Choose the test card by the response you need, not by the number

The core buying decision with Razorpay test cards is simple: pick the card that reproduces the exact response your integration must handle, then add a second card for the normal success path. A test card is a tool for exercising a code branch. If your checkout has never seen an insufficient funds decline, an expired card, or a failed 3D Secure challenge, you have not tested it. Build a small set that covers success, a soft decline, a hard decline, and an authentication failure, and confirm each number against Razorpay's current sandbox documentation before you commit it to a test suite. Test numbers change, documentation ages, and a stale number silently routes your test down a path you did not intend.

What to look for in a Razorpay test card

  • Documented behavior. The card should have a stated outcome in the provider's own reference. A number you found on a forum has no guaranteed behavior.
  • Scheme coverage. Visa, Mastercard, American Express, RuPay and Diners each format card numbers differently. A 15 digit American Express number exercises validation rules that a 16 digit Visa number never touches.
  • Authentication variants. You want at least one card that forces a 3D Secure challenge and one that skips it, so both flows run in your pipeline.
  • Decline variants. Decline types are not interchangeable. A bank side failure, an incorrect CVV, and an expired card each arrive as different error objects in the response.
  • Currency and market fit. If you accept INR and USD, test both. Cross border test payments can behave differently from domestic ones.
  • Stability. Prefer numbers that have survived several documentation revisions over a number posted last week.

Parameter bands to expect

Test cards follow the same structural rules as live cards, so your validation code should be exercised the same way.

  • Card number length. 16 digits for Visa, Mastercard, RuPay and Discover; 15 digits for American Express; 14 digits for Diners Club.
  • Prefix ranges. Visa numbers begin with 4, Mastercard with 51 to 55 or 2221 to 2720, American Express with 34 or 37, RuPay with 60, 65, 81, 82 or 508. Test numbers sit inside these ranges so your BIN detection logic runs.
  • Expiry. Any future date in MM/YY format works in most sandboxes. Past dates are the standard way to trigger an expiry decline.
  • CVV. Three digits for Visa, Mastercard and RuPay, four digits for American Express. Many sandboxes accept any value, which means a wrong CVV test may need a dedicated decline number.
  • OTP and authentication. Sandbox 3D Secure flows usually accept one fixed OTP. Confirm the current value in the provider's reference rather than assuming.

Pitfalls that break test runs

  • Using test numbers in live mode. Test PANs are rejected in production, and a live key with a test card can produce confusing gateway errors.
  • Using live card data in sandbox. Never enter a real cardholder number into a test environment. PCI DSS requires that production card data stays out of non production systems.
  • Assuming one card covers every decline. Declines are mapped per number. Testing one failure does not validate the others.
  • Hardcoding numbers deep in the app. Keep the set in a config file so a documentation update means one edit, not a search and replace.
  • Ignoring amount thresholds. Some sandboxes tie behavior to the amount, so a decline card at a low value may succeed.
  • Forgetting the webhook side. A card that succeeds in the browser can still fail the capture or webhook step. Test the full lifecycle, not just the redirect.

FAQ

Are Razorpay test cards real cards?

No. They are reserved numbers that only work inside the sandbox. No real account is debited and no real issuer is contacted.

Will a test card work after I switch to live keys?

No. Live mode rejects test PANs by design. You need real payment instruments, or a live mode pilot with a small amount, to validate production behavior.

Does the CVV matter for a test card?

Usually not. Most sandboxes accept any three or four digit value, so a CVV failure has to come from a card documented to return that error.

Why did my test payment decline when it should have succeeded?

Check three things in order: the key mode, the expiry date, and whether the number is still listed in the current documentation. Expired test numbers are the most common cause.

Can I reuse the same test card across gateways?

Sometimes. Several gateways use the same widely published numbers, but decline behavior and authentication flows are provider specific, so verify each number in the sandbox you are testing against.