A fake CVV for testing is a three or four digit code that a payment gateway accepts inside its sandbox, paired with a published test card number. It works only in test mode against a developer account. Sending an invented CVV to a live merchant is card fraud, not testing.
What counts as a test CVV?
Payment processors publish test card numbers so developers can run charges without touching real accounts. In sandbox mode the gateway skips the card network and returns a result you chose in advance. The CVV field still has to be filled, so processors accept any three digits for most test cards.
Some gateways also publish specific CVC values that force a decline. You use those to check that your checkout page shows the right error message when a bank rejects a security code.
Which test CVV values do processors accept?
Every major processor keeps its own list. These are the common ones.
- Stripe: card 4242 4242 4242 4242 with any three digit CVC, any future expiry, and any postal code.
- PayPal and Braintree: card 4111 1111 1111 1111 for a standard Visa approval.
- Mastercard test range: 5555 5555 5555 4444.
- American Express test range: 3782 822463 10005, which uses a four digit CVC because Amex prints four digits.
Stripe treats a wrong length CVC as an error rather than a mismatch, so type the full three digits even in test mode. Amex test cards need four.
Does the test CVV change the charge result?
Yes, in some sandboxes. Processors document CVC values that return a "CVC check failed" response so you can test your decline flow. Other gateways toggle the outcome with a card number instead. Read your processor's test page before you build assertions around a specific digit.
How to test CVV handling in a sandbox
- Create a sandbox or test account with your processor.
- Switch your API keys to test mode. Live keys reject test cards.
- Fill the checkout form with a published test card number and a valid CVC length.
- Run a charge and confirm the approval response and the last four digits stored.
- Run a second charge using the value your processor lists for a CVC failure.
- Check that your app shows a clear message and does not store the code.
- Repeat for each card brand you plan to support.
Why a fake CVV cannot work on a live payment
The issuer validates the CVV, not the merchant. When a live authorization reaches the bank, the bank compares the submitted code to the one tied to the account. There is no field a merchant or a third party can alter to change that answer.
- Issuer check: only the bank that issued the card knows the correct code.
- Tokenization: modern gateways replace card data with a token, and the CVC is not stored past authorization.
- Network rules: Visa and Mastercard require CVC checks for card not present transactions.
- Rate limits: repeated wrong CVC attempts trigger declines and alerts at the issuer.
Where the legal line sits in the US
Faking a CVV to complete a real purchase is fraud. Federal law at 18 U.S.C. 1029 covers the use and sale of counterfeit access devices, and states add their own charges for identity theft and theft by deception.
That covers the "buy CVV" market as well. Lists sold on forums and chat apps are stolen data, recycled data, or pure scams. Most buyers never get a working code, and the purchase itself is a crime.
Test mode sits on the other side of the line because no real account is charged and no real card is involved. Keep your testing inside that boundary and you are fine.
Compliance rules that touch CVV handling
PCI DSS forbids storing the CVC after authorization, even in encrypted form. That applies to test data too, because sloppy test code often becomes production code.
Tokenization and hosted fields keep card data out of your servers. Use those tools and your test environment looks like your live one without the risk.
Better options for QA teams
- Sandbox test cards: the fastest path for functional testing.
- Mock gateway: stub the API response so you can trigger every error code on demand.
- Network tokens: test the tokenized flow your production app will use.
- Processor test suites: Stripe, PayPal, and Adyen all ship sample cases for declines, 3DS, and disputes.
FAQ
Can I use any three digits as a CVV in test mode?
For most processors, yes. Stripe, PayPal, and Braintree accept any three digit value on their published test cards. Exceptions are the values they list for forcing a CVC failure.
Why does my sandbox decline a test card?
Common causes are live API keys, an expired test card date, a card number from a different processor's list, or a CVC with the wrong digit count for the brand.
Do test cards work on live websites?
No. A live gateway sends the authorization to the issuer, and the issuer declines a test card number. This is why test mode and live mode use separate keys.
Is there a legal fake CVV generator?
There is no generator that produces a code a live bank will accept. Tools that claim this either return random digits or collect your data. Use your processor's sandbox instead.