A 3D Secure test card is a sandbox card number that forces a simulated 3DS authentication step during checkout. The "v3" tag comes from provider test libraries that group cards into sets, so it points to the third set of 3DS cards, not to a third version of the protocol. 3D Secure has no version 3; the live specification is EMV 3DS 2.1 through 2.3, and v3 test cards exercise that 2.x flow.

3d secure test card v5

What does a 3D Secure test card v3 do?

Each test card number maps to one scripted outcome in the sandbox. One card returns a frictionless approval with no challenge. Another opens the challenge window, where you pick "complete" or "fail" to control the result. A third returns an authentication error so you can test your retry path.

3D Secure Test Card V9

This lets you check the full order lifecycle: authorization, 3DS challenge, capture, refund, and webhook delivery. Nothing touches a real bank. No money moves.

3D Secure Test Card v8: What It Is and How to Use It Safely

How sandbox 3DS testing works

Frictionless versus challenge flow

In a frictionless flow the issuer approves the transaction without asking the cardholder for anything. Your code sees a normal successful authorization and no redirect. In a challenge flow the payment page redirects to an ACS page, the shopper enters a code or confirms in an app, and the browser returns to your return URL.

3D Secure Test Card V7: The Ultimate Guide to Purchase

Authentication values you will see

• Y: authenticated, liability shifts to the issuer.
• N: not authenticated, treat as a decline or a review case.
• U: authentication could not run, often a technical problem.
• A: attempted, common for merchants that have not finished a 3DS2 migration.

Your integration should handle all four values. Most bugs show up in the U and A paths because developers test only the happy case.

Which 3DS test card numbers should you use?

Payment providers publish their own number sets, so pull the list from the sandbox you build against. The examples below are documented by Stripe and behave the same across most 3DS2 test suites.

• 4000000000003220: 3DS required, challenge flow, authentication succeeds.
• 4000000000003063: 3DS required, challenge flow, authentication fails.
• 4000000000003055: 3DS supported but not required, frictionless approval.
• 4000002500003155: 3DS required, then a successful charge.

Expiry date and CVC take any value with the right format in test mode, such as 12/34 and 123. Cardholder name and postal code checks follow the same rules as your other test cards.

Provider labels differ. Adyen, Checkout.com, and Braintree each publish test cards for 3DS2 with their own numbering, and a card that triggers a challenge on one platform may approve without one on another.

How to test a 3DS v3 flow step by step

1. Switch your API keys to the sandbox or test mode keys.
2. Set the card number to the 3DS test card for the outcome you want.
3. Submit the payment and watch for a redirect or a challenge iframe.
4. Complete or fail the challenge on the ACS page.
5. Read the authentication result in the payment response and in the webhook payload.
6. Confirm the order state moves to the value you expect: paid, declined, or pending review.
7. Repeat with the error card to test timeouts and retries.

Run each case on mobile Safari, mobile Chrome, and desktop. Challenge windows that open in a new tab break on some in-app browsers.

Why does my 3DS test card fail?

Wrong environment

A 3DS test number sent to a live endpoint will decline or return an unknown card error. Check that the key prefix matches the environment.

3DS not enabled on the account

Some providers require you to turn on 3DS in the dashboard before test cards trigger a challenge. If requests come back with no authentication data, that setting is the first thing to check.

Challenge window blocked

Pop-up blockers and strict iframe sandboxing stop the ACS page from loading. The payment then sits in a pending state.

Stale device data

3DS2 collects browser and device signals before the issuer decides between frictionless and challenge. Cached JavaScript from an older build can produce the wrong flow, so hard refresh or clear storage between runs.

Sandbox versus production

The protocol is the same; the difference is who answers. In test mode a simulated ACS returns results on demand. In production the issuer decides, and you cannot force a challenge for a card that does not need one.

Keep the same integration code in both environments. The only changes should be the API keys and the base URL.

Frequently asked questions

Does a 3DS test card work in live mode?

No. Test numbers exist only in sandbox environments and will decline against real card networks.

Can I pick any CVC and expiry?

Any value in the right format works with a test card, since no real issuer validates it.

Is there a 3D Secure version 3 protocol?

No. EMV 3DS 2.x is the live standard, and "v3" is a library label or shorthand for a full 3DS2 challenge test.

Which outcome should I test first?

Start with the frictionless approval, then the challenge success, then the challenge failure, then the error path. That order mirrors real traffic.