Checkout.com test CVV values are placeholder three-digit codes that only work with sandbox API keys. The standard passing pair is card number 4242 4242 4242 4242, CVV 100, and any future expiry date. A test CVV never authorizes a real card, never moves funds, and stops working the moment you switch to live keys.

What CVV do I use with Checkout.com test cards?

Use 100 for a passing CVV check on the standard test cards. Non-matching values, typically 101 and similar, simulate a CVV mismatch so you can exercise your decline path. Confirm the numbers against the current test card table in Checkout.com's docs, because gateways revise these values.

  • CVV 100: CVV check passes.
  • CVV 101 or another value: check fails and the response flags a mismatch.
  • Expiry: any future date, such as 12/2030.
  • Cardholder name and billing address: any plausible test data.

Does the CVV matter in sandbox mode?

It matters only when CVV validation is enabled on your test channel and the value is sent with the request. Many integrations tokenize the card first, and the token path can skip CVV collection entirely. If mismatches never trigger, check whether your payload includes the cvv field and whether your account settings enforce the check.

How do I trigger declines and 3DS challenges?

Declines come from specific test card numbers, not from random CVVs. Checkout.com publishes cards mapped to response codes, so a declined card returns the exact code you need to test that branch of your logic. 3DS test cards run the challenge flow in sandbox, where you approve or fail the prompt yourself.

Why is my test CVV being rejected?

  1. You are using live keys instead of sandbox keys.
  2. The card number is not on the test list and fails a Luhn or scheme check first.
  3. Your request omits the CVV or sends it in the wrong field.
  4. The card was already tokenized, so CVV checks no longer apply.

Can I test CVV validation with a real card?

No. Sandbox values exist so no real card data enters your test environment. Real card numbers in a test system breach PCI DSS rules, and card networks prohibit storing the CVV after authorization.

Best practices for test CVV workflows

  • Keep sandbox and live keys in separate configuration files.
  • Log the full gateway response code, not just a pass or fail flag.
  • Cover both the CVV match and mismatch paths in automated tests.
  • Re-read the test card table after each API version upgrade.