A CVV test payment uses sandbox test card numbers issued by your payment processor to confirm that checkout rejects a wrong or missing security code. No real card data enters the test flow. Buying CVVs from a seller and running them through a live gateway is carding, and it is illegal in the US.
What a CVV test payment actually checks
A CVV test covers one branch of your payment logic: does the gateway decline when the three-digit code is wrong, absent, or unsupported? The processor returns a specific decline code for that case, which lets you route the failure to the right message on screen.
This is separate from address verification (AVS). A payment can pass the ZIP check and still fail the CVV check, so test both paths on their own.
- CVV matches: the issuer authorizes and returns a success code.
- CVV mismatch: the issuer declines with a code such as N7 or the processor error
incorrect_cvc. - CVV not provided: the result depends on whether you marked the field as required in your payment form.
Why you cannot buy CVVs to test your gateway
Card numbers and security codes sold online come from breaches, skimming devices, and phishing kits. Using them in any transaction, test or live, breaks card network rules and state and federal law. A merchant account caught doing it gets terminated, and processors report the activity to acquirers.
PCI DSS Requirement 3.2 also forbids storing the CVV after authorization, which means a "test" that collects real security codes has no compliant path. Sandbox keys exist to remove the need for real numbers entirely.
If a site offers to sell you CVVs for testing, that is the fraud pitch, not a service. Walk away.
How to run a CVV test payment
- Switch to test keys. Use your processor's publishable and secret test keys, not the live ones. Test keys only talk to the sandbox.
- Pull the published test cards. Every major processor documents test numbers that trigger specific responses, including a wrong-CVV response.
- Submit a wrong code first. Enter a code that does not match the test card profile and record the exact response your server receives.
- Submit the matching code. Confirm the same card authorizes when the CVV is correct.
- Test a blank field. Submit with the CVV field empty to see whether your form blocks it or the gateway does.
- Log the response codes. Store the decline code, not the card data, and map each code to a customer-facing message.
What the decline codes mean
Issuers and processors use different labels, but the shapes are consistent. A CVV failure is a soft decline in most setups, which means the customer can retry with the right card in hand.
- N7: CVV2 mismatch, the code typed does not match what the issuer has.
- M: CVV2 and address both fail.
- U: the issuer cannot check the code, often a card type that has no CVV.
- Processor-level code: a string such as
incorrect_cvcorcvc_check_failedreturned by the API.
Test each of these in the sandbox so your checkout shows a clear message instead of a generic "payment failed" screen.
Does Stripe publish test cards for CVV failures?
Yes. Stripe's documentation lists separate test card numbers for incorrect CVC, expired cards, generic declines, and processing errors. You use a standard test card and trigger the CVV failure with a documented number, then read the returned error object.
Adyen, Braintree, and Authorize.net follow the same model. The card numbers come from the processor's docs, never from a third-party seller.
Can a test CVV work on a live gateway?
No. Test card numbers fail against live keys because the issuer never issued them. Any guide that claims a purchased CVV can "verify" a live account is describing fraud, and the account gets flagged fast.
Live CVV checks happen only when a real customer types their own card details into your form. Your job is to pass those details to the processor and store nothing.
What should I check before going live?
Run the full sandbox set: matching CVV, wrong CVV, blank CVV, expired card, and a declined card. Confirm your logs hold no CVV, your error messages are clear, and retries do not create duplicate charges.
Then do one live transaction with your own card and refund it. That single test proves the live keys, the CVV field, and the webhook all work together.
FAQ
Does a failed CVV check decline the whole payment?
It can. Many issuers decline the authorization, while others approve and flag the mismatch for the merchant. Your integration must handle both outcomes.
Can I store the CVV to compare later?
No. PCI DSS bars storage of the card verification code after authorization, even in encrypted form. Store the authorization result instead.
Is a CVV test payment legal?
Testing with sandbox cards from your processor is legal and expected. Testing with card numbers bought from a seller is not, at any stage.
Why does my test card return incorrect_cvc every time?
You are likely using the test number reserved for CVV failures. Check the processor table and swap to the standard success number.