Short answer
Sandbox CVV authentication is a test-mode check. A payment gateway compares the CVV field against a fixed value stored for a test card number. No issuer is contacted. The gateway returns a scripted pass, fail, or error response.
How the test check works
A developer sends a card number, expiry, and CVV to a sandbox API endpoint. The endpoint looks up the test card in a local table. If the CVV matches the table value, the check passes. If the CVV does not match, the sandbox returns a CVV mismatch code. Common test values are 123 and 000. Response times run under 200 ms because no network hop to an issuer occurs.
What the sandbox does not do
The sandbox does not verify that a card exists, that it is open, or that funds are available. It does not run Address Verification System checks against bank records. A passing sandbox CVV test proves code path handling. It proves nothing about a real account.
Production differences
In production, the gateway sends the CVV to the card issuer through the card network. The issuer returns a match, no-match, or not-processed code. The gateway must not store the CVV after authorization. PCI DSS Requirement 3.2.2 sets this limit.
Test checklist
- Use the provider's published test card table.
- Test a match, a mismatch, and a missing CVV.
- Log only the response code, never the CVV value.
- Confirm the CVV field is not written to disk or logs.