Answer

Authorize.Net test cards are card numbers that work in the Authorize.Net sandbox. Each number passes the Luhn check and returns a set response from the gateway. The standard set is Visa 4007000000027, Mastercard 5424000000000015, American Express 370000000000002, Discover 6011000000000012, JCB 3088000000000017, and Diners Club 38000000000006. Use any 3 digit card code, or 4 digits for American Express. Use an expiration date in the future. These numbers fail in live mode.

Sandbox test card numbers

  • Visa: 4007000000027
  • Visa decline: 4222222222222
  • Mastercard: 5424000000000015
  • American Express: 370000000000002
  • Discover: 6011000000000012
  • JCB: 3088000000000017
  • Diners Club: 38000000000006

Card code and expiration values

The gateway checks the card code field on every test transaction. Visa, Mastercard, Discover, JCB, and Diners Club take a 3 digit code. American Express takes a 4 digit code. Any digits pass the format check in the sandbox. The expiration month and year must be later than the current date, or the gateway returns an expired card error before it reaches the test card logic.

Declines and response testing

The sandbox can return declines, AVS mismatches, and card code mismatches on demand. Authorize.Net documents the values that trigger each response, and those values change over time. Check the current developer documentation before you build a test suite around them. A test card never returns a real authorization, and no funds move.

What the sandbox does not do

  • Test transactions do not settle and do not enter a batch.
  • Test cards do not work against the production endpoint.
  • Production credentials do not work against the sandbox endpoint.
  • Test cards do not carry a real bank identification number.

Rules that apply to live card data

Test cards are safe to store in a code repository. Live card data is not. PCI DSS forbids storage of the card verification value after authorization, and it forbids storage of full track data in any form. Sandbox testing exists so that integration work runs without live account numbers.