Card test data v7 is a versioned collection of fake payment card records that a payment processor or testing tool releases for sandbox work. Each record pairs a card number with an expiration date, a security code, and a scripted outcome. The v7 tag marks the seventh revision of that collection.

card test data v6

Test records act like real cards inside a sandbox. A charge on a test number returns a coded answer: approved, declined, held for review, or pushed through a 3D Secure step. No money moves and no bank gets contacted.

Card Test Data v9: Request Declined

What does a test card record contain?

A record is a small structured row, not a live account. Most publishers keep the same fields across versions so test fixtures survive an upgrade.

Card Test Data V8: The Ultimate Guide to Where to Buy CVV

• Card number that passes the Luhn checksum
• Brand and card type (credit, debit, prepaid)
• Expiration date, often set several years ahead
• CVV or CVC value, sometimes any three digits works
• Cardholder name and billing country
• Expected response code
• Decline reason, such as insufficient funds or expired card
• 3D Secure behavior, when the processor supports it

Who publishes card test data?

Every large processor maintains its own sandbox card set. Stripe, Adyen, Braintree, Checkout.com, and Worldpay each publish numbers that map to their own result codes. A number that triggers "insufficient funds" at one gateway may return a plain approval at another.

card test data v1

The version label matters because these sets change. Processors add card brands, retire test numbers tied to past dates, and introduce codes for newer authentication flows. Pinning a version in your fixtures keeps results stable when the public set moves on.

How are test card numbers generated?

Publishers build test numbers from the Luhn algorithm, the same checksum that validates real card numbers. They pick a test BIN range, add digits at random, then solve for the final check digit.

That is why a test number passes format validation but fails at the issuer. No bank issued it, so no authorization request can settle against it. A dataset release may also include invalid numbers on purpose, so you can confirm that your form rejects bad input.

Common test scenarios and expected answers

Most datasets cover the same short list of outcomes. Map each record to a test case so failures point to a known cause.

• Approval: the charge succeeds and the order moves to paid
• Generic decline: the gateway returns a soft refusal
• Insufficient funds: a decline reason your UI should display
• Expired card: tests your date validation path
• Incorrect CVV: tests the security code check
• 3D Secure challenge: tests the redirect and callback flow
• Processing error: tests retry logic and error messaging

How do you use card test data v7 in a test suite?

1. Pull the dataset from your processor's test documentation.
2. Store each record as a fixture with a matching expected response.
3. Point the suite at the sandbox endpoint, never at a live endpoint.
4. Assert on the response code, the decline reason, and the order state.
5. Tag fixtures with the dataset version so failures name the right source.
6. Re-run the suite when the processor ships a new version.

Pin the version in source control rather than fetching records at runtime. A silent dataset update can turn a passing test into a false failure during a release window.

Can test card data be used on a live site?

No. Sandbox numbers are rejected in live mode, and repeated attempts can trip fraud rules on your own account. Keeping test keys and live keys in separate environments removes the risk.

Store test credentials outside the production codebase. A leaked sandbox key is harmless, but the same habits applied to live keys are not.

Is buying card data legal?

Card test data is free and legal. Numbers sold as "CVV," "fullz," or "dumps" come from real accounts and serve no testing role.

Trafficking in those credentials is a federal crime in the United States under 18 U.S.C. § 1029, and similar statutes apply in most countries. Possession can support charges when intent to defraud is shown.

An offer that advertises "card test data v7" with live balances is either a scam or a felony. Real test records never carry a balance.

Frequently asked questions

Do test card numbers expire?

Sandbox expiration dates are arbitrary and set far in the future, though a dataset release can swap them. Use the value in the record and update when the version changes.

Is card test data v7 the same at every processor?

No. The version number, card list, and result codes come from the publisher. Treat each processor's set as its own dataset with its own changelog.

Do I need a PCI review to use test data?

No, as long as the data is fake. PCI DSS applies to real cardholder data. Mixing real numbers into a test environment is a violation and a common audit finding.

What is the CVV in a test record?

It is a placeholder. Some gateways accept any three digits, while others require the exact value listed in the record.

How often does a test dataset get a new version?

There is no fixed schedule. Publishers revise when they add a card brand, retire a test BIN, or change how a decline is coded.