What is a mock CVV?

A mock CVV is a fake three- or four-digit code used with test card numbers in a payment sandbox. It lets developers run checkout tests without touching real card data. Mock CVVs work only in test mode and are rejected by live payment networks.

Card verification value (CVV) is the short code printed on a card. In a sandbox, the gateway replaces the real code with a mock value. That value tells the test system to approve or decline a transaction based on rules you set.

  • Mock CVV: fake code for test transactions.
  • Test card number: fake card number issued by a payment processor for sandbox use.
  • Sandbox: isolated test environment that mimics a live payment page.

How mock CVVs work in test environments

Payment processors publish test card numbers and matching mock CVV values. Stripe, for example, lists cards where any three-digit CVV passes in test mode. Other processors require a specific code to trigger a decline.

The sandbox matches the card number, expiry, and CVV against a rule set. If the values match an approval rule, the test charge succeeds. If they match a decline rule, the sandbox returns an error code.

Test card numbers vs real card numbers

Test card numbers follow the same length and prefix rules as real cards, but they are not tied to a bank account. A mock CVV has no link to a real cardholder. The sandbox never sends the data to a card network.

Sandbox rules that control CVV checks

Most gateways let you toggle CVV checks on or off in the dashboard. When checks are on, you can test decline codes such as "CVV mismatch." When checks are off, any mock CVV passes.

What the digits in a mock CVV represent

A CVV is three digits for most cards and four digits for American Express. The code is a check value, not a random number. In a sandbox, the processor maps specific codes to outcomes.

Some test suites use 123 or 000 as the default mock CVV. Others publish a table where 123 returns a match and 999 returns a mismatch. Read your provider's test data page before you write assertions.

Mock CVV formats across processors

  • Stripe: any three-digit CVV passes for standard test cards; specific decline cards use fixed codes.
  • PayPal: sandbox cards come with a CVV and a test expiry date.
  • Adyen: test cards include CVV rules for address and security code result codes.
  • Braintree: test CVVs trigger specific processor response codes.

How to use a mock CVV in a sandbox

  1. Open your payment processor's test mode or sandbox dashboard.
  2. Copy a test card number and its matching mock CVV from the provider's test data page.
  3. Set a future expiry date, such as 12/34.
  4. Run a test charge and confirm the response code.
  5. Repeat with decline cards to test your error handling.

Do not paste real card data into a sandbox. Test data belongs in test mode only. Mixing live and test keys can create failed charges or false test results.

Why a mock CVV fails on a live payment page

Live gateways send the CVV to the card issuer for validation. The issuer compares the code to the one on file for that card. A mock CVV has no matching card, so the issuer returns a "no match" or "not processed" response.

Card networks also block repeated failed CVV attempts. A live page will decline a mock CVV in most cases. The only safe place for a mock CVV is a sandbox.

PCI rules add another limit. Merchants cannot store the CVV after authorization. That means a mock CVV cannot be reused from a database, even in test systems that copy production logic.

Common mistakes with mock CVV testing

  • Using a live secret key in a test script. This sends test charges to a real account.
  • Assuming every test card accepts any CVV. Some processors tie each test card to one code.
  • Skipping decline tests. A checkout that handles only approvals can break on a real CVV mismatch.
  • Confusing a mock CVV with a stolen or generated CVV. Stolen card data is illegal to buy, sell, or use.

If a vendor offers to sell "CVV" data for live cards, that is carding, not testing. Mock CVVs come from your payment processor and cost nothing.

Security and legal limits on mock CVV use

A mock CVV is not a license to test with live data. Test systems must stay isolated from production keys and real card numbers. A leak of test data is harmless, but a leak of live card data is a breach.

Buying or selling real CVV data is illegal in most countries. It violates card network rules and can lead to criminal charges. If a site sells "CVV" for live cards, treat it as fraud.

FAQ

Can a mock CVV be used to buy something?

No. A mock CVV has no linked account and fails issuer checks. It cannot authorize a live purchase.

Where do developers get test card numbers and mock CVVs?

From the payment processor's developer docs. Stripe, PayPal, Adyen, and Braintree publish test cards with matching CVV values. Use the test data page for your own provider.

Is a mock CVV the same as a fake CVV?

Not quite. A mock CVV is issued for sandbox testing and is legal. A "fake CVV" made to look like a real card's code for fraud is illegal.

Do mock CVVs expire?

Test card expiry dates are arbitrary but must be in the future. Mock CVVs themselves do not expire. The sandbox may retire old test cards when it updates its test data set.