Comparing a dummy CVV with a real CVV comes down to one question: is the number attached to a live cardholder account? A dummy CVV is a throwaway test value that payment processors publish for sandbox use — it looks exactly like a security code but belongs to nobody. A real CVV is the three- or four-digit code printed on an actual card, and it exists only to authorize that cardholder's payments. This guide picks the option you should actually use, then explains what separates the two.
What Is a Dummy CVV?
A dummy CVV is a test verification value supplied by a payment provider for its development environment. Stripe and other gateways publish test card numbers that accept arbitrary CVC values, so engineers can simulate successful and declined charges without touching live card data.
What Is a Real CVV?
A real CVV is the security code on a genuine payment card, generated by the issuing bank and matched to that account. Card networks and PCI rules classify it as sensitive authentication data: a merchant may pass it to the issuer to authorize a payment, but may not store it afterwards.
Which One Should You Use?
Use the dummy CVV. If you are testing a checkout, integrating a payment gateway, or training a support team, processor-issued test credentials give you everything you need and none of the risk. The only legitimate use for a real CVV is paying with your own card on a site you trust.
Key Features
- Dummy CVV: issued inside a processor sandbox, with no cardholder attached
- Real CVV: printed on a live card and tied to a real, named account
- Risk profile: test values carry none; real values carry fraud and legal exposure
- Legal status: test data is fine for development, while trading real card data is a federal crime in the US
- Storage rules: PCI DSS forbids retaining a CVV after authorization
- Cost: test credentials are free, so anything advertised as a purchasable real CVV is fictional or stolen
- Verification behavior: dummy values usually pass any CVC check in test mode, while real values must match the issuer record exactly
Specifications and How the Values Behave
In live mode the issuer compares the submitted code against the one on file and returns a match, no-match, or unchecked response; a mismatch usually declines the transaction. In test mode the gateway skips the issuer entirely and returns a scripted result, which is why any CVC value works. Test credentials are documented, versioned, and revocable, and they stop working the moment you switch your keys to live.
Access and Refunds
Test credentials are delivered instantly through the processor dashboard, so there is no shipping and nothing to return. Because they are digital and free, refunds are not a concern — you simply regenerate keys or rotate test accounts if you need a clean environment. Support is handled through the gateway's own documentation and developer channels.
Is Buying a Real CVV Legal?
No. Obtaining or selling someone else's card verification value is unauthorized access to a payment account and falls under wire fraud and identity theft statutes. Every storefront claiming to sell CVVs is either reselling stolen data or collecting payment and delivering nothing.