Test Credit Card Numbers: Sandbox Cards Explained

Answer

A test credit card number is a card number that a payment processor publishes for use in its sandbox. The number passes the Luhn check. The processor's test system accepts or declines it by a fixed rule. No bank account sits behind the number. No funds move. Test numbers work when the site runs in test mode with test API keys.

Who publishes test numbers

Stripe, PayPal, Braintree, Adyen and Authorize.Net each publish a set. The digits differ between processors. A Stripe test number returns a result in Stripe. The same digits read at a live terminal do nothing, because no issuer owns that account range.

Common test numbers

• Visa: 4242 4242 4242 4242
• Visa debit: 4000 0566 5566 5556
• Mastercard: 5555 5555 5555 4444
• American Express: 3782 822463 10005
• Discover: 6011 1111 1111 1117
• JCB: 3566 0020 2036 0505
• Diners Club: 3056 9300 0902 0004

Each of these is a sandbox card. The sandbox accepts any future expiry date, any three digit CVC, and any billing ZIP code. American Express uses a four digit CID.

Decline testing

Processors publish numbers that force an error. Stripe documents these:

• 4000 0000 0000 0002: generic decline
• 4000 0000 0000 9995: insufficient funds
• 4000 0000 0000 0069: expired card
• 4000 0000 0000 0127: incorrect CVC
• 4000 0000 0000 0119: processing error

Each number maps to a fixed error code. A developer uses them to exercise the error path in checkout code.

The Luhn check

Card numbers carry a check digit. The Luhn formula, defined in ISO/IEC 7812-1, weights each digit, sums the results, and requires a total that divides by 10. Test numbers satisfy the formula. So do most 16 digit strings from a random generator. A passing Luhn check shows the digits are well formed. It shows nothing about the account status.

What test numbers cannot do

A test number cannot charge a card, hold funds, or open an account at an issuer. The CVV on a test card is a placeholder. Live card verification values are secret and no processor publishes them. PCI DSS bars merchants from storing the CVV after an authorization. A test number has value inside a sandbox and no value outside it.