A 3D Secure test card is a sandbox card number that triggers a 3DS authentication step without charging a real account. Processors like Stripe, Adyen, and Checkout.com publish them, and they work only with test API keys. They let you watch the challenge window, the frictionless approval, and the failure path before you ship.
How does a 3D Secure test card work?
In test mode the gateway routes the number to a simulated issuer instead of a real bank. That simulated issuer follows a fixed script tied to the number itself. One number approves with no prompt, another forces a challenge, a third fails authentication, and a fourth comes back as not enrolled.
Because the behavior lives in the number, you pick an outcome by picking a card. No dashboard toggle needed.
Which 3DS outcomes should you test?
Four outcomes cover most real traffic. Run each one before launch.
- Frictionless approval: the issuer approves with no customer interaction.
- Challenge: the customer sees an OTP or biometric prompt and approves it.
- Failed authentication: the customer fails or abandons the prompt, and your order handling has to cope.
- Not enrolled or unsupported: the card skips 3DS, or your integration falls back to a non-3DS charge.
What happens to the order after a failed challenge?
Authentication failure returns a specific error to your server. Your code should show a clear message, keep the order unpaid, and log the reason. Do not retry the same card in a loop; repeated failed attempts look like fraud to the gateway.
Where do you find test card numbers?
Each processor lists them in its own docs, and the numbers differ between processors. Stripe's set sits in its testing docs, Adyen keeps one under test card numbers, and Checkout.com publishes its own. Pull the current list from the docs page rather than from a blog post, since numbers get retired.
Some processors tie 3DS behavior to a test payment method token instead of a raw number. In that case you simulate the challenge through a field in the API request, not through the card.
How do you test a 3DS flow, step by step?
- Switch your integration to test mode and confirm you are using test API keys.
- Enter the processor's 3DS test card with any future expiry date and any CVC.
- Complete the payment and watch the response: does it redirect, open an iframe, or return a challenge token?
- Run the same card twice, once approving the challenge and once failing it.
- Check that your webhook handles both outcomes and that the order state matches the payment state.
- Repeat with the frictionless card and the not-enrolled card.
What should you log from a 3DS test run?
Log the authentication result before anything else. The response carries a status, a 3DS version, and a transaction ID from the directory server.
- Status: tells you whether the challenge passed.
- 3DS version: shows whether 3DS1 or 3DS2 handled the request.
- ECI and CAVV: the values your acquirer needs for liability shift.
If the CAVV is missing on a successful authentication, the liability shift may not apply. Catch that in test mode, not after launch.
Test cards vs live cards
A test card will not authenticate against a live gateway. Live gateways check the number against real issuer BIN ranges and return a decline. Test numbers sit in reserved ranges that no bank issues to customers.
The same limit runs the other way: real card numbers belong in production only, and only for the account holder's own card. Testing your checkout with someone else's number breaks card network rules and processor terms.
Common mistakes
- Using a live key with a test card, then assuming the integration is broken.
- Hardcoding one number and never running the failure path.
- Ignoring the 3DS version. 3DS1 and 3DS2 return different payloads.
- Skipping the mobile view. Challenge windows render inside an iframe and break on small screens.
FAQ
Do 3D Secure test cards expire?
The numbers do not expire on their own, but processors retire and replace them. Accept any future expiry date in the checkout form, and check the docs when a number stops behaving as expected.
Can I use a 3DS test card on a live site?
No. Live gateways reject them because the numbers sit in reserved test ranges. Use them in a sandbox account only.
Do the same test cards work for 3DS2?
Often yes, but the challenge is rendered by an SDK or a redirect rather than a full-page form. Check your processor's 3DS2 section, since some providers use separate numbers for the 3DS2 challenge flow.
Why does my test card skip the challenge?
Either the number is a frictionless card, or your account is not enabled for 3DS yet. Confirm the card's documented behavior first, then check the 3DS setting in your dashboard.