There is no official product called a Braintree test card v5. Braintree, the gateway now owned by PayPal, publishes a single free set of sandbox card numbers, and that set is not sold, licensed, or versioned. If a listing offers you a "v5 test card," a "test card list v5," or a CVV pack to go with it, the seller is either reselling documentation you can read at no cost or moving stolen card data. For legitimate work, pull the numbers from the official developer reference, use a future expiration date, and pair each number with the test CVV values documented alongside it. That is the whole toolkit.

more on this topic

Why the "v5" label should stop you

Payment sandboxes do not issue numbered generations of cards. Braintree updates its test values quietly when a processor changes behavior, and the reference page is the only source of truth. A vendor who invents a version number is trying to make a static public list look like a licensed product. The same pattern shows up in offers for "fresh CVV databases," which is a different and criminal business entirely. Real card numbers, including CVV and expiry, are sensitive authentication data. Buying, selling, or holding them outside a lawful processing role is fraud in every US jurisdiction, and the FTC has prosecuted these operations for years.

braintree test card v8

What you actually need for a sandbox transaction

• A sandbox-only card number. The commonly published examples include a Visa number starting 4012, a Mastercard starting 5555, an American Express starting 3782, and a Discover starting 6011. These are test values. They decline instantly in production.
• A future expiration date. Sandboxes validate the date format and reject anything already expired.
• A test CVV. Most card brands accept 123 in the sandbox; American Express uses four digits. Braintree also documents special values that force a CVV mismatch so you can exercise your decline path.
• A billing postal code. Address verification responses are triggered the same way, and you need at least one passing and one failing case.
• Sandbox API credentials. Test cards only work against the sandbox environment with sandbox keys.

Parameter bands worth verifying

Test suites usually break down into three bands. The success band covers a normal authorization, capture, and settlement flow. The decline band covers issuer and processor refusals, and Braintree simulates many of these through specific transaction amounts rather than card numbers, so your test plan should include both amount-driven and value-driven declines. The risk band covers CVV and postal code mismatches, plus 3D Secure and verification challenges. Build one automated case per band before you touch a live key.

more on this topic

Pitfalls that waste time or create liability

1. Treating test numbers as versioned and hunting for a newer release instead of reading the current reference.
2. Hardcoding test cards into code that also runs against production credentials.
3. Logging full card values or CVV in application logs, which violates PCI DSS rules on sensitive authentication data.
4. Paying a third party for a "test card list," a CVV set, or a validation service that only mirrors public documentation.
5. Assuming an amount that triggered a decline last year still triggers it today. Ranges get adjusted.

FAQ

Where do I get Braintree test cards?

From the official Braintree developer documentation. No account upgrade purchase or license is required, and the list is the same for every merchant.

Braintree Test Card V7: Sandbox Numbers That Work

Does a v5 test card exist?

No. The naming is invented by resellers. Version numbers on the API and SDKs exist, but the test card list does not carry them.

Can test card numbers ever charge a real account?

No. They resolve only inside the sandbox and fail authorization against live processors.

Is it legal to buy card data online?

No. Purchasing real card numbers, CVV values, or full card records is a federal offense, regardless of how the listing is worded.