You do not buy a Stripe CVV test card. Stripe publishes its test card numbers for free, and every one of them works only in test mode with a test API key. Type 4242 4242 4242 4242 into the card field, put any three digits in the CVC field, set any future expiry date, and the sandbox charge succeeds. If you came here looking for a store that sells CVVs for live cards, that is stolen payment data, not a product category, and no legitimate vendor sells it.

test cvv stripe

What a Stripe test card actually is

A test card is a card number that Stripe reserves for sandbox traffic. When your integration runs with a test publishable key and a test secret key, Stripe intercepts the number and simulates a response instead of contacting a card network. The same number sent with a live key is rejected, because no bank issued it.

related article

That means the card number itself is not the valuable part. The value is the mapping between a number and the response it triggers: an approval, a soft decline, a hard decline, or a specific verification outcome such as a CVC check failure.

stripe cvv validation

Test numbers worth having on hand

• 4242 4242 4242 4242: the standard Visa approval path, any CVC, any future expiry.
• 4000 0000 0000 0002: generic decline.
• 4000 0000 0000 9995: insufficient funds decline.
• 4000 0000 0000 0069: expired card decline.
• 3782 822463 10005: American Express, which uses a four digit CID instead of a three digit CVC.

Stripe also maintains numbers that force specific address and CVC verification results. Check the current test card documentation before you hardcode anything, because Stripe adds and retires cases over time.

stripe test cvv code

How the CVC field behaves in test mode

For the standard approval cards, the CVC value does not matter. Any three digits pass. That is convenient for smoke tests and useless for validating your own form logic, because a bug that accepts an empty CVC field will still produce a green charge in the sandbox.

To test the CVC path itself, you have two options. First, use a card whose simulated response is a CVC check failure and confirm your app surfaces that outcome correctly. Second, validate on your own side before the request ever reaches Stripe.

Client side checks that hold up

1. Accept 3 or 4 digits. Rejecting 4 digits breaks American Express.
2. Strip spaces and dashes before counting.
3. Do not run a Luhn check on the CVC. Luhn applies to the primary account number, not the verification value.
4. Keep the field numeric with an inputmode hint so mobile keypads open correctly.
5. Treat a missing CVC as a normal state for stored credentials and recurring charges.

Matching the test case to the code path

Pick numbers by the branch you want to exercise, not by brand preference. A generic decline proves your error handler runs without throwing. An insufficient funds decline proves you can show a retry prompt rather than a dead end. A CVC check failure proves you can ask the customer to re-enter the code without dropping the rest of the payment details.

Log the decline code your backend receives and assert on it. A test suite that only checks whether the charge object exists will pass while your checkout silently swallows the reason.

Pitfalls that cost real money

• Shipping test keys to production, or live keys to staging. Both directions cause confusing failures.
• Storing the CVC anywhere after authorization. PCI rules prohibit retaining it, encrypted or otherwise.
• Requiring a CVC on merchant initiated or recurring transactions, where no cardholder is present.
• Seeding your database with a test card number and then wondering why live charges decline.
• Assuming a CVC mismatch is the same thing as a decline. The issuer decides, and the response codes differ.

About buying CVVs

Card verification values are not sold as a product. The numbers circulating on forums are taken from breached accounts, and purchasing or reselling them is payment card fraud in every U.S. jurisdiction. There is no legitimate merchant, no support line, and no refund policy. If a site offers CVVs for sale, the realistic outcomes are a scam, a law enforcement honeypot, or both.

The only CVC values you should ever handle in a test environment are digits you invented or numbers Stripe published for sandbox use.

FAQ

Is 4242 4242 4242 4242 a real card?

No. It is a reserved test number. It will be declined on any live gateway.

What CVC do I use with a Stripe test card?

Any three digits work for the standard approval cards. The American Express test card expects four digits.

Can I test CVC rejection without a special card?

You can validate length and format in your own form. To confirm rejection handling at the gateway level, use one of Stripe's CVC failure test numbers from the current docs.

Where can I buy a CVV for testing?

Nowhere. Test values are free and published. Values tied to real accounts are stolen data and buying them is a crime.