Razorpay does not run a real CVV check in test mode. A Razorpay credit card CVV validation test is a check of your own checkout flow: whether your page collects the CVV correctly, passes it to the payment request, and reacts the right way to the response that comes back. In live mode, the actual CVV comparison happens at the card network and the issuing bank, and Razorpay only relays the result. Razorpay never stores the CVV on its servers.

razorpay cvv check

What the test actually verifies

When developers search for a Razorpay credit card CVV validation test, they usually want to know one of three things: which test card values work, why a card is being declined for a CVV reason, or how to confirm their integration sends the field at all. Those are three different problems, and only the third one is something you can fully control in test mode.

razorpay cvv check

• Field handling. Your form accepts 3 digits for most cards and 4 digits for some card types, and only sends digits.
• Request shape. The CVV travels inside the payment request or the checkout token, not in a separate call your server logs.
• Response handling. Your code shows the right message for a declined CVV and lets the buyer retry with another card.
• No storage. Nothing in your database, logs, or analytics tooling keeps the CVV after the request finishes.

Test mode versus live mode

In test mode, Razorpay uses documented test card numbers rather than real accounts, so no bank is contacted and no issuer decision is returned. That means a test transaction can succeed even when the CVV you typed is not the one printed on the card, because there is no card and no printed CVV to compare against. Test mode is for building and wiring up your flow.

read more

In live mode, the CVV is captured in the checkout or a PCI-compliant tokenization flow, sent with the authorization request, and checked by the issuer. A mismatch comes back as a decline. Because the check belongs to the issuer, the same card and the same CVV can produce different outcomes depending on the cardholder's bank settings, the amount, and the merchant category.

more on this topic

Where the check happens

The CVV is a verification value, not an authentication credential for the account. It exists so a merchant can prove the person making the purchase is holding the physical card. The merchant never sees the stored value, the gateway does not keep it after authorization, and the comparison is made by the issuer. This is why you cannot query a CVV, look it up, or validate one in advance.

Errors you may see and what they mean

Declines tied to the CVV field usually fall into a small group: an invalid or missing verification value, a card that does not participate in verification, or an authentication step that failed before authorization. The exact codes and the wording shown to the buyer are listed in Razorpay's error reference and change from time to time, so read the response body your integration receives rather than matching on a hardcoded string. Build your retry logic on the error category, not on the message text.

Testing the failure paths

The useful part of a CVV validation test is the failure path, and test mode gives you a controlled way to reach it. Trigger a declined payment, an authentication challenge, and a timeout, and confirm each one lands on a screen that tells the buyer what to do next. Verify that a failed attempt does not clear the rest of the form, that the order status stays consistent, and that your logs record the outcome without recording the card data itself.

Do not break PCI rules while testing

CVV is sensitive authentication data under PCI DSS, and the standard prohibits storing it after authorization, even in encrypted form. That rule does not pause for a sandbox. Use Razorpay's hosted checkout or a tokenization product so the CVV goes from the buyer's browser to the gateway without passing through your servers, and keep it out of request logs, error trackers, and support tickets. In India, card storage rules add further limits on what a merchant may retain, so lean on tokens rather than raw card data.

A short test checklist

1. Confirm the CVV field accepts the right length for each card type and rejects non-digits.
2. Run a successful test payment and confirm the order and payment records match.
3. Run a declined test payment and confirm the buyer sees a clear, non-technical message.
4. Check your logs and database for any trace of the CVV after the request completes.
5. Repeat in live mode with a small real amount before scaling traffic.

The short version: a Razorpay credit card CVV validation test proves your integration handles the CVV field correctly. It cannot prove a CVV is genuine, because only the issuing bank can do that.