Your top pick for a Stripe CVV test is 4242 4242 4242 4242 with any three digits in the CVC box and any future expiry date. Stripe ships it as the default Visa test number, it approves on every attempt in test mode, and it confirms that your form collects a CVC and passes it to the API. The criteria for choosing a different number are narrow: the response you need to reproduce, the card brand your UI has to render, and whether your code reads the cvc_check field on the returned charge. Everything below is sandbox data. It moves no money and none of it works against a live key.

stripe test card cvv verification system

The default pass card: 4242 4242 4242 4242

Reach for this number when the only thing you need is a successful charge. The CVC field takes 123, 456, 999, or any other three digits, and the postal code field accepts anything too.

Stripe Card CVV Test Tool: How to Evaluate One Before You Commit

  • Pros: approves on every attempt in test mode, with any three-digit CVC and any future expiry.
  • Pros: supports address verification tests in the same pass, so you do not need a second card.
  • Pros: it is the number Stripe uses in its own samples, so teammates recognize it without a lookup.
  • Cons: it never exercises your CVC failure path, so decline handling stays untested.
  • Cons: it is a Visa, so Mastercard, Amex, and Discover logos will not appear in your UI during this test.

Use it when you are validating checkout, webhooks, receipts, or subscription creation rather than card validation itself.

stripe test card cvv procedure

The failure card: 4000 0000 0000 0127

Stripe keeps a short list of test numbers wired to fail one specific check. The card that fails CVC validation is 4000 0000 0000 0127, which returns the incorrect_cvc decline code, the same code a real issuer sends when the security code does not match.

Stripe CVV Test for Stripe Card

  • Pros: lets you prove your decline messaging, retry flow, and support copy before a customer sees them.
  • Pros: the failure is deterministic, so it is safe to assert on in automated tests.
  • Cons: it declines no matter what you type in the CVC box, which confuses testers who assume their input caused it.
  • Cons: it does not cover issuer timeouts or network errors, which need separate handling.

Use it for the decline branch in your test suite and keep the pass card for the happy path. Stripe's testing page also lists numbers for a charge that succeeds while the CVC check reports a failure, plus brand-specific variants. Pull those from the current page rather than an old blog post, because the lists change.

Criterion: what actually drives the CVC result

In test mode the digits you type are not matched against anything. Stripe decides the CVC outcome from the card number alone, which is the most useful fact on this page because it changes how you write tests.

  • Pros: any three digits give the same result, so test data stays simple and nobody hunts for a magic CVV value.
  • Pros: a passing cvc_check on the success card still proves your form posts the field and your code reads the response.
  • Cons: you cannot recreate a mistyped CVV by mistyping it. That case needs the dedicated failure card.
  • Cons: a sandbox pass says nothing about how a live issuer treats a mismatch, so do not treat it as a production risk approval.

Choose by branch: success card for the happy path, failure card for the decline path, both when your integration branches on cvc_check.

What test mode will not cover

Test keys and live keys live in separate environments. A sandbox card is rejected by a live key, and a real card cannot be tested without creating a live charge.

  • Pros of staying in sandbox: no funds move, no real cardholder data touches your logs, and you can run thousands of attempts at no cost.
  • Pros: keeping real card data out of your environment is also the point of PCI rules on sensitive authentication data.
  • Cons: sandbox behavior does not mirror every issuer rule, fraud score, or 3D Secure prompt a live charge triggers.
  • Cons: pasting real card numbers into a test form creates a compliance problem with no payoff, and in the US, using card data you do not own is a crime.

Run CVC tests against published sandbox numbers, then validate the live flow with your own card and a small charge.

Steps to run a CVC test in Stripe

  1. Switch the dashboard to test mode or load your secret test key in the development environment.
  2. Enter 4242 4242 4242 4242, any future expiry, and any three-digit CVC. Submit the payment.
  3. Confirm the charge succeeds and read the cvc_check value on the returned object.
  4. Repeat with 4000 0000 0000 0127 and confirm your code handles the incorrect_cvc decline.
  5. Record both outcomes in your test suite so a later refactor cannot break the decline branch.

Keep the sandbox numbers in one file in your repo, labeled test-only, so nobody copies them into production code or a support ticket.