A test CC number is a card number that a payment processor publishes for sandbox use only. It passes the same Luhn checksum as a real card, so a checkout form accepts it, but the processor routes it to a simulator instead of a bank. No authorization request reaches an issuer, no funds move, and no cardholder is charged. Developers use these numbers to build, break, and rebuild payment flows without handling live card data.
Where test numbers come from
Payment processors maintain their own lists, and each list is bound to that processor's test mode. A number from one provider will not behave the same way on another provider's gateway.
How to Use a Test Card No for Online CVV Sales
- Stripe publishes test card numbers in its developer documentation, including cards that always succeed and cards that always decline.
- PayPal publishes sandbox card numbers for its developer test accounts.
- Adyen and other gateways publish their own test cards, each tied to a specific result code.
Because these lists are public, treat them as fixtures, not secrets. Anyone can read them.
How to run a test payment
- Create a sandbox or test account with your payment provider.
- Switch your API keys to the test pair. Keep live keys out of your development environment.
- Open your own checkout page in test mode.
- Enter the test card number, any future expiry date, and any three digit CVC.
- Submit the form and read the response object your gateway returns.
- Log the result code and the decline reason, if one is present.
- Repeat with a second number that maps to a different outcome.
What different test numbers do
Most providers assign one behavior per number. A generic success card approves every charge. A decline card returns a fixed error such as insufficient funds. A fraud card trips the gateway's risk rules. An authentication card forces a 3D Secure challenge. That range lets you test the happy path and every failure branch in the same afternoon.
Understanding Test Card Numbers for Online Security
Limits and legal boundaries
Test numbers work only against a sandbox endpoint. Typing one into a live storefront will fail, and if it somehow did not, you would still be attempting to move money on someone else's account. Real card numbers, expiry dates, and CVV codes belong to real people, and using them without written authorization is card fraud in every US state and under federal law. Storing CVV data after an authorization is also prohibited by the PCI Data Security Standard, even for merchants that are otherwise compliant.
Quick checklist
- Confirm you are pointed at a test endpoint before you type any number.
- Keep a short list of numbers that cover success, decline, fraud, and 3DS.
- Never place live card data in a test database.
- Clear test records before you promote a build to production.