Answer

A Square test card is a fake card number that Square publishes for its Sandbox. The Sandbox is a test copy of the Square payments environment. Charges run against test accounts. No bank is contacted. No money moves. A test card returns an approval in the Sandbox and a decline on a live Square account.

Square test card numbers

Square lists test values in its developer documentation. The list covers Visa, Mastercard, American Express, Discover, and JCB.

  • Visa: 4111 1111 1111 1111
  • Mastercard: 5105 1051 0510 5100
  • American Express: 3400 000000 00009
  • Discover: 6011 0000 0000 0004
  • JCB: 3569 9900 1009 5841

The docs pair each number with a CVV and a postal code. Use an expiration date in the future, such as 12/2030. Card brands change test values over time. Check the current Sandbox test values page before you build a test suite.

How to use a test card

  1. Create a Square developer account and an application.
  2. Switch the application to Sandbox.
  3. Copy the Sandbox application ID and access token.
  4. Send the test card number through the Web Payments SDK or the Payments API.
  5. Read the response. Sandbox returns a payment object with a status such as APPROVED or COMPLETED.

Test nonces

The Web Payments SDK turns card data into a single-use token called a nonce. Sandbox also accepts fixed nonces, so you can skip the card form. The string cnon:card-nonce-ok simulates an approved card. Square publishes other fixed nonces that simulate a CVV failure, a postal code failure, and an expiration failure.

What test cards do not do

  • They do not work with live credentials.
  • They do not verify that a live card is valid.
  • They do not carry funds or a credit line.
  • They do not reproduce issuer declines from a real bank, except through Square's simulated failure nonces.

Limits and law

Test cards sit outside payment regulation because Square publishes them and no account is tied to them. Live card numbers are different. In the US, unauthorized use of a card number falls under 18 U.S.C. 1029, access device fraud. Penalties include fines and prison time. PCI DSS sets the storage and transmission rules for merchants and developers who touch live card data. Sandbox credentials and test values are free to obtain and carry no such duties.