Test card number: answer first

A test card number is a card number that a payment processor publishes for sandbox use. The number passes the same format checks as a live card. It routes to a simulated authorization. No bank is contacted. No money moves. No cardholder exists.

Processors publish these numbers so developers can build checkout flows without touching real card data. Stripe, Adyen, PayPal, and Braintree each keep their own list.

Common test card numbers

• Visa: 4242 4242 4242 4242
• Visa debit: 4000 0566 5566 5556
• Mastercard: 5555 5555 5555 4444
• American Express: 3782 822463 10005
• Discover: 6011 1111 1111 1117
• JCB: 3566 0020 2036 0505
• UnionPay: 6200 0000 0000 0005

The first six digits are the issuer identification number. Each network keeps its own range. Stripe uses 4000 00 and 4242 42 ranges for Visa tests because those prefixes sit inside the real Visa IIN space.

Decline and error cards

Sandbox lists also carry cards that fail on purpose. These let a developer test an error state without editing code.

• 4000 0000 0000 0002: generic decline
• 4000 0000 0000 9995: insufficient funds
• 4000 0000 0000 0069: expired card
• 4000 0000 0000 0127: incorrect CVC
• 4000 0000 0000 0119: processing error

Response codes on these cards come from the processor's sandbox, not from a bank. The code names differ between processors. A decline code at Adyen may not match the same string at Stripe.

CVV, expiry, and postal code fields

A test card still has three fields to fill. Most processors accept any three digits for the CVC on an approval card, and 000 or 123 for a mismatch test. Expiry accepts any future date. Billing postal code accepts any five digits unless the test case keys on a specific value.

Some sandboxes require the CVV to match a fixed value, so check the processor page before debugging a failed charge.

Luhn check

Every published test number satisfies the Luhn algorithm, a mod-10 checksum defined in ISO/IEC 7812. A form that rejects 4242 4242 4242 4242 has a checksum bug, not a bad test number.

Sandbox keys and live mode

Test card numbers work only with test API keys. A live key with a test number returns a decline from the network. The two modes are separate at the API level, and the key prefix shows which one is active.

Rules on real card data

Live card numbers, CVVs, and cardholder names fall under PCI DSS. Test numbers exist so that staging environments hold no real account data. Buying, selling, or trading live card data is a federal crime in the US under 18 U.S.C. 1029, and a merchant account can be terminated for it. Card numbers found on carding forums are stolen, not test data, and using them carries the same charge.