A sample CVV test case is a fake card verification value paired with a test card number inside a payment gateway sandbox. It lets a developer confirm that a checkout form accepts 3 digits for Visa and Mastercard, 4 digits for American Express, and rejects letters or blank fields. These codes never touch a real card or a live authorization.
Sample Data CVV Testing: What Test Card Numbers Prove
What is a sample CVV test case?
It is a placeholder code taken from a processor's test documentation, not a number tied to any cardholder. Stripe, for example, tells developers to use any 3-digit CVC with its 4242 4242 4242 4242 test card. The value exists to exercise form logic and API fields, nothing more.
How is a test CVV different from a real one?
A real CVV is issued by the bank, printed on the card, and tied to the account. A test CVV is invented. It has no link to an account and no value outside the sandbox.
How do test CVV values work in a sandbox?
The sandbox checks format rules and returns a scripted response. Most gateways accept any 3 or 4 digits when the card number is a known test card. In many setups the response depends on the card number, not the CVV.
Some processors add CVV-specific triggers. A code of 000 may force a "CVV mismatch" decline, while 123 passes. Read your gateway's test docs before you assume a behavior.
Which CVV values cover the common test scenarios?
- 123 — generic pass value for 3-digit brands (Visa, Mastercard, Discover).
- 1234 — 4-digit CID for American Express test cards such as 3782 822463 10005.
- 000 — decline trigger on some gateways; confirm in the processor docs.
- 12 or AB — short or non-numeric input for client-side validation checks.
- Blank — required-field and error-message checks.
What should a CVV test case actually verify?
A good test case checks the rules your code owns, not the bank's rules. You want proof that the form and API handle each input the way your spec says.
- Length rules per brand: 3 digits for Visa and Mastercard, 4 for Amex.
- Numeric-only filtering and rejection of letters or symbols.
- Required-field messages when the field is empty.
- Decline handling when the gateway returns a CVV mismatch code.
- No CVV value in your logs, database, or analytics events.
How do you build a CVV test matrix?
- Pick one test card per brand from your processor's public list.
- List the CVV variants you plan to send (valid length, wrong length, letters, blank).
- Write the expected result for each pair of card and CVV.
- Run each case through the UI and again through a direct API call.
- Record the result, then confirm the CVV does not appear in any stored payload.
What are common mistakes with sample CVV test cases?
- Pointing test values at a live endpoint instead of the sandbox.
- Storing the CVV after authorization, which breaks PCI DSS rules.
- Assuming every gateway accepts any 3 digits; behavior varies by processor.
- Testing only the happy path and skipping declines and validation errors.
Is it legal to use sample CVV numbers?
Yes, when you stay inside a sandbox you control and use published test values. The numbers are public, tied to no account, and meant for development.
Using a real cardholder's CVV without permission is card fraud, and holding that data after authorization violates PCI DSS. Keep test data separate from production data and delete it when the sandbox is retired.
FAQ
What is the standard CVV for test cards?
123 is the common choice for 3-digit brands, and 1234 for American Express. Check your processor's docs, since a few gateways reserve specific values for decline tests.
Can I use any 3 digits with Stripe test cards?
Yes. Stripe's docs state that any 3-digit CVC works with its test card numbers, and any future expiry date passes.
Do I need a CVV test case for a zero-amount authorization?
Yes, if the endpoint requires the field. Send a valid test CVV so the request reaches the authorization step, then check that your app handles the zero-amount response.
Does a test CVV expire?
The CVV itself has no expiry. The test card's expiry date field still needs a future date, and processors update test card lists from time to time, so recheck the docs when a case fails.