In the 2Checkout sandbox, now operated by Verifone, a 2Checkout test CVV is a fake three or four digit security code that you pair with a test card number to simulate a card payment. It is not tied to any real bank account, and it only works while your account is in test mode. The approved values come from Verifone's official developer documentation, not from guesswork.
What a test CVV is
The CVV, or card verification value, is the short code printed on a payment card. In live mode the gateway passes that code to the card issuer to confirm the buyer is holding the physical card. In test mode there is no issuer and no cardholder. The gateway instead compares the number you enter against a list of accepted test values, which is why a random code can fail while a documented one always passes.
- Three digits on most card brands.
- Four digits on American Express test cards.
- Always used together with a test card number from the same source.
Why sandbox testing uses fake CVV codes
Developers need to exercise every branch of a checkout flow without touching real money or real cardholder data. Test CVV values make that possible.
- No genuine cardholder information enters your system.
- You can repeat the same transaction as often as needed.
- You can trigger specific outcomes, including approvals and declines.
- You keep your integration work inside PCI DSS scope limits.
Where to find the official test card list
Verifone publishes sandbox credentials inside its developer portal. The list changes from time to time, so pull the current table rather than copying values from an old blog post. Look for a page titled something like test card numbers or sandbox test data. Each row normally gives a card number, an expiry date, a CVV, and the response the gateway should return.
How to run a test transaction
- Switch your 2Checkout account to test or sandbox mode.
- Open the official test card table in the developer portal.
- Copy the card number, expiry, and test CVV as a single set.
- Submit a small order and confirm the response code in your logs.
- Repeat with a card that is designed to decline.
Common test CVV errors
- CVV mismatch or invalid security code: the value you entered is not on the accepted list for that test card.
- Address verification failure: the billing address does not match the test profile you selected.
- Unexpected decline: some test cards are built to decline on purpose so you can test error handling.
- Live mode rejection: test values only work in sandbox mode.
Test CVVs and real card data
A test CVV has one purpose: development and quality assurance. It cannot authorize a live charge, and it cannot verify a real card. Real verification values are sensitive authentication data under PCI DSS, and merchants are not permitted to store them after an authorization attempt. Buying, selling, or using another person's card details is card fraud and is a criminal offense in the United States and most other countries.
Sandbox testing checklist
- Confirm test mode is switched on before you start.
- Use card number, expiry, and CVV from the same official row.
- Test at least one approval and one decline path.
- Log the gateway response code for each attempt.
- Clear test card data from your database before you go live.