The short answer
On Stripe's standard test card 4242 4242 4242 4242, the CVV can be any three digits you want. The same holds for most test numbers: Stripe checks the length and format, not the value, unless you deliberately pick a card number built to simulate a failed CVC check. Expiry works the same way. Any future date passes.
Stripe CVV Verification Method: A Comprehensive Guide
So the test CVV is usually 123, or 000, or 999. It genuinely does not matter. What matters is the card number in front of it.
Why the CVV barely matters in test mode
Test mode is a sandbox. There is no issuer, no card network, no real authorization. Stripe's test cards are hard-coded to return specific outcomes, and CVC validation is one of the outcomes they simulate rather than compute. For a plain success card, the CVC field is accepted as long as it has the right number of digits.
Stripe CVV Authentication Process Guide for Selling CVV Online
Two exceptions exist. Card numbers designed to fail CVC verification, and American Express, which expects four digits instead of three.
Test numbers that return a specific CVC result
- 4242 4242 4242 4242: success, any 3-digit CVC, any future expiry.
- 4000 0000 0000 0127: CVC check fails; the charge comes back with an incorrect_cvc decline.
- 4000 0000 0000 0002: generic decline, unrelated to CVC.
- 4000 0000 0000 9995: insufficient funds decline.
- 4000 0000 0000 0069: expired card.
- 4000 0000 0000 0119: processing error.
- 4000 0025 0000 3155: requires 3D Secure authentication.
- 3782 822463 10005: Amex, four-digit CID.
Reach for 0127 when you want the cvc_check field on the charge object to come back as fail. Reach for 4242 when you just need a payment to go through.
Three digits versus four
Visa, Mastercard, Discover and most other brands use a three-digit CVC. American Express uses a four-digit CID printed on the front of the card. In test mode Stripe enforces the length, so four digits on a Visa test card gets rejected by form validation before any charge is created. That's a client-side validation error, not a declined payment, and the distinction trips people up when they're debugging.
Reading cvc_check on the charge
When you create a charge or a PaymentIntent in test mode, the resulting object carries a cvc_check value. "pass" means verification succeeded. "fail" means it didn't. "unavailable" means the issuer couldn't be reached. "unchecked" means the check was skipped, which happens with certain regions and card types. If you're building decline handling, this is the field to branch on, and 4000 0000 0000 0127 is the card that exercises the fail path.
Mistakes I see most often
- Pasting test numbers into a live-mode checkout. They will not resolve. Test numbers only work with test API keys.
- Assuming a failed CVC always blocks the charge. Some payment methods and some issuers skip CVC entirely.
- Hard-coding 4242 everywhere. You want at least one decline card and one 3DS card in the suite.
- Storing the CVV. Never store it, in test or live. PCI DSS forbids retaining the verification code after authorization.
A note on people selling "real" CVVs
Anyone offering live card numbers with matching CVVs is selling stolen data, and the numbers are usually dead or already flagged by the issuer. Test-mode CVVs come from public documentation and cost nothing. A site that charges for something labeled a Stripe test CVV is a red flag, not a shortcut. Testing a live card requires the cardholder's authorization and a live key, and nothing on a storefront changes that.