Short answer

Card test data v10 is a versioned set of sandbox payment credentials a development team keeps for testing checkout, refund, and subscription flows. The "v10" is a revision label, not an industry standard. Each processor publishes its own test card numbers, and most teams copy those into a numbered set they can diff between releases. Every number in that set is dead outside a sandbox. It cannot move real money.

read more

Where the numbers come from

Processors and card networks publish test PANs in their developer docs. Stripe lists 4242 4242 4242 4242 as the default success card, plus decline codes like 4000 0000 0000 0002 for a generic decline and 4000 0000 0000 9995 for insufficient funds. Visa and Mastercard maintain test BIN ranges for acquirer and merchant certification, and you will see 5555 5555 5555 4444 for Mastercard and 3782 822463 10005 for American Express in most sandbox environments. These are public numbers. Anyone can read them. That is the point.

card test data v9

Why version a test data set at all

Expiry dates roll forward, 3D Secure behavior changes, new card brands get added, and gateways retire numbers now and then. If you hardcode a card list in six places, you get six ways to break CI. A numbered set (v9, v10, v11) gives you one source of truth. A v10 set usually means someone fixed a specific failure: an expired test card, a new decline code, or a scheme change that made an old number stop returning the response you expected.

Request cannot be fulfilled

What belongs in the set

• At least one success card per brand you accept, with a fixed future expiry.
• Decline cases, named clearly: generic, insufficient funds, expired card, incorrect CVC.
• Cards that trigger 3DS challenge and 3DS frictionless paths.
• Refund and partial-capture cases, since those fail differently than auths.
• A note on which gateway version each number was verified against.

Pitfalls I see often

• Test PANs leaking into staging that talks to a live acquirer. That is a real incident waiting to happen.
• Using a name like "test test" when the gateway validates cardholder name against the issuer's response in sandbox mode.
• Assuming 4242 works everywhere. It does not. Each gateway has its own list, and some acquirers reject network-published numbers outright.
• Forgetting that CVC rules still apply. A random three digits usually passes in sandbox, but not always.

The line you do not cross

Sandbox numbers only work in sandbox. Taking a real card number, or a test number, into a live payment endpoint to see whether it authorizes is card testing, and it is a federal offense in the US under wire fraud and access device statutes. There is no "just checking" exemption, and processors flag the pattern fast because the request signature is obvious: many small auths, mismatched BINs, no follow-on purchase. If your goal is verifying that a gateway works, use the gateway's documented test data against its own test endpoint. That is what v10 is for.

related article