A CVV test sample is a fake card verification value paired with a test card number inside a payment processor's sandbox. It works only in test mode and is published by the processor itself. It has no value on a live payment page and cannot move real money.
What does a CVV test sample actually do?
Test card numbers mimic real card numbers so developers can run charges without touching a real account. Each test number ships with a matching expiry date and a fixed or flexible CVC value. The sandbox checks the format, returns a scripted result, and never contacts a bank.
Processors publish two kinds of test values. One set produces an approval. Another set triggers a specific decline, such as a failed CVC check. That second set is how teams confirm their error handling works before launch.
- Most Visa, Mastercard, and Discover test cards accept any three digit CVC unless the card is flagged to fail a CVC check.
- American Express test cards expect four digits.
- Decline cards return codes such as incorrect_cvc, expired_card, or insufficient_funds.
Where do test card numbers and CVVs come from?
Every major processor publishes its own list in open documentation. Stripe, Adyen, Braintree, and Authorize.net all keep a test card page anyone can read. The numbers look real, but they route to a sandbox instead of a card network.
Because each provider writes its own rules, a test card from one gateway will fail at another. Copy the list from the docs of the processor you integrate with, and check the page again after a major API version change.
Why does a test CVV get rejected?
The common cause is a mismatch between test mode and live mode. Keys, card numbers, and CVC values from the sandbox do not cross over. A second cause is a card number that carries a built-in decline rule, which returns an error even when every field is correct.
Do test values ever expire?
Most published test cards use a far future expiry year, so they keep working across releases. Providers do retire test numbers when they change a card brand's rules. If a number that worked last quarter fails today, check the docs before you debug your own code.
Can you use a test CVV on a real checkout?
No. Live payment networks reject test card numbers, and a real card needs the value printed on that card. Any site that claims to sell a valid CVV for a real account is selling stolen data or nothing at all.
Real CVVs are printed on the card or generated by the issuer for a single transaction. They are never published as samples, bulk lists, or downloads. A screenshot of a CVV in a sales pitch tells you nothing about whether the number is real.
Is it legal to buy CVVs?
No. Buying, selling, or trading verification values tied to real card accounts is card fraud in the US and most other countries. The FTC treats trafficking in stolen card data as a federal crime, and card networks watch for the patterns that go with it.
PCI rules add a second layer. Merchants may not store the CVV after an authorization, even on their own systems. A vendor who offers to "test" or "check" real CVVs is asking you to break that rule and to handle stolen property.
Legitimate work with CVV data happens in three places only: the cardholder's own checkout, the issuer's verification step, and a processor's sandbox with fake numbers.
How do you test CVV validation the right way?
Point your integration at the sandbox, use the processor's published test cards, and confirm that each response lands in the right code path. Then confirm the CVC is discarded and never written to a database, a log line, or an analytics event.
- Pull the test card list from your gateway's documentation.
- Run one approval case and at least one CVC decline case.
- Log the response code and the last four digits, never the CVC.
- Switch to live keys and confirm the test numbers stop working.
- Review your error messages so a decline does not reveal why the check failed.
Test the four digit Amex path separately. Teams that hardcode a three digit field pass every Visa test and fail the first Amex order.
What do "CVV sample" listings online really sell?
Most are bait. Some sellers post free sample numbers to build trust before a paid order. Others sell lists of card data that came from breaches, which is stolen property with no lawful use.
Buyers of those lists face chargeback losses, frozen accounts, and prosecution. The lists also go stale fast, because issuers cancel compromised cards as soon as the fraud shows up.
If you run a store and someone offers to "validate" your customers' cards for you, treat it as a red flag. That offer describes card testing, and card testing leads to chargeback fees and a closed merchant account.
Frequently asked questions
What is a CVV test sample?
It is a fake verification value published by a payment processor for sandbox testing. It matches a fake card number and returns a scripted result in test mode only.
Does a test CVV work with a real card number?
No. Live networks check the value against the issuer's records, and a test value will fail. Mixing a test CVC with a real card number produces a decline every time.
How many digits is a test CVV?
Three digits for Visa, Mastercard, and Discover. Four digits for American Express. Sandbox rules follow the same format as live cards.
Can I store a CVV for testing?
Store nothing but the processor's fake values. Never store a real CVV, even for a few seconds outside the authorization request. PCI DSS forbids retention after authorization.
Where do I find test card numbers?
In your processor's own developer documentation. Stripe, Adyen, Braintree, and Authorize.net each publish a public test card page with numbers, expiry dates, and CVC rules.