The best pick for most teams is the 3D Secure test card set published inside your own gateway's sandbox documentation, and the set closest to a "v7" revision is whatever build your provider currently labels as its 3DS2 scenario list. This guide compares the four sets that cover most integrations: Stripe, Adyen, Checkout.com and Cybersource. They are judged on four criteria: how many authentication outcomes each set can force, whether it spans 3DS1 and 3DS2, how fully the vendor documents the expected result fields, and whether the cards stay confined to test mode.

read more

What the "v7" label actually refers to

Three things get called v7. One is the seventh revision of a vendor's published test card list. Another is the seventh edition of a sandbox scenario document. The third is shorthand for 3DS2 test data where the version digit drifted. No standards body issues a numbered v7 card. EMVCo owns the 3D Secure specification and its version line, running from 2.1.0 through 2.3.1, while each gateway stamps its own revision numbers onto test data. Treat v7 as a vendor label and verify it against that vendor's changelog before you build a suite around it.

3d secure test card v4

Criteria that separate a good test card set from a thin one

• Outcome coverage: can the set force frictionless, challenge, and challenge-failed results on demand?
• Version coverage: does it include 3DS1, 3DS2, and the transition states between them?
• Documentation quality: does the vendor state the expected authentication value, ECI, and liability shift for each card?
• Isolation: do the cards work only in test mode, with no route to a live authorization?

Stripe: the most widely documented set

Pros

• Public card numbers with named outcomes, including 4000 0025 0000 3155 for a 3DS1 challenge and 4000 0000 0000 3220 for a 3DS2 challenge.
• Works with PaymentIntents, SetupIntents and the Stripe.js confirmation flow, so you exercise the same code path you ship.
• Test clocks and test helpers let you script the challenge result instead of clicking through a modal by hand.

Cons

• Models Stripe's own routing only, so a gateway-agnostic integration still needs a second sandbox.
• The sandbox challenge screen does not look like an issuer ACS page, which hides some real-world layout bugs.

Use it when you build on Stripe, or when you need a fast reference for what an authentication-required response looks like.

more on this topic

Adyen: scenario-first test cards

Pros

• Test data is organized by authentication result rather than by card number, which maps well to automated test cases.
• Covers frictionless, challenge, and refused-authentication branches.
• Sandbox and live credentials are kept separate, which lowers the risk of a test card reaching production.

Cons

• Fewer inline examples, so you read the docs to find the card that produces the result you want.
• Behavior differs between the 3DS1 and 3DS2 test endpoints, which trips up suites written for one version.

Use it when you run regression suites that must hit several authentication outcomes per release.

read more

Checkout.com and Cybersource: enterprise and legacy coverage

Pros

• Both publish 3DS2 test cards with the expected transStatus values: Y for authenticated, N for not authenticated, U for unable to authenticate, A for attempted.
• Cybersource keeps 3DS1 scenarios alive, which matters for acquirer links still carrying older traffic.
• Documentation ties each card to specific API request and response fields.

Cons

• Some test card lists sit behind an account login.
• Onboarding takes longer than a self-serve Stripe sandbox.

Use them when your stack is enterprise-grade and 3DS1 traffic still exists in production.

How to run a 3DS2 test from start to finish

1. Switch to test API keys and confirm the sandbox base URL.
2. Submit a card the vendor documents as challenge-required.
3. Complete the challenge once, then repeat it and abandon it, so you cover both branches.
4. Read the response fields: transStatus, ECI, and the authentication value.
5. Repeat with a frictionless card and compare the two payloads field by field.
6. Log both responses in your test report so a future regression is easy to spot.

Pitfalls to avoid

• Assuming a v7 label is universal. It is a vendor revision number.
• Testing only the success path. The U and N branches cause most production support tickets.
• Storing sandbox keys in shared configs that also hold live keys.
• Copying test BINs into a live terminal profile.