What CVV test mode is
CVV test mode is a sandbox setting in a payment gateway that simulates the card verification value check. The gateway does not contact an issuer. It compares the submitted CVV against a fixed list of published test values and returns a canned result such as pass, fail, or not processed. Developers use it to confirm the checkout form collects the field, passes it to the API correctly, and branches on each response code.
Prerequisites
- A sandbox or test account with your payment provider
- Test API keys, kept separate from live keys
- The provider's current list of published test card numbers
- A client or API console that can post a payment request
How to run a CVV test
- Switch the gateway account to test mode and copy the sandbox API keys.
- Select a published test card number for the card brand you need to cover.
- Submit a payment with that number, a future expiry date, and the test CVV value mapped to the outcome you want.
- Read the response object and note the CVV result field, for example match, no match, unchecked, or unavailable.
- Change only the CVV to a second test value and resubmit, so you confirm your code branches on the result.
- Assert on the response codes in your automated test suite so regressions surface in CI.
- Repeat with a declined test card number to see how decline codes and CVV codes interact in one response.
Typical test CVV values
Most gateways publish a small set. One value returns a match, a second returns no match, and a third returns not processed. Stripe accepts any three digit CVV with its standard test cards and documents dedicated values for specific outcomes. Authorize.net returns configurable response reasons in its sandbox. These values change, so read the current provider documentation instead of hard-coding numbers from an old tutorial.
What test mode does not cover
Sandbox CVV checks do not model issuer behavior, address verification interactions, or fraud scoring. A pass in test mode proves your integration handles the field and its response codes correctly. It says nothing about how a live issuer will answer. Test mode accepts only the provider's published test numbers. Live card numbers are rejected or return errors, which is the intended behavior.
Handling CVV data correctly
Test data is disposable, but production rules still apply to how you handle the field. Do not log, store, or echo the CVV back in a response, and do not include it in error messages. Keep the sandbox isolated from production credentials so a test key can never reach a live endpoint.