A test card is a card number that a payment processor publishes for use in its sandbox. It runs through the same checkout flow as a real card, returns approval or decline codes, and moves no money because test mode never reaches a bank network. Every major processor hands these numbers out for free in its developer docs.

Test card data has no value outside a sandbox. The numbers are public, they fail in live mode, and using a real card number that belongs to someone else is a federal crime in the US.

How do test cards work?

A test card pairs a reserved card number with any future expiry date and any three or four digit security code. The processor matches the number against a lookup table instead of contacting an issuer.

Each entry in that table maps to a result. One number returns a clean approval. Another triggers an insufficient funds decline. A third forces a 3D Secure challenge.

• Card number: a reserved test value from the processor's list.
• Expiry: any future date, such as 12/34.
• CVV or CVC: any digits, because no issuer validates it.
• ZIP or postal code: whatever value the test case expects.

Where do test card numbers come from?

Processors publish test cards in their API reference pages. Stripe, PayPal, Adyen, Square, and Authorize.net each keep a list of numbers tied to specific outcomes.

You need a developer account in test mode to use them. There is no approval step, no fee, and no card application to fill out.

Never invent a number and hope it works. Sandbox tables are fixed, and a made up number returns a generic error that tells you nothing about your code.

What can you test with a test card?

• Successful charges and the exact response fields they return.
• Declines for expired cards, stolen cards, and insufficient funds.
• 3D Secure and SCA authentication flows, including failed challenges.
• Refunds, partial refunds, and refunds on a settled charge.
• Disputes and chargebacks, where the processor provides a test path.
• Recurring billing, trials, and subscription upgrades.
• Webhook delivery, retries, and signature checks.
• Currency conversion and rounding on multi-currency accounts.

Cover the decline paths first. Most checkout bugs show up when a payment fails, not when it succeeds.

How do you run a test card through a checkout?

1. Create a sandbox or test mode account with the processor.
2. Grab the publishable and secret test keys, not the live keys.
3. Open the processor's test card list and pick a number for the outcome you want.
4. Submit the payment with any future expiry and any CVV.
5. Read the response object and confirm the status code matches the expected result.
6. Check your webhook log to confirm the event arrived and parsed.

Keep live keys out of test environments. A test card sent with a live key returns a decline, and a real card sent with a test key does nothing at all.

Test card vs real card

• Test card: public number, sandbox only, no issuer, no account holder, no money.
• Real card: issued by a bank, tied to a person, works in live mode, moves funds.

The two are not interchangeable in either direction. A test number will never clear a live charge, and a real card number in a sandbox throws an error.

Offers to sell card numbers, CVVs, or full card data are fraud offers. Those numbers belong to real people, and buying or using them carries prison time under 18 U.S.C. 1029. There is no legitimate market for them.

Other meanings of the term test card

Payment testing is not the only use of the phrase. The word shows up in broadcast, printing, and retail contexts as well.

• Television test card: a still image broadcast to calibrate color, focus, and geometry on a TV set. The BBC's Test Card F is the best known example.
• Print or packaging test card: a sample sheet that shows how ink, stock, and finish will look before a full print run.
• Retail or gift card test: a check of whether a stored-value card activates, loads, or reads at a terminal.

Frequently asked questions

Are test card numbers real?

No. They are reserved strings that processors set aside for sandbox traffic. No bank issued them and no account stands behind them.

Do test cards work in live mode?

No. Live mode rejects them at the gateway. That separation is the point, since it keeps test traffic out of real settlement.

Can you buy a test card?

No reason to. Processors give them away with a free developer account, and any site charging for them is selling you public information. Sites that sell CVV data are selling stolen card records, which is a different and illegal product.

Which test card should you pick?

Start with the basic approval number your processor lists, confirm the happy path, then work through one decline case at a time. Match each number to the specific behavior your code needs to handle.

How do you test a card without a processor account?

You cannot run a real authorization without a gateway. For pure UI work, hardcode a mock response object and skip the network call.