Core buying advice
Buy card test cases only from vendors that provide synthetic test numbers and scenarios, never live card data. Prioritize coverage of decline codes, edge cases, and regional rules. Verify that the provider updates test cases as card networks change rules and that their data handling meets PCI DSS requirements for test environments.
What to look for
- Scenario breadth: test cases for approvals, declines, errors, refunds, chargebacks, and 3D Secure flows.
- Card brand coverage: Visa, Mastercard, American Express, Discover, and regional networks.
- Update cadence: monthly or quarterly updates aligned with network rule changes.
- Format: structured data (CSV, JSON) or API access with clear documentation.
- Compliance: vendor attestation that test data is synthetic and not derived from real accounts.
Parameter bands
For small teams, 50 to 200 test cases may suffice for core checkout flows. Mid-size operations often need 300 to 800 cases to cover multiple card types and currencies. Enterprise payment platforms should look for 1,000 or more cases with customizable scenario tagging. Update frequency: at least quarterly; monthly for high-risk or multi-region businesses.
Pitfalls
- Using live card numbers in test environments, which expands PCI scope and risks data exposure.
- Test suites that lack decline and error scenarios, leading to missed failure paths.
- Vendors that do not document test case provenance or update history.
- Overpaying for large suites when a smaller, well-curated set covers your flows.
FAQ
Are card test cases the same as test card numbers?
Test cases include card numbers plus expected outcomes, request payloads, and assertions. Test card numbers are just one input.
Can I generate my own test cases?
Yes, for basic validation. But curated suites save time and cover network-specific rules you might miss.
How often should test cases be reviewed?
Review quarterly and after any payment gateway or card network rule change.