CVV test cases check the card verification value field on a payment form. A tester enters set values and confirms three things: the field behavior, the validation message, and the processor response. Test data comes from a processor sandbox, not from a live account.

What the field accepts

Card brands differ. Visa, Mastercard, and Discover print a 3-digit code on the back. American Express prints a 4-digit code on the front. A form that reads the brand from the card number should accept both lengths.

  • 3 digits for Visa, Mastercard, Discover
  • 4 digits for American Express
  • Digits only. No letters, spaces, hyphens, or symbols

Core test cases

  1. Valid 3-digit value. Expect a pass and an authorization request.
  2. Valid 4-digit value on an American Express test card. Expect a pass.
  3. 4 digits on a Visa test card. Expect a length error.
  4. Empty field. Expect a required-field error.
  5. Two digits. Expect a length error.
  6. Five digits. Expect a length error.
  7. Letters, for example "abc". Expect a format error.
  8. Mixed input "12a". Expect a format error.
  9. Leading zero, for example "012". Expect a pass. The field holds a string, not a number.
  10. Value "000". Behavior depends on the processor. Record the response.
  11. Whitespace before or after digits. Confirm the form trims or rejects.
  12. Paste a 3-digit value. Confirm paste is allowed.
  13. Script payload in the field. Expect rejection with no server error.
  14. Autofill from a stored card. Confirm the code is never prefilled.

Processor responses

A sandbox authorization returns a code. Map each code to a test case: approval, code mismatch, expired card, insufficient funds, generic decline. A code mismatch returns an authorization decline. It does not return a form validation error. The form cannot verify the code. Only the issuer does that.

Data rules

Test cases use card numbers issued for testing. Never use a live card number in a test environment. PCI DSS classifies the card verification code as sensitive authentication data and prohibits storage after authorization. That rule changes test design. No test case may write the code to a log, a database column, or an analytics event. Inspect the logs and the network payload as part of the run.

What test cases cannot cover

No test case proves a card is valid or that funds exist. Code checks cover field format, data transport, and the issuer response. Case counts depend on the form. Record pass or fail for each case.