What a CVV test environment is
A CVV test environment is a payment sandbox that accepts fake card numbers and fake CVV codes. It runs the same format checks as production. No issuer is contacted. No funds move. A version tag such as v1 identifies the sandbox API version, not the card or the CVV.
Standard test values
Most gateways publish a fixed table. Common entries:
- Visa: 4242 4242 4242 4242, CVV 123
- Mastercard: 5555 5555 5555 4444, CVV 123
- American Express: 3782 822463 10005, CID 1234 (4 digits)
- Decline case: 4000 0000 0000 0002
Expiry dates in test tables are set in the future. A CVV of 123 works for Visa, Mastercard, and Discover. Amex uses a 4 digit CID. Gateways differ, so read the test table for the API version you call.
What the sandbox checks
- Luhn checksum on the primary account number
- CVV length by brand: 3 digits for Visa, Mastercard, Discover; 4 for Amex
- Expiry date in the future
- BIN range mapped to a card brand
- CVV response code mapping, such as M, N, U, P, S
What is not simulated
Issuer risk scoring, network fraud rules, and live AVS databases are absent in most sandboxes. Some systems return a simulated CVV or AVS response only when you send a specific amount or ZIP code. 3-D Secure step-up is optional and often stubbed.
CVV Test Environment V7: Everything You Need to Know
Test data rules
Do not place a live card number in a sandbox. Test numbers are public, and storing them still falls under PCI DSS scope. Sandbox keys are separate from live keys. Keep both out of client code. Record the API version used for each test run so results stay repeatable.
Checklist before production
- Repeat each case against live keys with real cards.
- Confirm the CVV is not stored after authorization.
- Check tokenization covers recurring charges.
- Verify 3-D Secure flows end to end.
- Confirm the decline path returns the right error code.