Razorpay test mode does not check a CVV against a live card issuer. When you pay with one of Razorpay's documented test cards, the gateway accepts any three digit CVV, so the digits you type in a sandbox checkout usually do not change the result. That is the short answer. The rest of this guide covers what that behavior means for your integration, how to force a CVV failure when you need to exercise error handling, and why test credentials are the only card values that belong in a checkout form.

Razorpay CVV Test API: A Comprehensive Guide

What developers mean by "Razorpay CVV test"

The phrase gets used for three different tasks, and mixing them up causes most of the confusion.

related article

• Confirming that your checkout form collects and validates a three or four digit CVV before it submits to the gateway.
• Checking that your backend passes the CVV parameter in the payment request and does not log or store it afterward.
• Simulating a decline so your UI can show a readable failure message instead of a blank screen.

Only the third task depends on the gateway returning a CVV related error. The first two are entirely under your control.

more on this topic

How Razorpay handles the CVV field in test mode

Test mode is a simulation layer. No authorization request reaches a card network, so there is no issuer to verify a CVV or a billing address. Razorpay documents test card numbers for its standard flow, and those numbers are paired with a future expiry date and an arbitrary CVV. Enter 123, 456, or any other three digits and the test payment behaves the same way.

Razorpay CVV Test Tool

That is deliberate. The CVV exists to prove the payer holds the physical card, and a sandbox has no card to hold. Treat the field as a format check in test mode, not a security check.

Test card values to use

• Card number: use a number from the test card list inside your Razorpay dashboard. The Visa test number 4111 1111 1111 1111 is widely used across gateways and appears in Razorpay's list.
• Expiry: any date in the future.
• CVV: any three digits. The dashboard list, not a blog post, is the authoritative source when your account is set up.
• Name and address: anything, since test mode does not run address verification.

Forcing a CVV decline on purpose

If you need to see how your application reacts to a failed CVV check, do not hunt for a magic card number. Simulate the failure at the layer you control:

1. Return a synthetic error from your own payment wrapper in a staging build, then confirm the checkout screen renders the message.
2. Send a malformed CVV, such as two digits, and verify that client side validation catches it before any network call.
3. Test the empty field case, the paste case, and the autofill case, since these are the paths that break in production.

Testing approaches compared

Razorpay test mode

• Pros: real request and response shapes, real webhook payloads, no card data involved, safe to run in CI against a staging key.
• Cons: cannot reproduce issuer declines, 3D Secure challenges, or risk rules, because those layers are absent.

A local mock gateway

• Pros: instant, deterministic, and easy to script for edge cases such as timeouts and duplicate submissions.
• Cons: drifts from the real API over time, and it will not catch integration mistakes in your request payload.

Recommended use: build the happy path and error branches against a mock, then run a small set of end to end checks against Razorpay test mode before release.

What test mode cannot verify

Sandbox results tell you nothing about how a real issuer responds. Live CVV verification, address verification, 3D Secure step up, and network level fraud scoring all happen outside the test environment. Your production error handling should assume any of them can fire, including declines that arrive after your UI already showed a success state.

Buying live CVVs is not a testing shortcut

Card verification values are not sold legitimately. Purchasing or reselling card data is a criminal offense in the United States and most other jurisdictions, and the numbers are typically stolen, expired, or already blocked. They also fail the only test that matters to a developer: they reproduce nothing that Razorpay test cards cannot reproduce, and they put your account, your keys, and your users at risk. If you need a payment flow verified, the sandbox and a mock are the tools.