A CVV test run is one small authorization that checks whether a card number, an expiry date, and a 3-digit code work together. In a legal setting the card is a processor test number and the request goes to a sandbox. Running that check on card numbers you do not own is card testing fraud. In the US it falls under 18 U.S.C. ยง 1029.
Sandbox test numbers
Payment processors publish test card numbers. They work only in test mode and never move real money. Stripe lists 4242 4242 4242 4242 as a successful Visa charge with any future expiry and any 3-digit CVC. 4000 0000 0000 0002 returns a decline. Adyen, Braintree, and Checkout.com publish similar lists.
What one test run contains
- Card number taken from the sandbox list
- Expiry date in the future
- 3 or 4 digit code, arbitrary in test mode
- Amount, often 1.00 USD
The API response returns an authorization result, a CVV result code, and an AVS result code. Stripe reports a pass or fail flag on test cards. Live networks return codes M, N, P, U, or S under ISO 8583.
Card testing on live cards
Attackers send many small authorizations across BIN ranges. Common signals: a high decline rate per IP address, many cards per session, amounts under 2 USD, a CVV mismatch rate near 90%, and BINs from one issuer range. Visa and Mastercard publish rules on this traffic. Acquirers fine merchants that allow it. The Visa Fraud Monitoring Program tracks the pattern.
Controls
Require CVV and AVS on every request. Set velocity limits per card, per IP address, and per email. Enable 3-D Secure 2. Block country pairs that do not match the billing address. Log every decline.
No public test number charges a real account. A source that asks for a live card to run a test is committing fraud. This page does not list live card data and does not explain how to get it.