A PayPal sandbox CVV is a fake three or four digit security code attached to a test credit card inside PayPal's developer environment. Programmers use it to run checkout tests without touching a real card. The code works in sandbox mode only, and every live payment processor rejects it.

What is the PayPal sandbox?

The sandbox is a copy of the PayPal payments system built for testing. It mirrors the live API, the checkout flow, and the webhook responses, but no money moves. Accounts, balances, and cards inside it are fake by design.

Every developer account gets two sandbox identities: a personal buyer and a business seller. You sign in with those logins, add a test card, and run transactions against the test servers. Sandbox testing is free, separate from your live account, and you can wipe and rebuild it whenever you like.

• Test API endpoints and credentials
• Fake buyer and seller accounts
• Test card numbers with matching CVV and expiry values
• Simulated declines, refunds, and disputes

Where do sandbox CVV numbers come from?

PayPal publishes a short list of test card numbers in its developer documentation. Each entry carries a card number, a CVV, an expiry date, and a card brand. The CVV is a test value, not a code from any bank.

Because the list sits in public docs, the same numbers appear in tutorials, forum answers, and integration guides. They are open test fixtures, not secrets.

Are sandbox test cards sold anywhere?

No legitimate seller exists, because the numbers are free. Anyone charging money for a "PayPal sandbox CVV" is selling something you can copy from the documentation in under a minute.

Which test cards does PayPal publish?

The docs list test cards for Visa, Mastercard, American Express, Discover, and a few regional brands. Some entries are built to succeed, and others are built to fail on purpose so you can test decline paths.

• Cards that approve a charge
• Cards that force a specific decline reason
• Cards that trigger a processor error
• Cards used for 3D Secure flows

Each card pairs with one CVV and one expiry date. Mixing a CVV from one listing with a card number from another breaks the test.

Why a sandbox CVV fails on a live payment

Live payment systems run checks that test values cannot pass. The card number fails the Luhn algorithm or belongs to a reserved test range. Even when the number passes a format check, the issuing bank has no matching account, so the authorization dies.

• Luhn checksum and BIN range validation
• Issuer lookup against a real bank database
• 3D Secure and address verification tied to a real cardholder
• Fraud scoring on the device, IP, and billing address

That last point matters. A fake card on a live store trips a fraud review before the CVV check even runs.

How developers use test CVVs in a sandbox build

1. Create a PayPal developer account and open the dashboard.
2. Generate sandbox buyer and seller accounts.
3. Open the test card list in the docs and pick a card for the brand you want to test.
4. Add the card to the sandbox buyer account with the matching CVV and expiry.
5. Run the checkout flow against the sandbox API base URL.
6. Trigger declines on purpose to confirm your error handling works.

Test cards expire like real ones. When a sandbox card starts failing, swap in a fresh entry from the docs.

Sandbox CVV vs real CVV

• Sandbox CVV: public test value, no bank account behind it, works in test mode only.
• Real CVV: printed on a card, tied to an account, never shared with anyone.

Real CVVs are protected data under PCI DSS. Merchants may not store them after authorization, and selling them is a crime in every US state and most countries.

What about sites that sell CVVs?

Sites that advertise "CVV" for sale are trading stolen card data. The data comes from breaches, skimmers, and phishing kits, and using it is carding, which carries felony charges under 18 U.S.C. 1029 in the United States.

Most of those marketplaces are also scams. Buyers pay in crypto and receive dead numbers, recycled dumps, or nothing at all. There is no refund path and no way to complain without admitting to a crime.

If you spot charges you did not make on your own card, call your bank first, then file reports with the FTC and the FBI's IC3.

FAQ

Can I use a PayPal sandbox card on a real store?

No. Live gateways reject test card numbers at the authorization step.

Do PayPal sandbox test cards have real CVVs?

No. The CVV is a placeholder value published in the developer docs. It matches nothing at any bank.

Why does my sandbox test card get declined?

Common causes are an expired test card, a wrong CVV, a sandbox account set to the wrong country, or a card brand your merchant account does not accept. Check the error code in the API response.

Is it safe to share a sandbox CVV?

Yes, because it is public test data. The same is never true for a real card's CVV.

The short version

A PayPal sandbox CVV is test data for developers. It works in test mode, fails everywhere else, and costs nothing to pull from PayPal's own documentation. Any site that charges for one is either reselling public test values or selling stolen card data, and both are bad deals.