Card test environment: definition
A card test environment is a sandbox run by a payment processor. It accepts card numbers that are not tied to real accounts. It returns authorization codes, decline codes, and error messages. No money moves. No card network is contacted.
Who runs these environments
Processors such as Stripe, Adyen, and PayPal operate test modes. A merchant account has two sets of API keys: test and live. Test keys route traffic to the sandbox. Live keys route traffic to production.
Test card numbers
Processors publish fixed test card numbers. Stripe lists 4242 4242 4242 4242 as a Visa test number. The expiry date can be any future date. The CVV can be any three digits. The sandbox checks the number against a list. It does not check the CVV against an issuer.
What merchants test
- Checkout form validation
- Authorization success and decline paths
- 3D Secure challenge flows
- Refunds and partial captures
- Webhook delivery
What the environment does not do
It does not verify CVV or AVS against real issuer data. It does not settle funds. It does not test real card behavior. A test card number works inside the sandbox that issued it.
Rules
Real card numbers must not be entered into a test environment. Processors log test traffic. Card testing with live numbers violates card network rules and is fraud. PCI DSS applies to any system that stores, processes, or transmits real card data. Test environments stay outside PCI scope when no real data enters them.