What a 3D Secure test card is

A 3D Secure test card is a card number that exists only in a sandbox. Processors publish these so you can push a payment through enrollment, the Access Control Server, and authentication without touching a real account. The "v1" in 3D Secure test card v1 points at the older 3D Secure 1.0 set, the version where the cardholder got bounced to a bank-hosted page and came back with a PAReq and PARes. Most gateways still keep a few v1 numbers in the table for legacy regression tests, even though the schemes retired live 3DS1 traffic years ago.

Buy the Best 3D Secure Test Card V10

Why the v1 label still shows up

Search for 3DS test cards and you land on pages that mix 1.0.2 and 2.x numbers in one grid. That is the whole reason "v1" became a modifier: people want the original redirect flow, not the newer in-app challenge. If your integration predates 3DS2 and you are still writing tests against the 1.0.2 message format, the v1 cards are the ones you want. If you are building anything new, you should be testing 3DS2 and treating v1 as a compatibility case.

3D Secure Test Card V9

3DS1 versus 3DS2 in the sandbox

• 3DS1: a browser redirect to an ACS page, a typed password, and a PARes back to the merchant.
• 3DS2: a device fingerprint call first, then either a frictionless approval or a challenge window.

Same test PAN can behave differently across those two paths, which is the source of most "the card does not work" reports I see.

3D Secure Test Card v8: What It Is and How to Use It Safely

What the numbers look like

Nearly every published test PAN starts with 4000 and passes the Luhn check. That 4000 range is reserved for testing, so the digits never collide with a live account. Expiry is any future date and the CVC is any three digits in most sandboxes.

3d secure test card v5

Patterns I keep in a scratch file: 4000 0000 0000 3220 for a 3DS2 challenge, 4000 0000 0000 3055 and 4000 0000 0000 3063 for 3DS-required behavior on several gateways, and 4000 0000 0000 0002 for a plain decline with no 3DS step at all. Numbers do get retired and behavior gets remapped. Check the processor's current test card page before you hardcode anything into a suite.

The fields that decide the outcome

The PAN is only half of it. Sandbox results come from a handful of values you send or read back:

• Enrollment status (Y, N, U): whether the card sits in the 3DS directory at all.
• Transaction status (Y, N, A, U, C, R): authenticated, not authenticated, attempted, unavailable, challenge required, rejected.
• Challenge indicator and exemption flags on the 3DS2 request.
• Simulated ACS page behavior, which some sandboxes let you choose from a dropdown.

How to run a clean test

1. Stay in test mode with test API keys. Live keys against a test PAN produce errors that look nothing like the real failure.
2. Use the gateway's own test numbers, not a list copied from a blog post.
3. Log the raw 3DS messages. The enrollment response and the authentication response tell you which branch fired.
4. Change one variable per run: challenge indicator, exemption, or amount. Not all three.

Pitfalls worth knowing

Old v1 cards often fail outright on gateways that dropped 1.0.2 support, and that is expected, not a bug. The redirect step needs a real browser user agent, so a headless script will hang at the ACS page forever. Some sandboxes also cache enrollment per card, so a number that returned Y yesterday can return U today after a config change.

One last thing: these are sandbox artifacts with no issuer, no balance, and no cardholder behind them. They work in test mode only. Pointing one at a live endpoint is fraud, and it gets merchant accounts shut down fast.