A credit card test number is a synthetic account number that a payment gateway publishes for its sandbox, and it is the only kind of card number you should ever use outside of a live, authorized transaction. Pick the test number that matches your processor, your card brand, and the exact outcome you need to reproduce, whether that is an approval, a soft decline, or a 3D Secure challenge. Numbers published by Stripe, PayPal, Authorize.Net, and similar processors behave the way the gateway programs them to behave, and none of them can move real money. If someone offers to sell you a live card number, that is stolen financial data, and buying or using it is a federal crime, not a shortcut.
What a test card number is, and what it is not
Developers sometimes confuse three different things: a real card number, a test card number issued by a gateway, and a fake number that only happens to pass a checksum. Knowing which one you are holding prevents most integration bugs.
- It is issued by the processor, not by a bank, so it only resolves inside a sandbox account tied to that processor.
- It usually passes the Luhn check digit, which is why it looks plausible to a form validator.
- It works only in test mode. Swap in live API keys and the same number will be rejected.
- It is not a stolen, leaked, or generated card. It carries no credit line, no cardholder, and no billing address.
How to choose the right one
Three inputs drive the decision, and getting them in the right order saves hours of debugging.
- Start with your gateway. Each processor publishes its own list, and numbers rarely work across competing sandboxes.
- Then pick the outcome. Most lists include separate numbers for approvals, generic declines, insufficient funds, expired card, and processing errors.
- Then pick the verification scenario. If your checkout collects a CVV or an address, choose the number and the companion address or CVV value that produces the pass or fail you want to test.
Match the card brand and length
Card numbers follow an industry numbering plan, so a test number for one brand will not validate as another.
- Visa style: 16 digits beginning with 4.
- Mastercard style: 16 digits beginning with 51 through 55, or in the 2221 to 2720 range.
- American Express style: 15 digits beginning with 34 or 37.
- Discover style: 16 digits beginning with 6011 or 65.
If your form rejects a legitimate test number, check the length rule and the spaces first. Many validators break on 15 digit input.
Match the response you need
Approval is the easy case. The valuable tests are the ugly ones: a decline at authorization, a decline at capture, a timeout, and a challenge flow where the customer must complete an extra verification step. Read your gateway list line by line and map each number to a branch in your error handling. Teams that skip this step ship code that shows a blank screen the first time a real card declines.
Match the verification behavior
Address and CVV checks are simulated too. Gateways publish specific street addresses, postal codes, and three or four digit security values that force a match or a mismatch. Use them to confirm that your order review queue, your retry logic, and your customer messaging behave correctly when verification fails.
Common pitfalls
- Mixing live and test credentials in the same configuration file.
- Hardcoding a test number into a build that later ships to production.
- Assuming a test number from one gateway works in another.
- Testing only the happy path and never the declines.
- Using a real card number, even your own, in a non PCI compliant environment.
- Forgetting that sandbox expiration dates still need to be in the future.
FAQ
Are test card numbers the same as real card numbers?
No. A test number has no account behind it and cannot be charged. It exists so software can be exercised without touching a real account.
Can a test number buy anything?
No. It resolves only inside a sandbox and only when the sandbox is in test mode.
Why do test numbers pass a checksum check?
Because they follow the same numbering plan as live cards, including the final check digit, so they exercise the same validation code paths.
Do test numbers expire?
Some gateways require an expiration date in the future and reject anything in the past.
Is it legal to share them?
Yes. Gateways publish them for developers. Sharing a live card number or its security code is a different matter and is illegal in most jurisdictions.