Sample data for CVV tests is fake card data that a payment processor publishes for its sandbox. The card numbers pass a Luhn check and route to no bank. The CVV is any three digits, or four for American Express. Live card data has no role in a test environment.
What counts as test data
A test data set has four fields: a card number, an expiry date, a CVV, and a postal code. Each field comes from the processor's test documentation. The values are public. Stripe, Adyen, PayPal Braintree, and the card network developer portals publish sets for Visa, Mastercard, American Express, Discover, Diners Club, and JCB.
Published test numbers
- Visa: 4242 4242 4242 4242
- Mastercard: 5555 5555 5555 4444
- American Express: 3782 822463 10005
- Discover: 6011 1111 1111 1117
- Diners Club: 3056 9300 0902 0004
- JCB: 3566 0020 2036 0505
Stripe documents any three-digit CVC and any future expiry date for these numbers in test mode. American Express numbers take a four-digit code. Test BINs sit in ranges the networks reserve, so a live authorization never sees them.
Rules for handling test data
- Never enter a live card number in a test environment. PCI DSS and card network contracts bar it.
- Never store the CVV after authorization, test or live. PCI DSS Requirement 3.2 lists the CVV as sensitive authentication data.
- Keep test keys and live keys apart. A live key with a test PAN returns an error, and the reverse sends traffic to the sandbox.
- Label test records in your database so a QA row never reaches a settlement file.
Decline and error cases
Processors publish numbers that trigger specific responses. Stripe lists 4000 0000 0000 0002 for a generic decline and 4000 0000 0000 9995 for insufficient funds. Test these paths before release. A sandbox that approves every charge hides bugs in your error handling.
What test data cannot show
A sandbox does not model issuer risk checks, 3-D Secure step-ups, or network latency. Some processors simulate 3-D Secure with a test flow. Others do not. Read the sandbox docs for the flow you need. Test data also cannot confirm that your production account has the card brands enabled.
If a vendor offers real CVV samples for testing, treat the offer as a red flag. Live card data in a test pipeline is a breach waiting to be reported. Use the processor's published set instead.