A CVV test procedure is a repeatable QA pass you run inside a payment gateway's sandbox. You push test card numbers through your own checkout to confirm three things: the CVV field captures and validates the code, the gateway returns the right decline when the code is wrong, and the code never comes to rest in your logs, database, or analytics. It does not involve a real cardholder's account, and it should never involve a card you do not own.
When you need this procedure
Run it any time the card entry path changes. A new checkout build, a gateway migration, a switch to hosted fields, adding American Express with its four-digit code, bolting on 3-D Secure, or a shift to network tokens all reset the assumptions your last test covered. Auditors also want evidence on a yearly cycle, so treat the procedure as a document you re-run rather than a one-off.
Prerequisites
- A sandbox or test merchant account with the same configuration as production, including whether CVV is set to required.
- Test card numbers pulled from your gateway's own documentation, not from a forum.
- Read access to application logs, the error tracker, and the APM traces.
- A data-flow diagram showing every hop the card data takes.
- A written pass or fail statement for each case before you start, so the result is not a judgment call later.
The procedure, step by step
- Map the path. Write down every system that touches the field: browser, your server, the gateway API, the queue, the warehouse. If the CVV never reaches your server because you use hosted fields or a tokenization script, note that and drop the server-side cases.
- Check field behavior. Confirm the input accepts three digits, accepts four for Amex, masks the value, and blocks paste or autofill if your policy says so. Try letters, five digits, and an empty submit.
- Confirm format validation is client-side only for convenience. Length checks in the browser are UX. The gateway and the issuer do the real validation, so the server must handle a request that skips your form entirely.
- Run the positive case. Submit a sandbox card with the matching CVV and confirm an approval, plus a token or transaction ID you can trace.
- Run the negative cases. Submit a wrong CVV and confirm you get the CVV mismatch decline, not a generic failure. Submit no CVV and confirm the "CVV2 required" behavior matches your configuration.
- Check the failure copy. The customer should see a message that tells them to recheck the code, and it should not reveal whether the card number itself is valid.
- Trace the raw value. Search logs, error payloads, and APM spans for the three digits you typed. You want zero hits. Error trackers and request-body dumps are the usual offenders.
- Inspect storage. Query the transactions table, the card-on-file table, and any search index or cache. The CVV should not exist there in any form, encrypted or not.
- Test the retry and 3-D Secure paths. A decline should not trigger an automatic retry that writes the code somewhere new, and the challenge flow should not echo it back in a callback payload.
Negative tests that earn their keep
The positive case passes on almost any build. The value sits in the declines. Most gateways expose distinct codes for a CVV mismatch and a missing CVV, and your code needs to branch on them. Treat a mismatch as a soft failure the customer can fix and a missing code as a configuration problem on your side. Both should land in the same reconciliation report so finance can see why an order failed.
CVV Test Protocol Guide: How to Buy CVV Online Safely
Where teams get it wrong
- The code lands in a query string on a redirect, which puts it in the browser history and the web server access log.
- A debug build serializes the whole request body into the application log, and the debug flag ships to production.
- The error tracker captures the request payload on a failed charge. That is a storage violation sitting in a third-party dashboard.
- Someone builds a "card on file" table and includes the CVV column for convenience.
- The backoff-and-retry job re-posts the original request, code and all, days after the first attempt.
Evidence to keep
Save the test case IDs, the sandbox transaction references, screenshots of the decline screens, and the log searches with timestamps. Store the results with your PCI evidence pack. The finding auditors look for is that sensitive authentication data is not retained after authorization, so your proof is a negative result: a documented search that returned nothing.
One last rule. Test with sandbox numbers only. Using a card you do not own to "see if it works" is a crime in most jurisdictions, and using your own live card in production tells you nothing about your sandbox configuration.