Short answer

A PayPal sandbox test card is a fake card number used inside the PayPal sandbox, a test copy of the PayPal payments system. No card network is contacted. No funds move. The numbers come from the PayPal developer dashboard, not from a bank.

What the sandbox is

The sandbox is a separate environment with its own accounts, balances, and API credentials. Transactions stay inside it. Developers use it to test checkout flows, refunds, subscriptions, and webhook handling before touching a live account.

Where test card numbers come from

Sign in to the PayPal developer dashboard. Create a sandbox business account and a sandbox personal account. Card numbers appear in the sandbox account tools, and PayPal can generate one for a sandbox account. Treat the dashboard as the source of truth. PayPal edits its card list without notice, so a number copied from a blog post may stop working.

Number rules

A sandbox card number must pass the Luhn check. The last digit is a check digit computed from the digits before it. A made-up number with a wrong check digit is rejected before any payment logic runs. PayPal publishes test numbers for Visa, Mastercard, American Express, and Discover.

Generic industry test numbers also pass Luhn: 4111111111111111 for Visa, 5555555555554444 for Mastercard, 378282246310005 for American Express. The PayPal sandbox takes some of these and rejects others. Results depend on merchant country, account type, and the card types enabled on the sandbox account.

Values for a test payment

  • Expiry date: any future date. A past date fails.
  • CVV: 3 digits for Visa and Mastercard, 4 for American Express. The sandbox does not check the value.
  • Billing address: the address on the sandbox account, or a test address.
  • Cardholder name: any string.

Common failures

  • Luhn check failure. Recheck the digits.
  • Expiry date in the past.
  • Wrong sandbox account type. A personal account cannot run a merchant payment.
  • Card type disabled on the sandbox account.
  • Live API credentials sent to the sandbox host.

What test cards cannot do

Sandbox cards do not exercise 3-D Secure against a real issuer. They do not reproduce issuer decline codes. They do not prove a live card will pass. For decline cases, PayPal supplies negative test triggers and decline simulation in the dashboard. Exact behavior per country is not documented in full.