In the PayPal Sandbox, the CVV field does not check a real security code. Enter any 3 digits, or 4 digits for American Express. The sandbox accepts the value and moves to the next step of test checkout. No bank, cardholder, or live account is involved.
What the PayPal Sandbox Is
The sandbox is a copy of the PayPal checkout that runs on test data. PayPal gives each developer a business account and a personal account for testing. Money moves between those two accounts. No card network is contacted. Card payments in the sandbox run through a simulator, so every response comes from PayPal rules, not from an issuer.
What the CVV Field Does
In production, the CVV is a 3 or 4 digit code printed on the card. The issuer checks it during authorization. In the sandbox, the field exists because the checkout form must match the production layout. The simulator records the digits and returns a result. Enter 123 for Visa, Mastercard, or Discover. Enter 1234 for American Express. Other 3 digit strings pass in most tests.
Some testers use the last 3 digits of the sandbox card number. That passes too.
Test Card Numbers Used With the CVV
- Visa: 4111111111111111
- Mastercard: 5555555555554444
- American Express: 378282246310005
- Discover: 6011111111111117
- Diners Club: 30569309025904
These numbers are published for testing and cannot be charged. Expiration date: use any month and year in the future. Name and billing address: use the values stored on the sandbox account, or a valid US ZIP code such as 95131.
Values That Fail
PayPal publishes negative testing values for the REST API. A negative test forces a set decline, such as CVV failure or address mismatch. The value goes in a header or a field, not in the card number. The list changes. Check the current PayPal developer documentation for the table that applies to your integration.
Sandbox Limits
The sandbox does not verify that a card exists. It does not check the CVV against an issuer. It does not settle funds. A sandbox CVV result tells you one thing: how your code handles a response. It says nothing about a live card.
Legal Note
Real card numbers and their CVV codes are not test data. Buying, selling, or using them without authorization is a federal crime in the United States under 18 U.S.C. section 1029. Sandbox values carry no such risk because no account backs them.