Core buying advice: you should not pay for a card number test. Every major payment processor publishes test card numbers in its public sandbox documentation, and those published numbers are the only ones a live gateway will accept while it runs in test mode. What is worth money is the tooling around the numbers: a sandbox account that can replay decline codes on demand, simulate 3-D Secure challenges, and log tokenized results for your QA team. If a seller offers numbers that look live, with matching CVV and expiry, treat that as fraud bait rather than a testing product.

What a card number test actually is

A test card number is a payment card number issued by a processor for sandbox use. It follows the same structure as a real number: an issuer prefix, an account field, and a check digit computed with the Luhn (modulus 10) formula. The difference is that the number is tied to a test merchant account, so an authorization request returns a scripted result instead of moving money. Developers use them to confirm that a checkout form, a subscription engine, or a refund flow behaves correctly before production traffic arrives.

What to look for before you pay for anything

• Scripted outcomes, not just approvals. The value of a test suite is the ability to force a specific response: insufficient funds, expired card, do not honor, pickup card, incorrect CVV. A vendor that only supplies an approval number gives you almost nothing.
• 3-D Secure simulation. You want test cases that trigger challenge flows, frictionless flows, and authentication failures, not just a success path.
• Token and vault coverage. Confirm the sandbox returns realistic tokens and that stored credentials can be reused the way production tokens are.
• Documented data handling. Any tool that stores test PANs should state retention limits and confirm that live card data never enters the test environment.
• Versioned documentation. Gateway APIs change. A test number list that has not been updated in a year will send you chasing phantom failures.

Parameter bands to check

• Length and prefix: test PANs run 13 to 19 digits, and the leading 6 to 8 digits form the issuer identification number. Match the prefix to the brand you intend to test.
• Check digit: every valid test PAN passes Luhn. Luhn catches all single-digit entry errors and most adjacent transpositions, but it does not prove the number is issued, so passing Luhn is a floor and never a guarantee.
• Expiry: published test cards usually carry dates years in the future. Reject any list with fixed dates that have already passed.
• CVV: three digits for most brands, four for American Express. Sandbox gateways normally accept any value, and good ones let you force a mismatch.
• Decline coverage: a useful set covers at least 10 distinct response codes plus one timeout and one network failure case.

Pitfalls that waste the most time

• Generating numbers with a Luhn calculator and expecting a gateway to accept them. The check digit passes; the authorization still fails.
• Using live card numbers in a development environment. PCI DSS requires that live primary account numbers are not used for testing or development.
• Buying a so-called BIN list. Issuer ranges are public reference data, and a paid list adds no testing value.
• Assuming a green test suite means production will work. AVS rules, velocity limits, and issuer fraud scoring only appear with real traffic.

FAQ

Can I just use a random number that passes Luhn?

No. The gateway validates the number against its test account configuration and returns a rejection for anything it did not issue.

Are published test card numbers legal to use?

Yes. They are inert numbers released by processors for integration testing and cannot be used to move funds.

Do I need a real card to start testing?

Usually not. Some processors ask for a real card during merchant account verification, which is a separate step from running sandbox transactions.

How many test cases should a suite include?

Enough to cover approval, soft decline, hard decline, 3-D Secure challenge, timeout, and refund for each card brand you accept. That is typically 25 to 40 scenarios.