Razorpay test mode accepts any CVV value on its published test card numbers, so the CVV you type in the sandbox does not decide the outcome. The card number decides whether the payment succeeds, fails, or triggers a 3-D Secure step, and the expiry only has to be a future date. The CVV field is still validated for shape, which means three digits for Visa and Mastercard, four for American Express, and nothing but numbers. That distinction matters because most developers searching for a Razorpay CVV test are really trying to verify one of two things: that their checkout accepts a well-formed CVV, or that their backend treats a successful sandbox payment correctly.
Why test mode ignores the CVV value
A sandbox is a simulator. When you submit a payment in test mode, Razorpay does not contact an issuer, so there is no CVV record to match against. The gateway returns a scripted outcome tied to the card number you used. Live mode is different: the issuer receives the CVV and can decline the authorization if it does not match the one on file.
Razorpay CVV Verification Method Guide: Everything You Need to Know
The practical consequence is that you cannot test a real CVV mismatch in the sandbox. You can only test how your own code handles the result the sandbox gives you.
Run a CVV test in the Razorpay sandbox
- Sign in to the Razorpay dashboard and switch the toggle to Test Mode.
- Copy the test key ID and key secret from the API keys section.
- Load your checkout or server integration with those keys.
- Enter a published test card number, for example the widely used Visa test number 4111 1111 1111 1111. Always pull the current list from your dashboard or the Razorpay docs, because test numbers change.
- Type any three-digit CVV, choose a future expiry, and submit.
- Open the payments list in the dashboard and confirm the status, then inspect the webhook payload your server received.
To test the CVV input field itself, submit deliberately malformed values: empty, two digits, five digits, letters, and a value with a leading zero. Razorpay Checkout rejects those before an authorization is ever attempted, and your own client-side validation should catch them even earlier. This is where most real bugs live.
Test mode versus a live transaction
Test mode
- Pros: no money moves, unlimited attempts, safe for automated tests, exposes field-level validation and error handling.
- Cons: no issuer response, so no genuine CVV match or mismatch, and no real decline codes from the card network.
Live mode with your own card
- Pros: the only way to observe true issuer behavior, including CVV mismatch declines.
- Cons: real money and real fees, a live restricted key scope, and any mistake touches production data.
Use test mode for logic and field validation. If you need to confirm how an issuer responds to a CVV mismatch, run one small live transaction with a card you own and reverse it according to your own refund policy.
Reading the result
Razorpay returns an error code and description with each failed attempt. A malformed CVV surfaces as a bad request style error before authorization, while a genuine decline returns a decline code from the issuer. Log the code, never the CVV, and map each code to a specific message in your checkout so support can diagnose issues without guessing.
Handling CVV data correctly
CVV is sensitive authentication data. PCI DSS forbids storing it after authorization even in encrypted form, and Indian rules bar merchants from storing card credentials and require tokenization for card-on-file payments. With Razorpay's hosted checkout the CVV goes straight to the gateway, so your server never sees it. If you build a custom form, keep the field out of your logs, your analytics, and your database, and clear it from memory once the request is sent.
Recommendation
Treat the sandbox as a test of your own code, not of the card networks. Validate the CVV field format on the client, confirm the sandbox payment and webhook on the server, and reserve live testing for the one case the sandbox cannot reproduce.