Answer

A CVV test in a payment gateway sandbox accepts any 3-digit value. American Express test cards accept 4 digits. Test card numbers published by processors never reach a card issuer, so no funds move and no real card is checked. The gateway returns a simulated authorization response.

related article

Test CVV values

• Visa, Mastercard, Discover: any 3 digits, such as 123, 000, or 999.
• American Express: any 4 digits, such as 1234.
• Stripe: card 4242 4242 4242 4242, any future expiry date, any CVC.
• Stripe decline case: card 4000 0000 0000 0127 returns an incorrect CVC error.
• Adyen and Braintree: the CVC field on a test card accepts any 3 or 4 digit string.

What a sandbox does not test

CVV is a 3 or 4 digit code. Visa calls it CVV2, Mastercard calls it CVC2, American Express calls it CID. The code is printed on the card and is not part of the card number. The card number carries a Luhn check digit. The CVV does not.

read more

A sandbox has no issuer host, no card network, and no cardholder account. It matches the submitted card number against a test list and returns a result your code defines. A passing sandbox test confirms that your form collects 3 or 4 digits and that your integration reads the gateway response. It confirms nothing about fraud screening or issuer behavior.

Checkout Card Verification Guide: How to Buy CVV

CVV response codes in production

In production the gateway passes the CVV value to the issuer inside the authorization request. The issuer returns a single-letter result code.

how to test cvv checkout

• M: CVV matches.
• N: CVV does not match.
• P: CVV not processed.
• U: issuer unable to process the check.
• S: issuer does not support the check.

Codes P, U, and S are common outside the US and on some card types. A gateway configured to decline on N will still approve those three codes unless you change the rule.

PCI DSS rules on CVV

PCI DSS Requirement 3.2 forbids storage of sensitive authentication data after authorization. CVV counts as sensitive authentication data. Gateways may hold the value during the authorization request and must delete it after the response. Logs that capture the CVV field fail an assessment.

Common test setups

• Stripe: test mode keys, published test cards, simulated decline codes.
• Adyen: test merchant account and test card list.
• Braintree: sandbox account with test numbers per card brand.
• Authorize.net: sandbox account with test card numbers.

Each provider publishes its own test card list and its own rules for the CVV field. Use the list from the provider you integrate.