What a 2Checkout test card actually is

A 2Checkout test card is a payment number issued for the Verifone 2Checkout sandbox. It authorizes against simulated accounts, moves no real money, and exists so developers can confirm that a checkout form, a tokenization call, a webhook listener, and a refund path all behave the way they should before a live store takes a single order. If you are integrating a payment gateway, you want the numbers published in the official 2Checkout sandbox documentation and nowhere else. Card data advertised for sale outside a bank or a licensed processor is stolen data. Buying it, testing with it, or running it through a gateway is a federal offense in the United States, and no legitimate integration ever requires it.

read more

What to look for in a test card set

• Coverage of outcomes. A useful set includes at least one card that approves and several that trigger specific declines, so you can prove your error handling works.
• Brand variety. Sandboxes usually publish numbers for the major card brands. Test each brand you plan to accept, because routing and response codes differ.
• Verification responses. You need cards that return a CVV mismatch and an address verification mismatch separately, not a single generic failure.
• Authentication flows. If you sell in a region with strong customer authentication, confirm the sandbox offers a card that forces a 3D Secure challenge and one that passes without it.
• Currency handling. Test at least one non-USD currency so you can see how rounding and settlement currency appear in your order records.
• Documentation freshness. Test credentials change when a gateway migrates platforms. Always pull the current list from the sandbox help center rather than a blog post from three years ago.

Parameter bands worth testing

Build a small matrix instead of a single happy path. On the amount side, run a low-value order, a mid-value order, and one above any fraud review threshold your account uses, since risk rules often fire on amount alone. On the response side, capture the authorization code, the decline reason, the AVS result, and the CVV result for every attempt, then assert on each field in your test suite. On the lifecycle side, push a sale through capture, a partial refund, a full refund, and a chargeback simulation if the sandbox supports it. Keep the sandbox keys and the live keys in separate configuration files so a test run can never touch production.

read more

Common pitfalls

• Hardcoding sandbox credentials into source control. Use environment variables.
• Treating a sandbox approval as proof that your live account is configured. Underwriting, descriptor, and settlement settings are separate.
• Ignoring the webhook signature check because the sandbox accepts unsigned calls. Live traffic will not.
• Assuming declined-card behavior is uniform across brands. Response codes vary, and your messaging should too.
• Logging full card numbers or verification values anywhere, including test logs. Never store sensitive authentication data after authorization.

FAQ

Can I use a real card in the sandbox?

No. Use only the published sandbox numbers. Real card data belongs in production with a live merchant account.

2checkout test card

Why did my test card stop working?

Gateways rotate sandbox credentials and retire numbers when the platform changes. Recheck the current documentation.

more on this topic

Do test transactions appear in reports?

Sandbox activity stays in the sandbox. It does not appear in live settlement reports or affect your processing volume.

Where do I get the numbers?

From the gateway's own sandbox documentation or developer portal after you create a test account.

Sandbox credentials only

The only card numbers you should ever type into a payment form you did not issue are the test numbers your gateway publishes. Anything else offered for sale online is compromised card data, and using it exposes you to criminal liability and destroys any merchant account you hold.