Stripe test cards accept any three-digit CVV, or any four digits for American Express, plus any future expiry date. The card number controls the CVC check result, not the code you type: 4242 4242 4242 4242 passes with any value, while 4000 0000 0000 0127 declines with "incorrect CVC" no matter what you enter.
stripe test card cvv procedure
What CVV do I use with a Stripe test card?
Type any three digits. Stripe test mode skips live issuer checks, so the value in the CVC field does not change the outcome of a test charge.
- Visa, Mastercard, Discover: 123, 456, or any three digits
- American Express: 1234 or any four digits
- Expiry date: any future date, such as 12/34
- Postal code: any valid-format ZIP, such as 10001
The rule holds because test mode runs on simulated card networks. No real issuer sees the request, so no real CVV verification happens.
Which Stripe test cards pass a charge?
These numbers approve in test mode and return a successful charge object through the API.
stripe test card cvv procedure
- 4242 4242 4242 4242 (Visa)
- 4000 0566 5566 5556 (Visa debit)
- 5555 5555 5555 4444 (Mastercard)
- 5200 8282 8282 8210 (Mastercard debit)
- 3782 822463 10005 (American Express)
- 6011 1111 1111 1117 (Discover)
Run each one once against your checkout form. That catches formatting bugs in the card number field, the expiry field, and the CVC field before you ship code.
Which Stripe test cards fail CVC checks?
Stripe ships test numbers that mimic a CVC mismatch so you can exercise your decline path.
- 4000 0000 0000 0127: declined with an "incorrect CVC" message
- 4000 0000 0000 0101: CVC check returns a fail result
- 4000 0000 0000 0002: generic decline, useful for testing fallback messages
- 4000 0000 0000 9995: insufficient funds
- 4000 0000 0000 0069: expired card
Stripe documents the full list in its test card reference, and it adds numbers over time. Check that page before you build test cases into a CI pipeline.
How does Stripe report a CVC check?
Every charge and PaymentIntent carries a cvc_check field on the card details object. It returns one of four values: pass, fail, unchecked, or unavailable.
In live mode the issuing bank decides that value. In test mode Stripe hard-codes it from the card number you used, which is why the CVV field itself is ignored.
Radar rules can act on cvc_check. A common setup blocks a charge when cvc_check equals fail and the order value sits above a set threshold.
How do I run a CVV test in Stripe?
- Open the Stripe Dashboard and turn on test mode with the toggle in the top bar.
- Copy the test publishable and secret keys, which start with pk_test_ and sk_test_.
- Submit a payment with a test card number from the lists above.
- Read the cvc_check value in the API response or the Dashboard payment detail view.
- Repeat with a CVC-fail card to confirm your UI shows the right error message.
Test keys never touch the card networks. A charge created with sk_test_ moves no money, so you can run the flow as often as you need.
What about 3D Secure tests?
Some flows need an authentication step before the CVC check matters. Stripe provides test cards that trigger a 3D Secure challenge, such as 4000 0025 0000 3155.
Use one of those when you test a subscription signup or a high-value order. The challenge appears in a Stripe-hosted test page, where you choose to authenticate or to fail.
Common mistakes when testing CVV
- Swapping the CVV digits and expecting a different result. The card number decides.
- Using live keys with test cards, which produces a real decline instead of a simulated one.
- Assuming a pass in test mode means live traffic will pass. Live CVC checks depend on the bank.
- Storing the CVV after authorization. PCI DSS bans that, in test mode or live mode.
- Skipping the Amex tests, which use four-digit codes and a different field layout.
Can I test CVV values from real cards?
No. Stripe test mode runs on simulated rails and is meant for published test numbers. Card verification codes from real accounts belong in live mode, and they cannot be stored after the authorization completes.
Using card numbers and CVVs that belong to other people is card fraud, regardless of the gateway you route them through. Stripe test cards exist so developers can build checkout flows without touching anyone's real card data.