its own test card numbers. American Express test cards take 4 digits. The sandbox does not send the card number or the CVV to a bank. No issuer checks the code. The value you type gets recorded with the test transaction and nothing else happens.

how to paypal sandbox cvv

Which Cards the Sandbox Accepts

PayPal publishes a list of test card numbers in its developer documentation. The list covers Visa, Mastercard, American Express, and Discover. A test card works with any future expiry date and any CVV of the correct length.

paypal sandbox cvv process

• Visa test numbers start with 4.
• Mastercard test numbers start with 5 or 2.
• American Express test numbers start with 34 or 37 and use a 4 digit CVV.
• Discover test numbers start with 6011.

Numbers outside that list return a decline. The sandbox has no route to an issuer, so a live card number cannot be authorized inside it. A real card pasted into a sandbox form fails the same way a mistyped number fails.

PayPal Sandbox CVV Explanation

Simulating a CVV Failure

Developers need to see how a checkout handles a bad CVV. Braintree, which PayPal owns, publishes test card numbers that force specific responses, including CVV verification failure and address verification failure. Use those numbers to build the error path. The CVV typed into the form still does not change the result. The test card number decides the response code.

What the Sandbox Does Not Do

The sandbox is a copy of the PayPal API with no money and no card networks behind it. It cannot validate a real CVV because it never asks an issuer. It cannot confirm that a card is open. Sandbox transactions do not appear on a statement and do not move funds.

PayPal logs sandbox activity against the developer account that made the call. The Developer Agreement limits sandbox use to building and testing your own integration.

CVV Rules Outside the Sandbox

PCI DSS requires merchants to keep the CVV out of storage after authorization. The code can approve a payment and then must be discarded. Storing it, buying it, or selling it is a federal crime in the United States under 18 U.S.C. 1029. The FTC tracks card fraud reports through its Consumer Sentinel network.

Test card numbers are published for free by PayPal and Braintree. Anyone charging money for a sandbox test card or a sandbox CVV is selling something that costs nothing.