Short answer

There is no public API endpoint that validates a CVV by itself. No processor, issuer, or card network exposes a service that takes a three digit code and answers yes or no. Card verification happens inside a normal authorization request. Only in a sandbox, with published test card numbers, does an invented CVV return a useful result.

What people mean when they search this

Two groups land on this page. Developers wiring up a checkout form want a test card with a known CVV so they can run a fake payment end to end. Others want to know whether a card number and CVV pair pulled from somewhere is live. The first is ordinary integration work. The second is card testing, and in the US it falls under 18 U.S.C. § 1029. I only cover the first.

Where test CVVs actually come from

• Stripe documents numbers like 4242 4242 4242 4242, any future expiry, any three digit CVC. The sandbox accepts them because it never contacts an issuer.
• Adyen, Braintree, and Checkout.com publish their own lists with their own rules for what the CVC field will accept.
• The values are invented. They map to no real account, and they work only against test keys.

One habit worth keeping: check the provider's current doc page before you trust a number. These lists get edited, and a card that passed last year may return a decline today.

Why a standalone CVV check does not exist

The issuer generates the CVV and checks it during authorization. Visa and Mastercard rules forbid storing it after the transaction, and PCI DSS requirement 3.3.1 says the same. A service that kept CVVs on file to answer validity questions would be holding data nobody is allowed to retain. So the call you actually make is a payment intent or an authorization, not a CVV lookup.

If you are building the checkout

• Use sandbox keys, and use the provider's test decline amounts to exercise your error paths.
• Never write the CVC field to logs, analytics, or your own database.
• Let the processor tokenize the card so your servers see a token, not a PAN.

The fraud line

Running real card numbers against a live endpoint is what processors call card testing or enumeration. It looks like bursts of small authorizations, heavy decline rates, and many BIN attempts from one address block. Processors throttle it, merchants eat the dispute fees, and the people behind it get charged. Nothing about that path is a shortcut.