Answer
A card test environment is a payment sandbox. It uses synthetic card numbers, test API keys, and a test merchant account. It does not use live card data. It does not check CVV data for resale or purchase.
CVV resale is illegal in the US. A sandbox cannot make it legal. Use test data from a payment processor. Do not enter real card numbers or real CVV values into test tools.
Parts of a test environment
- Test merchant account. It is separate from the live account.
- Test API keys. They work only in the sandbox.
- Synthetic card numbers. The processor publishes them for developers.
- Test CVV values. They are placeholders. They have no value outside the sandbox.
- Test outcome rules. A set amount or card number triggers a decline, a review, or a pass.
What test data looks like
Test card numbers follow the same length rules as live numbers. They do not link to a bank account. Test CVV values are 3 or 4 digits. They do not link to a real card. The processor documents the numbers and the expected result for each one.
PCI DSS treats CVV as sensitive authentication data. Merchants must not store CVV after authorization. A test CVV is not an exception to that rule. It is a sandbox placeholder, not card data.
Rules for a clean test run
- Use only test keys in the test environment.
- Use only synthetic card numbers from the processor.
- Keep live keys out of test code and test logs.
- Do not store CVV values in logs, databases, or tickets.
- Reset test data after each run.
- Review access logs for card testing patterns.
What a test environment cannot do
A test environment cannot check if a live card is valid. It cannot confirm a CVV for a live card. It cannot turn stolen card data into a legal payment. Card testing attacks use many small transactions to find live cards. A sandbox does not stop those attacks. Fraud controls and rate limits do.