There is no official 3D Secure test card v5. Card networks and EMVCo do not publish numbered test card sets, so any list labeled "v5" is a third-party assembly of numbers that were first published by a payment processor. The top pick for most teams is the sandbox test set from your own processor, and Stripe's is the most complete. We judged the options on four points: which 3DS flow the number triggers (frictionless, challenge, or failed authentication), how clearly the outcome appears in the API response, whether the number keeps working when you rerun the same scenario, and whether it can be used with zero live card data.

Buy the Best 3D Secure Test Card V10

What the "v5" label actually means

The version number in "3D Secure test card v5" has no technical meaning. A sandbox does not check whether a card is v3 or v5. What it checks is the BIN range and the status your processor attached to that range inside the test environment. When a card fails in your sandbox, the cause is almost never the version label. It is one of four things: the card is not on your processor's test list, test mode is off for the API key you are using, the merchant account is not configured for 3DS, or the digits were copied with a typo from an old forum post.

related article

You can verify this in five minutes. Take the number you found, search your processor's own test card documentation for it, and check whether it appears there. If it does not, it will not work, no matter which version label the list used.

3D Secure Test Card v8: What It Is and How to Use It Safely

Stripe sandbox cards: best overall

Stripe keeps the clearest test card table of the major processors, and each number maps to one named authentication outcome instead of a vague "3DS test card". The card 4000000000003220 returns an authentication that requires a challenge, so you can exercise your challenge UI, the redirect or modal handoff, and the return path after the customer authenticates. The card 4000000000003063 covers the 3DS-required case in the standalone 3DS API. Stripe also documents a frictionless-flow card in the same 400000000000 range, where the issuer authenticates without showing the customer anything.

read more

• Pros: one card per authentication outcome, so test names read like your acceptance criteria; published in public developer docs; works across standard sandbox API keys; frictionless and challenge cases are separated, which is the distinction that breaks most integrations.
• Cons: numbers are tied to Stripe's sandbox and mean nothing in another gateway; some cards behave as documented only when the account is enabled for 3DS2; the table changes, so a number copied from a blog post can be stale.

Use Stripe's set if you build on Stripe, or if you need a reference implementation to compare against while you map how another gateway reports authentication results.

Adyen test cards: best for acquirer-side testing

Adyen publishes a test card table with separate entries for 3DS1, 3DS2 challenge, and merchants that do not use 3DS at all, plus cards that return specific refusal reasons. The Visa test numbers in the 4212 range are the ones most often used for a 3DS2 challenge. Because Adyen sits closer to the acquirer side, its sandbox fits better when your question involves the scheme, the issuer response code, or a raw authentication value.

• Pros: covers 3DS1 and 3DS2 side by side, which helps with migration work; refusal reasons are testable without a live account; useful when you need to see how a gateway maps issuer responses into your own status fields.
• Cons: the table is longer and less self-explanatory, so you have to read the flow notes; some test behavior depends on settings in the test merchant account; documentation is spread across flow-specific pages.

Choose Adyen when you are testing acquirer behavior, refusal handling, or a migration from 3DS1 to 3DS2, and copy the digits from the current docs rather than from a reseller list.

Braintree and PayPal sandbox: best if you already ship on Braintree

Braintree's sandbox accepts standard test card numbers, and its 3DS sandbox returns a challenge you can complete or abandon on purpose. Test values live in PayPal developer documentation rather than in one printable table.

• Pros: no extra signup if you already have a Braintree sandbox; the 3DS challenge can be failed on purpose, which is a fast way to test your decline screens.
• Cons: fewer distinct authentication outcomes than Stripe; card values and 3DS behavior are documented in more than one place.

Use it if Braintree is your production gateway and you want the sandbox to match production configuration without a second integration.

How to pick a card for a specific test

1. Write down the outcome you need: frictionless pass, challenge pass, challenge abandoned, authentication failed, or issuer unavailable.
2. Find the processor row that names that outcome. Do not start from a card number.
3. Confirm test mode is active for the API key you are using.
4. Run the smallest possible request first, a single payment intent or authorization, and log the full authentication response.
5. Repeat with the same number to confirm the result is stable. If it changes, the issue is your configuration, not the card.
6. Record the number, the date you verified it, and the doc page you took it from, so the next person does not retest a stale value.

Safety rules that keep you out of trouble

Test card numbers are valid only inside sandbox and test modes. Never run live card data through a test environment, and never treat a public test number as proof that a real card will behave the same way. Card network rules and your processor agreement both prohibit using live account data for testing, and sandbox results do not predict production approval rates. Numbers sold or traded as "v5 3DS cards" are recycled public test values at best and a waste of money at worst, because the ones that matter are free in your processor's documentation.