Short answer

Stripe test cards return a set CVV result on demand. Card number 4000 0000 0000 0127 declines a payment with the code incorrect_cvc. Card number 4242 4242 4242 4242 passes the CVV check with any 3 digit code and any future expiry date. Test mode uses keys that start with pk_test_ and sk_test_. No test charge reaches a card network.

Stripe Test CVV Number: A Comprehensive Guide

The cvc_check field

A charge object in Stripe carries a field named cvc_check. It holds one of four values.

Buy CVV: A Guide to Test Stripe CVV

• pass: the code the customer entered matched the value held by the issuer.
• fail: the code did not match.
• unavailable: the issuer does not run the check for that card or that region.
• unchecked: the check was not requested.

Read this field after you create a PaymentIntent or a Charge. The decline reason sits in last_payment_error.decline_code, and incorrect_cvc is one of the values there.

more on this topic

Test cards that exercise the CVV path

• 4000 0000 0000 0127: decline, code incorrect_cvc.
• 4242 4242 4242 4242: approval, check returns pass with any 3 digit code.
• 3782 822463 10005: American Express approval. The CID is 4 digits, not 3.
• 4000 0025 0000 3155: approval that requires 3D Secure authentication before the CVV result.

Stripe changes its test card list over time. The testing page in the Stripe docs holds the current numbers and the decline each one produces. Some numbers that appear in blog posts and forum threads are stale and no longer map to the code they claim.

stripe cvv checker

Where the check runs

Stripe.js collects the card number, expiry, and CVV inside an iframe that your page does not touch. The value becomes a token or a PaymentMethod. Your server sees the token, not the code. The CVV check runs at authorization, so a bad code shows up as a decline on the charge, not as an error on the token. A test card with a wrong CVV length in a token request can still return a validation error from the Elements library.

Steps to run the test

1. Open the Stripe dashboard in test mode and copy the test secret key.
2. Create a PaymentIntent with amount 1000, currency usd, and payment_method_data card 4000 0000 0000 0127 with any future expiry and any 3 digit CVC.
3. Confirm the intent and read the response.
4. Check last_payment_error.decline_code for incorrect_cvc and retrieve the charge to read cvc_check.
5. Repeat with 4242 4242 4242 4242 and confirm cvc_check returns pass.

Rules that apply to CVV data

PCI DSS bars storage of the card verification value after authorization, in any form, even encrypted. That rule covers your own logs and support tickets. Stripe test data is exempt from scope concerns, since no real account sits behind it. Entering a live card number you do not own is a different matter. In the U.S., 18 U.S.C. 1029 covers trafficking in and use of unauthorized access devices, and a card number with its CVV falls in that class. Buyers and sellers of card data face federal charges, not just a declined test.