A CVV test sample is a fake card verification value used in a payment sandbox to test how a checkout handles card data. Common samples are 123, 999, and 000 for three-digit checks, and 1234 for American Express. These numbers pair with published test card numbers, not with real bank accounts.
What counts as a CVV test sample?
A CVV (also called CVV2, CVC, or CID) is the short code printed on a payment card. Visa, Mastercard, and Discover print three digits on the back. American Express prints four digits on the front.
A test sample copies the format of that code so a developer can push a payment through a staging environment. It carries no account behind it, so nothing is charged.
Which CVV values do gateways accept in test mode?
- Visa: 123, 999, or any three digits
- Mastercard: 123, 999, or any three digits
- Discover: 123 or any three digits
- American Express: 1234 or any four digits
The bulk of sandboxes skip an issuer check, because the point is to test your code, not the card network. Any value that matches the length rule passes.
Some cards exist to force a failure. Gateway docs list numbers that return a CVV mismatch, which lets you test your decline message and your error logging.
Test card numbers that go with a CVV sample
Test card numbers come from gateway documentation. They pass the Luhn check, so form validation treats them as real.
- 4242 4242 4242 4242 (Visa)
- 5555 5555 5555 4444 (Mastercard)
- 3782 822463 10005 (American Express, uses a four-digit code)
- 6011 1111 1111 1117 (Discover)
Sandboxes accept any future expiry date and any CVV for these cards. That rule comes from the gateway, not from the card network.
CVV format rules your form should check
- Visa, Mastercard, Discover: three digits, back of card
- American Express: four digits, front of card
- Digits only, no spaces, letters, or punctuation
Validate digit count and character type on the client, then read the gateway response. A rule that caps input at three digits blocks valid Amex customers.
How a sandbox handles a CVV check
A sandbox does not contact an issuer. It runs your request against a set of rules and returns a canned response.
When the response is a CVV mismatch, you get an error code instead of an approval. That code lets you confirm your UI shows the right message and your system logs the event.
How to run a CVV test in five steps
- Open your gateway account and copy the test API keys.
- Find the published test card numbers in the gateway docs.
- Enter a test card number, a future expiry, and a sample CVV such as 123.
- Send the payment and read the response code.
- Repeat with a card built to fail the CVV check, then compare both responses.
Run the same steps for each card network you plan to support. American Express needs a four-digit entry, and a form that hard-codes three digits will reject it.
Where to find official test samples
Each gateway publishes its own list. Stripe, PayPal, Adyen, Square, and Authorize.net all document test cards and the CVV rules that apply in test mode.
Use the list from the provider you integrate. A number from one gateway may return an error on another.
Why teams use test CVV samples
Test data lets you exercise paths that are hard to trigger with real cards. A decline path, a retry, and a 3D Secure challenge all need a response you can reproduce on demand.
Test samples also keep cardholder data out of your staging database. Nothing real enters the environment, so there is nothing to protect or delete.
Test CVV vs. real CVV data
Real CVV data belongs to a cardholder and cannot be sold. Card network rules and PCI DSS bar merchants from storing the CVV after an authorization, so no lawful business holds a stock of them.
Sites that advertise CVV numbers for sale are selling stolen card data. Buying, selling, or using that data is card fraud. In the US, 18 U.S.C. § 1029 covers fraud tied to payment card numbers and carries prison terms.
The only CVV samples you should ever type into a form are the published test values from a gateway's documentation, and only inside a sandbox.
FAQ
Do test CVV numbers work on a live checkout page?
No. A live gateway sends the code to the issuer, and a fake value fails the check. Test values work in sandbox mode only.
What CVV does Stripe accept in test mode?
Stripe accepts any three-digit CVC for non-Amex test cards and any four digits for Amex, unless the card is published as a CVV-failure card.
Is 000 a valid test CVV?
In most sandboxes, yes. The value only needs to match the digit count, and 000 passes that rule.
Can I reuse the same test CVV?
Yes. A test value holds no account, so you can enter it as many times as you need.
Why does my test card get declined?
Either the card number is one that forces a decline, or the sandbox is running with live keys. Check the response code first, then your API keys.
Keep test data inside the sandbox
Label test accounts, use test keys, and never paste test card numbers into a live checkout to see what happens. A few gateways treat repeated failures as a fraud signal.
Sandbox data costs nothing and carries no risk. Real card data carries both.