Test Payment Card: Sandbox Numbers and How to Use Them

What a test payment card is

A test payment card is a card number that a payment processor publishes for use inside its sandbox. The number has the shape of a real card, but it routes to a simulated authorization system. You receive an approval, a decline, or a specific error code, and no funds move. Test numbers work when the account or API key sits in test mode. Outside that mode they fail, and no processor settles them.

Prerequisites

• A sandbox or test account with a payment provider
• Test API keys, not live keys
• A staging checkout page or an API client such as cURL or Postman

How to run a test transaction

1. Sign in to the provider dashboard and confirm the account is switched to test mode.
2. Copy a test card number from the provider documentation for your region.
3. Enter a future expiry date, for example 12/34.
4. Enter a three digit CVC, or the four digit value the docs list for that card brand.
5. Submit the charge through your checkout page or an API call.
6. Read the response object and note the status field and the decline code.
7. Open the dashboard transactions list and confirm the test charge appears with a test label.
8. Switch the account back to live mode when testing ends.

Why providers publish several numbers

Each documented number triggers a distinct outcome. One returns a plain approval. Others force insufficient funds, expired card, incorrect CVC, or a processing error. Developers use these to exercise every branch of checkout logic, including retry flows and error messaging, without waiting for a bank response.

Common mistakes

• Using live API keys with a test card number, which returns an error instead of a simulated result.
• Hardcoding test card numbers in production configuration.
• Assuming a test number works in another provider sandbox. Number sets are not portable.
• Writing sandbox records into a live database.

Legal and compliance limits

Test numbers are inert outside sandbox mode. Real card data behaves differently. The PCI Security Standards Council prohibits storing the CVC or CVV after an authorization, and buying, selling, or trading card data is a federal crime in the United States under wire fraud and access device statutes. Anyone who needs card data for development should use the provider's published sandbox values and nothing else.