A 3D Secure test card is a sandbox-only card number that forces one specific authentication outcome when you run a payment through a 3DS-enabled test environment. Instead of returning a random result, the number tells the gateway to trigger a frictionless pass, a challenge prompt, an authentication failure, or a timeout. You use these numbers to prove your checkout handles every branch before live traffic reaches it.

Buy the Best 3D Secure Test Card V10

What these cards actually control

A test card controls two things: the authorization result and the 3DS authentication result. Those are separate events. An authorization can approve while authentication fails, and that combination is the one most integrations get wrong. The card number decides which of the four standard outcomes the issuer simulator returns:

3d secure test card v7

• Frictionless approval, where the issuer authenticates without showing the cardholder anything
• Challenge required, where your integration must render an authentication page or redirect
• Authentication failed, where the transaction must be stopped before authorization
• Authentication unavailable, where you fall back to a liability-shift or soft-decline path

Prerequisites

• A sandbox account with a processor that supports 3DS2
• 3DS enabled on the sandbox merchant profile
• Test API keys, never live keys
• A callback or return URL that resolves inside your test environment

Where to get them

Test card numbers come from the party that simulates the issuer, not from cardholders. The reliable sources are processor and acquirer sandbox documentation. Stripe publishes a small set of 3DS-specific numbers, and 4000 0000 0000 3220 is the standard challenge-flow card in its test mode. Adyen, Checkout.com, and CyberSource each maintain their own 3DS2 test sets, and the numbers differ between providers. Visa and Mastercard developer portals also issue sandbox credentials tied to their authentication directories. Always confirm the current numbers in the provider docs, since test ranges get retired.

3D Secure Test Card v8: What It Is and How to Use It Safely

How to run a 3DS test

1. Enable 3DS on the sandbox merchant account and copy the test API keys into your environment.
2. Pick a test card that forces the outcome you want to verify, starting with the frictionless case.
3. Submit a payment through your normal checkout path with that card and an arbitrary future expiry.
4. Complete or abandon the challenge when it appears, depending on the scenario under test.
5. Read the authentication result in the response payload, not the authorization status.
6. Repeat with the failure card and confirm your code stops before capture.
7. Repeat with the timeout card and confirm your retry logic does not double-charge.
8. Log the transaction IDs and match them against the events in the processor dashboard.

What to verify

• The order record shows the correct authentication status after every branch
• Failed authentication never produces a captured charge
• Challenge pages return to the right URL with the state intact
• Your webhook handler treats authentication events as idempotent
• Error messages shown to the customer match the actual failure reason

Common mistakes

Mixing live keys into a sandbox run is the fastest way to create a real charge. So is testing only the challenge path and assuming frictionless works. Build both, plus the failure path, before you switch to production credentials.

3d secure test card v2