Card test data v10 is a versioned collection of dummy card numbers, expiry dates, and expected response codes that developers use to verify payment flows in a sandbox. Every value in the set is fake, so no real account is charged and no customer data is involved. If you are integrating a payment gateway, this is the material you test with, never live card numbers.
What the v10 label means
Payment platforms refresh their test fixtures as APIs change. A version tag such as v10 simply marks the tenth published revision of a fixture set. Numbering lets a team pin a known dataset to a specific release, so a test that passed last quarter still behaves the same way after an API update. When a processor announces a new version, the practical changes are usually new decline scenarios, updated 3-D Secure simulation flags, or retired numbers that no longer trigger the response you expect.
What a test card data set includes
- Primary account numbers reserved for testing, often paired with a card brand and country.
- Expiry dates and security codes that only work inside the sandbox.
- Expected outcomes per number, such as approval, insufficient funds, expired card, or authentication required.
- Token samples for recurring billing and stored credential tests.
- Documentation covering currency behavior, regional rules, and error codes.
How to use card test data v10 in a sandbox
- Confirm your application points at the test environment, not the production endpoint.
- Load the fixture set that matches your API version.
- Run each scenario and compare the gateway response against the documented expectation.
- Record results with the version tag so a later regression is easy to trace.
- Repeat the suite after every gateway upgrade.
Why testing live card numbers is a crime
Running small charges against real card numbers to find which ones still work is card testing, and it is fraud in every U.S. jurisdiction. It also breaks card network rules and the PCI DSS requirements that govern how cardholder data is stored and transmitted. Merchants who allow it on their systems risk fines, loss of the ability to accept cards, and criminal liability. There is no legitimate reason to validate a card number you do not own, and offers to sell live card data belong in a report to law enforcement, not in a shopping cart.
Card Test Data V7: A Comprehensive Guide to Where to Buy CVV
Keeping test and production data apart
- Use separate API keys for sandbox and live modes, and store them in different secrets managers.
- Never copy production numbers into a staging database, even briefly.
- Limit live credentials to the smallest possible group of engineers.
- Mask or drop any card field that would otherwise land in application logs.
- Review access lists whenever someone leaves the team.
Common mistakes
Two problems show up again and again. The first is testing only the happy path, which leaves decline handling, timeouts, and duplicate charge protection unverified until a real customer hits them. The second is hardcoding a single test number into the checkout form during development and shipping it, which produces confusing behavior in production. A proper suite walks every documented outcome in the fixture set and asserts on the response code, not just on the absence of an error.
Where official test data comes from
Payment processors and acquirers publish their own sandbox numbers and expected outcomes in developer documentation. Those pages are the authoritative source, they are free to use, and they are updated when the API changes. Third party lists copied from forums go stale quickly and often mix in real numbers, which is a compliance problem waiting to happen.