Short answer

A credit card validator test checks format rules: digit count, issuer prefix, Luhn checksum, expiry date, and CVV length. It does not confirm that an account is open, funded, or approved. A number that passes every rule can still belong to a closed account.

The Luhn step

Luhn (mod 10) doubles every second digit from the right, subtracts 9 from any product above 9, adds the digits, and tests the total against a multiple of 10. One wrong digit or one swapped pair fails the check. Luhn catches typing errors, not fraud. Random digits pass it about one time in ten.

Rules a validator can enforce

  • Length: 12 to 19 digits. American Express uses 15. Visa uses 13, 16, and 19.
  • Issuer prefix: the first 6 to 8 digits fall in a range assigned under ISO/IEC 7812.
  • Checksum: the Luhn sum equals a multiple of 10.
  • Expiry: month between 1 and 12, year inside a set window, date not in the past.
  • Security code: 3 digits for most brands, 4 digits for American Express.

Rules no local validator can enforce

Account status, available balance, address match, and 3-D Secure enrollment live at the issuer. An authorization request returns them. Format checks run before the network call, so a pass means the number is well formed, not that it is live.

Test cases for a validator

  1. One valid number for each supported length and prefix.
  2. A number with one digit changed. The Luhn check must fail.
  3. Two adjacent digits swapped. The check must fail.
  4. Letters, spaces, hyphens, and non-ASCII digits in the input field.
  5. Expired month, month 00, month 13, and a date 20 years out.
  6. A 3-digit code on an Amex prefix, a 4-digit code on a Visa prefix.
  7. Empty field and a 25-digit string.

Sandbox numbers

Stripe, Adyen, and Braintree publish test card numbers with fixed outcomes: approval, decline, insufficient funds, and a 3-D Secure challenge. Use those in place of invented numbers, because the sandbox maps each test number to a scripted response.

Authorization tests

Run auth-only requests, then void. Test soft declines (retry allowed), hard declines (stop), and the 3-D Secure challenge flow. Log the response code and the decline reason, not the card number.

Data handling

PCI DSS requirement 3.2 bars storage of the CVV after authorization, encrypted or not. Test data belongs in the sandbox. Production card numbers stay out of logs, error messages, and analytics.