Sandbox CVV Test Process | Payment Sandbox Guide

Direct answer

A sandbox CVV test process sends a card verification value to a payment processor's test environment. The sandbox does not route the value to an issuing bank. It matches the test card number against a table and returns a scripted response. In most cases any 3-digit value in the CVV field passes. Test card numbers coded for a CVV failure return that failure. No live account is checked. The process tests integration code and decline handling, not card data.

sandbox cvv check

How the sandbox reads a CVV

Sandbox mode swaps the card network for a lookup table. The processor maps each published test account number to a fixed outcome: approval, generic decline, CVV mismatch, AVS mismatch, or a 3DS challenge. The CVV field is stored only if the test number requires a specific value.

related article

Stripe documents 4242 4242 4242 4242 as a Visa test number that returns a successful charge. Stripe documents 4000 0000 0000 0002 as a generic decline. Numbers in the 4000 0000 0000 01xx range return scripted CVV and postal code failures. Adyen, Braintree, and Checkout.com publish similar tables.

sandbox cvv testing

Field rules in sandbox

• Card number: test PANs only, published by the processor.
• Expiry: any future date.
• CVV: any 3 digits for a Visa or Mastercard test PAN, 4 digits for Amex, unless the test number is coded for a CVV failure.
• Amount: any value, in minor units.
• Authentication: 3DS is simulated with fixed challenge outcomes.

Sandbox compared with production

Production sends the CVV to the issuer through the network. The processor returns a verification code, such as M for match, N for no match, U for unavailable, or P for not processed. Sandbox returns the same code fields so the response parser behaves the same way, but the value comes from a lookup table.

What sandbox testing cannot show

• Issuer CVV rules, which vary by bank and region.
• Real fraud or risk scoring.
• Network timeouts and partial authorizations under live load.
• Any fact about a live card. A sandbox result says nothing about a real account.

Compliance rules for test environments

PCI DSS requires that test and development environments not store or process live cardholder data. Use published test PANs. Purge sandbox transactions with the same retention schedule as production. Logs that capture the CVV field must stay masked.