Short answer
PayPal Sandbox is a test environment, not a payment network. The credit cards inside it are fake. A sandbox card has no issuer behind it, no balance, and no cardholder. When a test checkout asks for a CVV, you type any 3 digits and the sandbox accepts the value in most test cases. The result of the charge comes from the test card number PayPal assigns to that scenario, not from the CVV.
A sandbox card cannot be used to check a real card. No live card data passes through the sandbox and no issuer responds. Anyone who runs live card numbers through a sandbox gets a fake approval that means nothing.
What the sandbox is
PayPal runs two environments. The live environment processes real money for real accounts. The sandbox environment runs a copy of the checkout flow with test accounts and test cards. Developers get sandbox credentials from the PayPal developer dashboard. Those credentials only work against sandbox endpoints.
- Sandbox accounts are separate from live accounts. Same email address can exist in both places.
- Sandbox money is test money. Balances reset on the sandbox side, not on the live side.
- Sandbox API hosts differ from live hosts. A sandbox key sent to a live host returns an authentication error.
What the CVV field does on a test card
Card security checks in the sandbox are stubs. The sandbox stores a test card as a number plus an expiry date, and the CVV entry is accepted as supplied. PayPal publishes test card numbers that each map to a result: approval, decline, or a specific error code. The card number drives the result.
Three practical points:
- Use a 3-digit value. 4-digit values fit American Express style test cards if the test case calls for that brand.
- If a test returns a CVV mismatch error, change the test card number. The number selects the scenario, and a mismatch error is just one scenario.
- Do not reuse live card data. Format the sandbox card as a number that PayPal lists in its test card table.
Where the test cards come from
PayPal lists test card numbers in the developer documentation under test card numbers, with a column for the expected outcome. Stripe, Adyen, and most gateways publish a similar table. Those numbers appear in public docs for one reason: they are inert. A test card fails at any live terminal.
Errors you may see
- CVV2 mismatch. The test card number maps to that failure on purpose, or the card brand and the CVV length disagree.
- AVS mismatch. The billing address on the test card does not match the address in the test case.
- Card expired. The expiry date on the test card sits in the past.
- Invalid card number. A digit was dropped, or the number came from a live card and fails the sandbox table.
What the sandbox does not do
The sandbox does not ask an issuer for an authorization. It does not confirm that a card is open, funded, or valid. It does not return a real CVV check result. A green check in a sandbox test tells you the integration handled a response, not that a card works.
Sandbox credentials also expire or get revoked when an account is closed or an app is deleted. If a test card that worked last month now fails, check the app settings first.
PayPal changes the test card table without notice. Confirm the current numbers on the developer site before you build a test suite around them.