Card test case definition

A card test case is a scripted check of payment card data against validation rules and a sandbox processor. It uses fake numbers. It does not use live card data. It verifies format, checksum, expiry, CVV length, required fields, and processor response codes.

Minimum test set

  1. Valid sandbox card: Use the processor's published test number. Use a future expiry. Use a 3-digit CVV for Visa and Mastercard. Use a 4-digit CID for American Express. Expected result: approval in sandbox.
  2. Luhn fail: Change one digit in a sandbox number. Expected result: validation error. No authorization request.
  3. Expired card: Use a date before the current month. Expected result: validation error.
  4. Short CVV: Use 2 digits on a 3-digit CVV card. Expected result: validation error.
  5. Missing field: Remove cardholder name, expiry, or CVV. Expected result: required field error.
  6. Processor decline: Use the sandbox decline number from the processor. Expected result: decline code shown and order not marked paid.

Pass criteria

Each case needs a fixed input, a fixed expected response, and a stored result. The test passes when the form rejects bad data before the network call or when the sandbox returns the expected code. Logs must not contain full card numbers or CVVs. Use masked values such as last 4 digits.

Test data rules

  • Use sandbox credentials and published test cards.
  • Do not use real card numbers, real CVVs, or production endpoints.
  • Do not store CVV after authorization.
  • Run card validation tests on every change to checkout or payment forms.

QA case vs fraud card testing

A QA card test case uses controlled fake data. Card testing fraud sends many real card numbers to a live payment endpoint. The goal is to find valid accounts. Controls include rate limits, CAPTCHA, velocity checks, and processor fraud tools.