Test Card System: How Payment Sandboxes Work

Test Card System: Short Answer

A test card system is a sandbox operated by a payment processor. It supplies card numbers that pass the same format and validation rules as live cards, but move no money. The numbers work in test mode with test API keys. Stripe, Adyen, Braintree, PayPal, and Square each publish a set.

related article

What the Sandbox Validates

• Check digit. The final digit of the card number is a Luhn mod-10 checksum defined in ISO/IEC 7812.
• Length and prefix. Visa test numbers start with 4 and run 16 digits. Mastercard test numbers start with 5 or 2. American Express test numbers run 15 digits.
• Expiry. The sandbox reads month and year. A past date returns an expired-card response.
• CVC length. Three digits for Visa, Mastercard, and Discover. Four digits for American Express.
• Authorization response. The processor maps a specific test number to a specific ISO 8583 response code.

Common Test Numbers

Stripe publishes a set that covers the responses a developer has to handle.

related article

• 4242 4242 4242 4242. Visa. Approved.
• 4000 0000 0000 0002. Generic decline.
• 4000 0000 0000 9995. Insufficient funds.
• 4000 0000 0000 0069. Expired card.
• 4000 0000 0000 0127. Incorrect CVC.

Response codes follow ISO 8583. Code 00 means approved. Code 05 means do not honor. Code 51 means insufficient funds. Code 14 means invalid card number. A sandbox returns these codes on demand so a developer can test error paths without a live card.

card testing software

Test Mode Compared With Live Mode

Test mode runs on separate API keys and separate endpoints. A test key cannot create a live charge. A live key cannot process a published test number. The processor dashboard shows a toggle, and the API response includes a livemode flag.

Limits of Test Card Numbers

Test numbers are not issued to any account holder. They carry no balance, no billing address, and no 3-D Secure enrollment. A test number returns the fixed response the processor coded for it. It does not reach a real issuer and cannot produce a real authorization decision.

Card Checking and Legal Exposure

The same term appears in a second context. Card checking services submit card data to merchant authorization endpoints to confirm that a number is live. That activity requires a merchant account and an agreement with the acquirer. Without both, it falls under 18 U.S.C. 1029, which covers trafficking in and unauthorized use of access devices. Penalties reach 15 years. 18 U.S.C. 1028A adds a mandatory 2 year term for aggravated identity theft. Acquirers monitor authorization-to-sale ratios and terminate accounts that show card checking patterns.

Compliance Notes

PCI DSS v4.0 requirement 3.3.1 prohibits storage of sensitive authentication data, including the CVC, after authorization. Published test numbers are not cardholder data because no issuer assigned them. Processors supply them so developers keep live card data out of development and staging systems.