Sandbox CVV validation is the check of the card verification value field inside a payment processor's test environment. The test card numbers and CVC values come from the processor's own documentation. No real card data is involved.
What the sandbox checks
A test gateway applies the same format rules it uses in production:
Sandbox CVV Security Test: A Practical Guide
- Length: 3 digits for Visa, Mastercard, and Discover. 4 digits for American Express.
- Characters: digits only. Letters and spaces fail.
- Presence: an empty CVC field fails when the processor marks the field as required.
- Card number: a Luhn check runs on the test PAN before the CVC check.
- Expiry: the test date must sit in the future.
The sandbox returns a result for the CVC field and a result for the full authorization. The two results are separate.
Where test CVV values come from
Each processor publishes its own test data. Stripe test cards accept any 3-digit CVC in test mode. Adyen lists a fixed CVC for each test card number. Braintree uses 123 for a CVC match and 200 for a CVC failure. Copy the values from the processor's reference page for the account's region.
Sandbox CVV Authentication Test: Verify CVV Handling Before Going Live
Test values exist to trigger each response path. A developer needs at least one passing value, one failing value, and one value that returns an unchecked result.
Reading the response
Most gateways return a CVC status field with four common states:
- Match: the value passes the check.
- No match: the value fails the check.
- Unchecked: the issuer or the gateway did not run the check.
- Unavailable: the check could not run.
Map each state to a message in the checkout UI before launch. A decline message that names the CVC field helps the buyer correct the entry.
What sandbox results do not prove
Test mode does not confirm issuer behavior on a real BIN range. It does not test address verification, 3-D Secure, or the fraud rules on a live account. Live CVC checks route to the card issuer. Sandbox checks stay inside the processor.
Handling test data correctly
Keep test API keys separate from live keys. Never send a real card number to a sandbox. PCI DSS requires that the card verification value is not stored after authorization, and that rule applies to test data as well.
Checklist before go-live
- Test one passing CVC, one failing CVC, and one empty CVC.
- Test 3-digit and 4-digit fields.
- Confirm the decline copy names the field.
- Swap to live keys and repeat one authorization.