What negative test cases for CVV actually test

Negative test cases for CVV check that your payment form rejects invalid security codes. You are not testing if a real CVV works. You are testing the validation rules. The goal is simple: only a correctly formatted CVV should pass. Everything else should fail with a clear error.

how to write cvv test cases

Core CVV validation rules

Before you write test cases, know the rules. Visa, Mastercard, and Discover use a 3-digit CVV. American Express uses a 4-digit CID. The field must accept digits only. No letters, no spaces, no symbols. The CVV is never stored after authorization. That last rule matters for your tests because you should not see CVV in logs or database dumps.

cvv input validation test cases

Negative test cases to run

I keep a list like this for every payment form. Run each one on the UI and the API.

related article

• Empty CVV field.
• Two digits (e.g., "12").
• Five digits (e.g., "12345").
• Letters only (e.g., "abc").
• Alphanumeric (e.g., "12a").
• Special characters (e.g., "!@#").
• Spaces inside the number (e.g., "1 23").
• Leading space (e.g., " 123").
• Trailing space (e.g., "123 ").
• Negative number (e.g., "-123").
• Decimal number (e.g., "12.3").
• SQL injection string (e.g., "' OR '1'='1").
• Cross-site scripting string (e.g., "").
• Unicode digits (e.g., "１２３").
• All zeros (e.g., "000").
• Repeated digit (e.g., "111").
• Newline character (e.g., "12\n3").
• Very long string (e.g., 100 digits).
• Null value in API request.
• Missing CVV field in API request.

How to structure your tests

Use boundary value analysis. Test 2, 3, 4, and 5 digits. For Amex, test 3, 4, and 5. Use equivalence partitioning. One valid case, many invalid cases. Always test both client-side and server-side validation. Client-side validation can be bypassed. Server-side validation is the real gate.

related article

What a passing negative test looks like

When your test sends bad input, the system should reject it. A good rejection has three traits. First, the error message says what is wrong without revealing internal details. Second, the response is a 4xx status code, not a 500. Third, the bad CVV does not appear in logs or error messages. If any of these fail, you have a bug.

Common mistakes

I see testers forget the 4-digit Amex case. I see them test only the UI and skip the API. I see them assume that spaces are trimmed when they are not. I also see them test with a real CVV and call it a negative test. That is not negative testing. That is a valid transaction. Keep your negative tests fake and wrong.

Final note

CVV negative tests are cheap to write and catch real problems. A form that accepts "abc" as a CVV will fail an audit. A form that leaks the CVV in a log will fail PCI. Write the cases, run them, and fix what breaks.