Test card data v5 is a versioned bundle of fake card numbers that a payment processor publishes for sandbox use. The "v5" is a label, not an industry standard. Every processor numbers its own revisions, so a v5 list from one vendor tells you nothing about the v5 list at another. What matters is which processor you integrate with and which scenario you need to reproduce: an approval, a soft decline, a hard decline, a 3D Secure challenge, or a refund.

Card Test Data V10: Guide on Where to Buy CVV

What actually lives in a test card set

• PANs that pass the Luhn check but were never issued to anyone
• Expiry dates far enough out that your test suite will not break next quarter
• CVV values tied to specific results, where the processor supports CVV simulation
• Billing addresses and postal codes that trip AVS rules on purpose
• A decline code mapped to each number, so you can test the failure branch

A good set covers multiple card brands and both credit and debit ranges. If yours only has Visa and Mastercard, you are not testing your brand routing logic at all.

read more

How the versioning works

Processors revise test data when they add brands, retire old BIN ranges, or change which number triggers which decline code. When a test that passed last month starts failing, read the changelog before you touch your code. Pin the version you test against in your repo the same way you pin an SDK version, and note in the commit message why you moved.

card test data v9

Why real numbers are the wrong tool

Running live card data through a test environment violates PCI DSS scope rules, and buying card numbers from a reseller is a federal crime under 18 U.S.C. 1029. Beyond the legal exposure, the data is useless for testing. Live PANs authorize against real issuer systems, so results are not reproducible and you cannot force a decline on demand. Test values exist so that every outcome is deterministic.

more on this topic

Building a test matrix that holds up

Start from outcomes, not from numbers. List every result your integration can surface, then map one test card to each. Cover the frictionless 3DS path and the challenge path separately, since they fail in different places. Add idempotency keys to a repeat-charge case, then a refund and a void. Run the same matrix in every environment you deploy to, because sandbox and staging often point at different processor accounts.

Mistakes I see most often

• Hardcoding an expiry date that quietly ages out of the sandbox
• Using a decline number in a happy path test and blaming the gateway
• Assuming sandbox CVV and AVS rules match production rules
• Skipping timeout and network error cases because the sandbox always answers
• Pulling a list from a random forum instead of the processor's own docs

Where to get an authoritative list

Go to the documentation of the processor you actually use. Stripe, Adyen, Braintree, and PayPal all publish test card data with the outcome each number produces. Keep a local copy pinned to a version, refresh it on a schedule, and throw away any third-party mirror. Mirrors go stale fast, and some circulate numbers that look real. That is the opposite of what you want in a test suite.