Short answer

A 3D Secure test card v5 is a sandbox-only card number that forces a 3DS 2.x authentication step, so you can test challenge and frictionless flows without moving real money. You enter it in a gateway test environment, use any future expiry date and any three digit security code, and the gateway returns a scripted authentication result instead of contacting an issuer. The "v5" label refers to the versioned test card pack a provider publishes, not to a separate 3DS protocol version.

3d secure test card v7

These numbers work only against test API keys. They decline on live keys, and they must never be sent to a production endpoint.

3D Secure Test Card V9

Prerequisites

• A sandbox account with your payment gateway or acquirer.
• Test API keys (publishable and secret) for that sandbox.
• 3DS enabled on the sandbox account, with 3DS2 set as the active version.
• An HTTPS return URL the challenge page can redirect to.
• Access to the sandbox dashboard and webhook logs.

Steps

1. Open the gateway dashboard and switch the account to test mode, then confirm 3DS2 is turned on for card payments.
2. Copy the test secret key into your environment variables and load the gateway SDK in your test project.
3. Create a payment intent or payment session for a small amount, such as 10.00 USD.
4. Submit one of the 3DS test card numbers below with a future expiry and a three digit security code such as 123.
5. Capture the response and check whether the gateway returned a challenge action or a frictionless authentication result.
6. If a challenge was returned, render the gateway challenge page or redirect to the provided URL, then complete the simulated authentication form.
7. Query the payment object after the redirect and record the final status: succeeded, requires_action, or failed.
8. Replay the same request with a card from the failure list and confirm your code handles the decline path without crashing.
9. Check the webhook log to verify your handler processed the authentication result event.

Cards that trigger 3DS in the v5 pack

• 4000000000003220: 3DS2 challenge required, authentication successful.
• 4000008400001629: 3DS2 challenge required, authentication successful through the full challenge flow.
• 4000002500003155: 3DS required and passed, used for recurring and subscription tests.
• 4000000000003063: authentication attempted and not successful, which ends as a failed payment.

Your gateway may publish a different set under its own versioned pack. Use the numbers from the provider whose sandbox you call, since result codes and challenge behavior differ between acquirers.

3d secure test card v5

Reading the authentication result

A frictionless result means the sandbox skipped the challenge and returned a liability shift value. A challenge result means your integration must hand control to the gateway page and wait for the return URL. Treat any status other than a successful authentication as a decline, and log the raw authentication payload so you can compare runs across card packs.

3d secure test card v4

Common failure points

• Sending a test card to a live key, which produces a hard decline and can flag the account.
• Using an expired date, which fails validation before 3DS runs.
• Missing or non-HTTPS return URLs, which stall the challenge step.
• Ignoring the challenge redirect in code that expects a single synchronous response.
• Testing only the success card and never the failure card, which leaves the decline path unverified.

Cleanup

Delete the test payment objects after each run, rotate sandbox keys if you shared them, and keep test credentials out of production config files. Document the pack version you tested against so a later 3DS upgrade does not silently change your results.