Answer
A sandbox test card is a card number a payment processor publishes for use in test mode. The number passes the Luhn check. It routes to a simulated response instead of a bank. No account sits behind it. No charge can post.
Test cards are free. They come from processor documentation, not from cardholders.
What a test card does
- Returns an approved or declined result you pick.
- Triggers error codes such as expired card or insufficient funds.
- Tests 3D Secure, refunds, and partial captures.
Common test numbers
Stripe lists 4242 4242 4242 4242 as a Visa that approves. It lists 4000 0000 0000 0002 as a card that declines. Adyen and PayPal publish their own sets. Each processor accepts only its own numbers. A Stripe test number returns an error in the Adyen test environment.
Use any future expiry date, any three digit CVC, and any postal code unless the docs say otherwise.
Test mode and live mode
Test API keys carry a different prefix than live keys. A charge sent with a live key and a test card fails. A charge sent with a test key and a real card number also fails. Keep the two sets apart.
Rules for test data
- Never enter a real card number into a test form you do not control.
- Do not store real card data on a test server. PCI DSS applies to any system that touches it.
- Delete test accounts before launch.
Real card numbers
Real card numbers belong to a person or a bank. Buying, selling, or trading them is illegal in the US under 18 U.S.C. 1029. A sandbox test card has no cash value and no owner.