Sandbox Test CVV: What It Is and How It Works

What a sandbox test CVV is

A sandbox test CVV is a 3 or 4 digit code assigned to a test card number. It is not a real CVV. Real CVVs come from card issuers and sit on the back of a physical card or in a digital wallet. Sandbox CVVs exist only inside payment gateway test environments.

read more

Payment gateways use sandbox CVVs to simulate card verification value checks. The code triggers a pass, fail, or unchecked response. The gateway returns that response to the merchant's test system.

Sandbox CVV Test Infrastructure: What Legitimate Testing Looks Like

Where sandbox test CVVs appear

Stripe, PayPal, Authorize.Net, and CyberSource publish test card numbers. Each gateway pairs those numbers with test CVV values. The values differ by gateway and by test case.

more on this topic

• Stripe test cards accept any 3 digit CVC for most charges. Some cards return a CVC failure.
• PayPal sandbox test cards use a fixed CVV, often 123.
• Authorize.Net sandbox test cards use CVV 123 or 999, depending on the test.
• CyberSource test cards list CVV values in its developer documentation.

Common test CVV values

Test CVV values are not standardized. A gateway may use 123 for a pass and 999 for a fail. Some gateways use 000 or 111. The test card number and the test CVV work as a pair. Changing one value changes the simulated result.

How to use a sandbox test CVV

1. Open a sandbox account with a payment gateway.
2. Find the gateway's test card list.
3. Copy a test card number, expiration date, and test CVV.
4. Send a test transaction through the gateway's sandbox API.
5. Check the response code for CVC match, mismatch, or not processed.

Sandbox test CVVs do not work on live payment networks. They cannot buy goods or services. They cannot verify a real card. Any site that sells CVVs or claims to sell real CVVs is a fraud risk. Real card data sales violate card network rules and US law.

Limits and risks

A sandbox test CVV has no value outside the test environment. It cannot be used for fraud. It cannot be used to bypass a real payment gateway. Test data is public. Gateways publish it for developers.

If a service offers to sell CVV data, that data is either fake or stolen. Both outcomes carry legal and financial risk. US law treats stolen card data as illegal. The FTC and card networks track such operations.