The short answer
Adyen test mode accepts CVV 737 on its Visa, Mastercard, Maestro, Discover, JCB, Diners Club, and Cartes Bancaires test cards. American Express test cards use CID 7373. Those values work with test API keys and test terminals. A live account rejects them.
Test card numbers and their CVV values
Adyen publishes a card list for its test environment. Each row carries one fixed security code.
- Visa 4111 1111 1111 1111: CVV 737
- Mastercard 5555 4444 3333 1111: CVV 737
- Mastercard 2222 4000 0000 0062: CVV 737
- American Express 3700 0000 0000 002: CID 7373
- Discover 6011 6012 3456 7890: CVV 737
- JCB 3569 9900 1009 5841: CVV 737
- Diners Club 3600 6666 3333 44: CVV 737
Adyen edits that table from time to time. Check the current version before you hard-code a number into a test suite.
Where the CVV goes in an Adyen request
The /payments call carries card data inside the paymentMethod object. Encrypted fields arrive as encryptedCardNumber, encryptedExpiryMonth, encryptedExpiryYear, and encryptedSecurityCode. Adyen's client-side encryption library builds those strings.
For a server-side test call with raw card data, send the security code in the cvc field. Adyen accepts raw card fields in test mode. Live requests require encryption.
3D Secure test cards
Adyen 3DS test cards use the password "password" on the challenge screen. Some of them take a different CVV. Read the row for the card you pick.
What a test CVV cannot do
CVV 737 clears no real authorization. It starts no charge and no settlement. Test cards return a simulated result code instead of an issuer response. Part of the Adyen list exists to force refusals, including a CVC rejection. The table marks which number returns which result.
CVV rules in production
PCI DSS Requirement 3.2 bans storage of sensitive authentication data after authorization. That set covers the CVV, CVC, and CID values, full track data, and PIN blocks. A merchant may pass the value to the processor and hold it in memory during the authorization. Writing it to a database, a log, or a receipt breaks the rule. Test card data stays outside that scope until it touches a production system.