Short answer
Test card numbers run in sandbox environments. Authorize.net, Stripe, and Adyen publish them for developer testing. A test number passes the Luhn checksum and triggers a 3-D Secure challenge in test mode. No test number moves real money. Using a live card number, or a CVV bought from a market, to test a payment page is carding. In the US that is 18 U.S.C. 1029, and it carries up to 10 years per count.
Luhn check
Hans Peter Luhn filed the mod-10 checksum patent in 1954 while at IBM. The patent issued in 1960. Every card number today carries the check digit. The rule: double every second digit from the right, subtract 9 from any result above 9, sum all digits. A total that ends in 0 passes.
Luhn catches typos. It does not prove a card exists, is open, or holds funds. Anyone can compute a Luhn-valid number in one line of code. Sandbox numbers such as 4242 4242 4242 4242 and 4007 0000 0002 7 pass Luhn. So do billions of fake strings.
3DS challenge testing
EMVCo owns the 3-D Secure specification. Version 2.x splits flows into frictionless and challenge. The issuer picks which path runs. Sandbox test cards set the outcome: pass, fail, or a challenge the tester can complete or abandon. Merchant test suites in Authorize.net and Stripe map each test number to a result code.
CVV test and mobile UX
- CVV length: 3 digits for Visa, Mastercard, and Discover; 4 for American Express.
- HTML input: inputmode numeric, autocomplete cc-csc, maxlength 4.
- Amex prints the code on the front, above the number. Other networks print it on the back.
- Real CVV validation happens at the issuer. The page cannot check a code by itself.
- A test CVV is any value the sandbox documents. Test runs accept 123 for most networks.
Authorize.net test card
Authorize.net runs a sandbox in its developer portal. Test cards include 4007000000027 (Visa), 5424000000000015 (Mastercard), 370000000000002 (Amex), and 6011000990139424 (Discover). Each maps to a response: approved, declined, or error. Test mode rejects live numbers by design.
Legal status
Buying, selling, or trading CVV data and fullz is a federal crime. Carding markets get seized. The Department of Justice announces takedowns each year. A page that promises a latest working link to a card shop is either a scam or a honeypot.