A sandbox test CVV is a fake 3 or 4 digit security code that works only with a payment gateway's test card numbers in test mode. It lets you validate a checkout form, a payment integration, and your CVC rules without moving real money. Any value such as 123, 999, or 000 is judged by the gateway's simulator, not by an issuing bank.
Where do sandbox test CVVs come from?
Every major processor publishes a fixed set of test card numbers, and each number carries its own CVV behavior. Stripe's 4242 4242 4242 4242 approves in test mode with any CVC, while 4000 0000 0000 0127 returns an incorrect_cvc decline. Braintree, Authorize.Net, PayPal, and Adyen publish comparable sandbox values in their developer documentation.
- 4242 4242 4242 4242: approval, any expiry date, any CVC
- 4000 0000 0000 0127: decline with an incorrect CVC reason code
- 5555 5555 5555 4444: Mastercard test range, same any-CVC rule
- 3782 822463 10005: American Express test number, 4 digit CID
Because these are published test values, they are free and carry no risk to any cardholder. A sandbox CVV is not linked to an account, a balance, or a person.
Why does a sandbox CVV fail outside test mode?
Test mode routes the transaction to a simulator, so the CVC value is never checked against an issuer's records. Live mode routes to the card network, where the number and the CVC must match a real account. A test card has no account, so the network returns a decline every time.
How do you test CVC validation with sandbox values?
Send the test CVC through your own form and confirm three behaviors. First, the field enforces 3 digits for Visa, Mastercard, and Discover, and 4 digits for American Express. Second, the value is never written to your database or application logs after authorization. Third, the decline reason from the gateway maps to the right customer message.
PCI DSS Requirement 3.2 forbids storing sensitive authentication data, including the CVV, once an authorization is complete. A sandbox is the only environment where a CVC-shaped value can appear in a log without breaking that rule. Even so, keeping realistic card data out of test fixtures avoids confusion later.
Does a sandbox test CVV work on a live website?
No. A live gateway rejects test card numbers before the CVV is even considered, and most processors block the known test ranges outright. If you need a live transaction, only a real card from a willing cardholder can produce one.
Can you buy a CVV that works in a sandbox?
There is nothing to buy. Sandbox CVVs come free from gateway documentation, and any listing that claims to sell them is selling something else. Offers to purchase real CVV data involve stolen card credentials, which is a federal crime in the United States and a violation of card network rules.
What is the takeaway for developers?
Treat sandbox test CVVs as fixtures, not credentials. Pull the current list from your gateway's docs, wire the decline codes into your test suite, and confirm your code never persists a CVC in any environment.