Card test data v1 is a versioned set of fake card numbers, expiry dates, CVV values, and expected gateway responses that developers use to test payment flows in a sandbox. The numbers belong to no account and cannot be charged. The v1 label exists so a team can pin a test suite to one known data set and change it on purpose instead of by accident.

card test data v4

What goes into a card test data set

A useful set covers every field a real checkout sends, plus the result the gateway should return for each entry.

card test data v4

• Card numbers from the gateway's public test ranges, including 15, 16, and 19 digit lengths
• Expiry values: valid future dates, plus past dates that must trigger an expiry error
• CVV and CVC values, including one entry with a wrong code
• Billing addresses for AVS checks: full match, street-only match, ZIP-only match, no match
• Expected outcome: approval, soft decline, hard decline, or a named error code
• 3-D Secure results: authenticated, attempted, and rejected

Why version card test data at all?

Gateways add decline codes and retire test ranges. If your suite reads the provider's page live, it starts failing for reasons that have nothing to do with your code. A frozen v1 file plus a quarterly check of the provider's release notes keeps the signal clean.

Card Test Data V8: The Ultimate Guide to Where to Buy CVV

Treat v1 as locked. Write a changelog line for each new file, note which gateway API version it matches, and cut v2 only when the provider changes the list and your assertions must follow.

card test data v6

How to structure the v1 file

Use JSON or CSV with one row per scenario, not one row per card number. A scenario ties an input to the outcome you assert.

Fields for a single row: scenario_id, card_number, exp_month, exp_year, cvv, avs_street, avs_zip, expected_status, expected_code, notes. Commit the file next to the tests that read it.

Naming carries more weight than format. Call each entry after the behavior it proves, such as decline_expired_card_v1, so a red test tells you what broke without opening the file.

How to run tests with card test data v1

1. Copy your provider's published test values into the repo as v1.
2. Map each value to the status and error code you expect.
3. Write one test per scenario, including the failures.
4. Point the suite at the sandbox endpoint and confirm every assertion passes.
5. Re-read the provider's test card page each quarter and log any change.
6. Cut v2 when a value or code shifts, and keep v1 until the suite migrates.

Sandbox behavior is not production behavior

A sandbox approves or declines based on the values you sent, not on a real issuer's rules. Production adds issuer risk checks, network timeouts, and partial captures that test data never exercises. Use test data to prove your code reads responses, then test real flows with your own card and a tiny live charge.

Tokenization also shifts the shape of the data. If you store tokens, your test set needs a token per scenario plus the card fields behind it, because the token is what your server sees.

Test card data versus real card data

Test numbers come from public sandbox documentation. Real card numbers, real CVVs, and real cardholder names come from people, and using them without permission is card fraud under federal law and in every US state.

Buying card data that belongs to someone else is a crime, not a shortcut around a failing test. A merchant can only charge a real card with the holder's authorization, and no sandbox result changes that.

Keep the two apart in your tooling. Run PAN-detection scans on repos to catch a real number pasted by mistake, and never load test entries into a live gateway configuration.

Mistakes that slow teams down

• Asserting on a decline message string instead of the error code
• Reusing one card number for every scenario, which hides AVS and 3-D Secure paths
• Letting the provider's list update in place so yesterday's green build turns red
• Storing test values in the same file as live API keys
• Skipping past-expiry and wrong-CVV cases until a customer finds them
• Assuming a sandbox approval means the integration is production ready

Frequently asked questions

Are card test numbers real?

No. They sit in ranges reserved for testing and live networks reject them. A test approval means your integration handles the response, nothing more.

Does the CVV on a test card matter?

Yes, for the test. Sandbox gateways compare the value against a published list and return the CVV result you asked for. Some entries are built to fail on purpose.

Where do I get card test data v1?

From the payment provider whose API you call. Stripe, PayPal, Adyen, and most other processors publish a test card page in their developer docs. The data is free, because the numbers have no value.

Can a test card be charged?

No. The authorization is simulated. If a charge looks like it succeeded, you are pointed at a sandbox, not a live account.

Should test card data live in a public repo?

It can, since the values are public. Strip any live keys, tokens, or merchant IDs before you push.

How often should test data be refreshed?

Check the provider's docs each quarter, and after any major API upgrade. Refresh the file only when something changed, and bump the version label when you do.