A CVV test case is a QA check that verifies how a payment system validates, passes, and responds to the card verification value during a transaction. It covers format rules, mismatch behavior, missing fields, and sandbox testing, and it uses fake card data only. The goal is to confirm that the checkout flow accepts valid CVVs, rejects invalid ones, and never exposes the value in logs or storage.
Why do CVV test cases matter in payment testing?
CVV validation helps merchants reduce card-not-present fraud and supports PCI DSS compliance. A missing or broken CVV check can let invalid transactions through or cause false declines for real customers. Good test cases catch those gaps before release.
What should every CVV test case cover?
- Format validation for 3-digit CVV on most cards and 4-digit CVV for American Express.
- Mismatch handling when the CVV does not match the issuer record.
- Missing or blank CVV behavior, including whether the field is required.
- Input sanitization for letters, spaces, and special characters.
- Response codes and user messaging for each outcome.
- Logging and storage checks to confirm the CVV is never persisted.
How do you write a CVV test case step by step?
- Define the precondition, such as a sandbox payment page and a test card number.
- State the test data, including a valid CVV, an invalid CVV, and an empty value.
- Describe the action, such as entering the CVV and submitting the payment form.
- Record the expected result, including the response code and on-screen message.
- Add postconditions that confirm the CVV is masked and not written to logs.
Which CVV test scenarios should QA run?
Run positive, negative, and boundary cases for every payment method you support. Positive cases use sandbox test cards with matching CVVs. Negative cases use wrong, short, long, alphabetic, and empty values.
- Valid 3-digit CVV with a matching sandbox card.
- Valid 4-digit CVV for American Express sandbox cards.
- Wrong CVV that triggers a decline response.
- Two-digit and five-digit CVV values that fail format validation.
- CVV field left blank when the form requires it.
- CVV entered with spaces or letters to test sanitization.
What should you never do when testing CVV?
Never use real cardholder data in test environments, and never store the CVV after authorization. PCI DSS prohibits retaining the CVV, even in encrypted form, once the transaction is complete. Use processor-provided sandbox cards and keep test data clearly labeled as fake.