Answer first
Stripe test cards are free. You do not buy them. In test mode, Stripe provides specific card numbers that trigger success, decline, or CVV check failures. To test CVV validation, use the test card that returns a CVV mismatch, usually the card number 4000000000000127 with any future expiry and any three-digit CVC. That card simulates an incorrect CVC. It is not a real card and cannot process live payments. If a seller offers CVV data or "valid test cards" for purchase, treat that as a red flag. Real CVV data is sensitive cardholder data, and buying it is illegal under US law and card network rules.
What to look for in a CVV validation test setup
- Test mode only: API keys that start with sk_test_ and pk_test_.
- Dedicated test cards: Use Stripe's published test numbers for CVV success, failure, and missing CVC.
- Response codes: Check the decline code, such as incorrect_cvc, and map it to your UI.
- No storage: Never store CVV after authorization. PCI DSS prohibits it.
- Idempotency: Use idempotency keys so retries do not create duplicate charges.
Parameter bands for CVV validation
CVV length and format depend on the card brand and country. For most US-issued cards, the CVV is three digits on the back. American Express uses a four-digit CID on the front. Stripe test cards accept any three-digit CVC for most test numbers, except the specific test card that simulates a CVC failure. For that card, any three-digit CVC returns an incorrect_cvc error. If you send a missing CVC, Stripe returns a different error. Use these bands when building validation:
stripe test card cvv procedure
- Standard CVV: exactly 3 digits, numeric only.
- Amex CID: exactly 4 digits, numeric only.
- Missing CVV: empty or null, expect a validation error before network call if required.
- Invalid format: letters, spaces, or wrong length, expect a client-side error.
Common pitfalls
- Mixing live and test keys. Test cards fail in live mode.
- Assuming all test cards pass CVV. Only some simulate CVV failures.
- Storing CVV in logs or databases. This violates PCI DSS and creates legal risk.
- Buying "CVV lists" or "test card packs" from third parties. These are not legitimate Stripe test cards.
- Using a real card number in test mode. Stripe rejects live card numbers in test mode.
FAQ
Do I need to buy Stripe test cards?
No. Stripe publishes test card numbers for free in its documentation. You can use them only in test mode. No purchase is required or legitimate.
Which Stripe test card triggers a CVV failure?
Stripe's test card 4000000000000127 returns an incorrect_cvc decline when you submit any three-digit CVC. Use it to verify your error handling.
Can I use a Stripe test card for a real charge?
No. Test cards work only with test API keys and test mode. They cannot authorize live payments.
Is it legal to buy CVV data?
No. Buying or selling real CVV data is illegal in the US and most countries. It violates card network rules and can lead to criminal charges. If you need test data, use official test cards from your payment processor.
How do I validate CVV format before submitting to Stripe?
Check the card brand first. For Visa, Mastercard, and Discover, require exactly three digits. For American Express, require four digits. Strip spaces and non-numeric characters. Do not store the CVV. Send it only as part of the authorization request.