Card test data is a set of fake payment credentials that a payment processor publishes so developers can run transactions in a sandbox without using a real card number. It usually includes a test primary account number (PAN), an expiration date, a security code, and sometimes a zip code or cardholder name. Nothing in a test data set belongs to a real person, and nothing in it can be charged.

related article

What card test data contains

A typical test data set mirrors the fields a checkout form collects, but every value is a placeholder. Because the goal is to exercise validation logic, the numbers are built to pass the same format checks a live card would pass.

Card Test Data v9: Request Declined

• Test PAN: a 16-digit number assigned to a test BIN range that the processor reserves for sandbox use.
• Expiration date: often a fixed future date, so the test never expires mid-project.
• CVV or CVC: a dummy three or four digit value used to test the security code field.
• Postal code and name: placeholder values for address verification system (AVS) checks.

Why test numbers pass the Luhn check

Most gateways run the Luhn algorithm before they send a request anywhere. That algorithm catches transposed digits and typos in a real card number. Test PANs are chosen so they satisfy Luhn, which means your form validation behaves the same way it would with a live card. Some processors also publish numbers that deliberately fail, so you can confirm your error handling works.

card test data v4

Test data versus live card data

The difference is authorization. A test PAN routes to a simulated environment. The processor returns a canned response, such as an approval, a decline, an insufficient funds code, or a 3D Secure challenge. No bank is contacted, no money moves, and no cardholder statement is generated. Live card numbers route to an issuing bank and produce a real authorization hold.

Request cannot be fulfilled

How developers get test card data

Processors publish their sandbox numbers in their own developer documentation, and that is the only source you should use. Stripe, Adyen, PayPal, and similar providers list test cards alongside their test API keys. If you build your own simulator, you generate random numbers inside a reserved test range instead of copying numbers from anywhere else.

Common mistakes to avoid

• Using test API keys with live card numbers, or live keys with test numbers. Both fail, and one can trigger a fraud alert.
• Hardcoding a test PAN into production code and shipping it.
• Assuming a decline on a test card means your integration is broken. Check which response code you asked for.
• Pasting real card data into a shared spreadsheet or ticket when a sandbox value would work.

A legal note

Test card data exists to make payment software safer. Real card numbers, including those sold as CVV or fullz, are not test data, and buying, selling, or using them without authorization is a crime in the United States and most other countries. If a source asks you to pay for card numbers, that source is not a payment processor and the numbers are not test data.