A CVV test entry page is a payment form that runs in a processor sandbox and accepts fake card numbers, so developers can check how their checkout reads and validates the card verification value. It uses published test cards, not live accounts. Nothing on the page touches a real customer's card data.
What a CVV Test Entry Page Does
The page mimics the card fields of a live checkout: card number, expiry, and the 3 or 4 digit security code. You type a test number, submit, and read the response. That response tells you whether your code handles the security code field the way your processor expects.
- Accepts sandbox card numbers from your payment provider.
- Returns a simulated approval, decline, or CVC mismatch.
- Shows the request payload so you can confirm what your server sent.
Sandbox page vs live page
A sandbox page talks to a test endpoint with test API keys. A live page talks to the real authorization network and moves real money. Keep the two apart: test keys in test code, live keys on the server, never in a browser.
How to Build a CVV Test Entry Page
You do not need a merchant account to build one. You need a sandbox from a payment processor and a form.
- Create a sandbox account with a processor that publishes test cards. Stripe, Adyen, Braintree, and Authorize.Net all do.
- Collect a test API key and keep it server side.
- Build the card form with a number field, an expiry field, and a CVV field of the correct length.
- Tokenize the card data in the browser or send it to your server, based on the processor's flow.
- Submit the form and log the response code, the decline reason, and the raw request.
- Repeat with cards that trigger specific outcomes, such as a bad CVC, an expired card, and a stolen card flag.
Test Card Numbers and Their CVV Values
Processors publish test cards that pair with any valid security code or with codes that force a failure. These numbers pass the Luhn check but belong to no account.
- 4242 4242 4242 4242 (Visa): any 3 digit CVC, any future expiry date.
- 4000 0000 0000 0002: generic decline, useful for testing failure paths.
- 4000 0000 0000 0127: returns an incorrect CVC decline.
Card sets differ by processor and region. Pull the list from your provider's docs, because old test numbers get retired.
CVV Rules Your Test Page Should Enforce
Format rules by brand
- Visa, Mastercard, and Discover use 3 digits printed on the back of the card.
- American Express uses 4 digits printed on the front.
- The field should reject letters, spaces, and lengths outside the brand rule.
Handling rules
- Mask the input and never write the code to a log file.
- Send the code to the processor over TLS and drop it after the response.
- Treat a CVC mismatch as a decline, not as a form error.
Why Buying or Testing Live CVVs Is Illegal
A CVV that belongs to someone else's card is not a test value. Buying card data, selling it, or running it through a checkout to see which numbers work is card fraud, and the "test" framing does not change that. In the United States, 18 U.S.C. ยง 1029 covers trafficking in and use of unauthorized access devices.
PCI DSS Requirement 3.2 bars merchants from storing sensitive authentication data, which includes the CVV, after a transaction authorizes. A page that keeps live codes puts a business outside its contract with the card networks and exposes it to fines.
- Store test data in an environment separate from production.
- Block live card numbers from sandbox forms with a validation rule if you can.
- Report suspected card fraud to your processor and to the FTC.
Before You Point the Page at Production
- Swap test keys for live keys on the server, never in client code.
- Confirm the CVV field is not saved in your database, error tracker, or analytics tool.
- Run one live transaction with your own card and check the statement descriptor.
- Add a regression test that submits a bad CVC and expects a decline.
FAQ
Can a CVV test entry page accept a real card?
It can if you build it that way, and that is the problem. Sandbox endpoints reject live card numbers, so a form pointed at a test key will fail on a real card. Keep it that way on purpose.
Do test card numbers work in live mode?
No. Test numbers fail authorization in live mode because no bank issued them. If a test card approves in live mode, your integration is pointed at the wrong endpoint.
Why does the sandbox reject my CVV?
Common causes are a field length that does not match the brand, a test card paired with a forced CVC failure, and whitespace copied into the input. Check the processor's decline code before you change your form logic.