Short answer

Stripe test cards accept any 3 digit CVC. American Express test cards take 4 digits. The value is not verified in test mode, so 123 works on most test cards. A few test numbers exist to force a CVC failure. For example, 4000 0000 0000 0127 returns an incorrect CVC decline. Test cards work with test API keys and return a decline in live mode.

related article

Standard test card

Card number 4242 4242 4242 4242. Expiry: any month and year in the future. CVC: any 3 digits. Postal code: any value. Stripe uses this number in its documentation and in dashboard examples.

stripe test card cvv v1

Test numbers by brand

  • Visa: 4242 4242 4242 4242, 3 digit CVC
  • Mastercard: 5555 5555 5555 4444, 3 digit CVC
  • American Express: 3782 822463 10005, 4 digit CVC
  • Discover: 6011 1111 1111 1117, 3 digit CVC
  • Diners Club: 3056 9300 0902 0004, 3 digit CVC
  • JCB: 3566 0020 2036 0505, 3 digit CVC
  • UnionPay: 6200 0000 0000 0005, 3 digit CVC

Test numbers that return specific errors

  • 4000 0000 0000 0002: declined, generic_decline
  • 4000 0000 0000 9995: declined, insufficient_funds
  • 4000 0000 0000 0069: declined, expired_card
  • 4000 0000 0000 0127: declined, incorrect_cvc
  • 4000 0000 0000 0119: declined, processing_error
  • 4000 0000 0000 3220: 3D Secure authentication required
  • 4000 0027 6000 3184: 3D Secure 2 required, full flow supported

Decline codes are stable strings. Tests can assert on them and fail when Stripe changes the mapping.

Stripe Test Card CVV V8 Guide

Requirements for test mode

Test cards need a test mode API key. Publishable keys start with pk_test_ and secret keys start with sk_test_. A test card sent to the live endpoint returns a decline. No money moves in test mode and no real account is charged.

stripe test card cvv v10

Test clocks move a PaymentIntent through states without a browser. The Stripe CLI forwards events to a local endpoint, which covers webhook cases.

CVC handling rules

PCI DSS forbids storing the CVC after authorization. Test card data carries no cardholder, so the rule does not bind it, but the production code path must not log the field. Mark the CVC input as sensitive and keep it out of logs, traces, and analytics.

Test numbers are published by Stripe and belong to no customer. A card number issued to a real person is different. Charging one without permission is card fraud under federal law and under state statutes.