What a credit card authentication test verifies

A credit card authentication test checks whether your payment flow handles card verification value (CVV), address verification service (AVS), and 3-D Secure challenges the way your processor expects. Run the test in a sandbox with test card numbers. Never use live card data.

How to Conduct a Credit Card Test Run: A Comprehensive Guide

Prerequisites

  • Sandbox merchant account and API keys from your payment processor.
  • Test card numbers published by that processor.
  • Access to your checkout logs and webhook events.

Step-by-step test procedure

  1. Open your processor's test card documentation.
  2. Copy one test card that returns a CVV match.
  3. Copy one test card that returns a CVV mismatch.
  4. Copy one test card that triggers a 3-D Secure challenge.
  5. Switch your checkout to sandbox mode.
  6. Confirm the API endpoint points to the test environment.
  7. Submit the CVV match card with a matching AVS address.
  8. Confirm the authorization response returns an approval.
  9. Submit the CVV mismatch card.
  10. Confirm your checkout shows a generic decline.
  11. Submit the 3-D Secure test card.
  12. Complete the challenge page.
  13. Confirm your webhook receives the authentication result.
  14. Force a timeout on the challenge step.
  15. Confirm the order does not finalize without completed authentication.
  16. Review logs for raw CVV values.
  17. Remove any stored CVV or full card numbers that violate PCI DSS.

What to check after each run

Confirm the response code matches the expected outcome. Verify that the order status changes only after authentication. Check that your decline page does not reveal whether the CVV or the address failed. Confirm the processor's test results map to your production logic.

credit card security test

Common mistakes

  • Using live card numbers in a test order.
  • Testing only the success path.
  • Logging CVV values.