What is a Stripe test card CVV v3?
A Stripe test card CVV v3 means testing CVC and CVV verification in Stripe test mode using Stripe's published test card numbers inside Stripe.js v3 and Elements. There is no separate "v3 card." The v3 label points to Stripe.js v3, the browser library that collects the card number, expiry, and CVC field.
Test numbers behave like real cards for validation logic, but they never touch a live card network and never move real money.
Which Stripe test cards trigger a CVC check failure?
Stripe publishes separate numbers for each CVC outcome so you can confirm your integration reacts to the right decline code.
- 4242 4242 4242 4242: payment succeeds and the CVC check passes with any three digits.
- 4000 0000 0000 0101: the card declines because the CVC check fails.
- 4000 0000 0000 0127: the CVC check fails with an incorrect CVC response.
- 4000 0000 0000 0002: generic decline, unrelated to the CVC field.
Stripe updates this list over time, so confirm each number against the current testing documentation before you hard-code it into an automated suite.
How do you test CVC verification without charging a card?
Use a test secret key, create a PaymentIntent, confirm it with a test card, then inspect the cvc_check value on the resulting charge. The field returns pass, fail, unavailable, or unchecked, and each value maps to a different message and retry path in your checkout UI. Because test-mode requests are routed to a sandbox, no real money moves at any point.
- Set your API key to a test key.
- Create the PaymentIntent with a fixed amount.
- Confirm it using a CVC-failure test number.
- Read the decline code and the cvc_check value.
- Assert the exact UI copy your customer would see.
Why does v3 matter for CVC collection?
Stripe.js v3 loads Elements from Stripe's servers, so your page never handles raw card data and your PCI scope stays small. The CVC input is an Element, which means it is tokenized in the browser before your server ever sees it. That design is what makes a CVC test meaningful: you are testing the token flow, not a stored value.
Is the CVV ever stored after verification?
No. PCI DSS prohibits storing the card verification code or value after authorization, in test mode as well as production. If your logs or database contain a CVC field, that is a compliance problem regardless of which environment it came from.
Common mistakes when testing CVC checks
Mixing test and live keys
Test numbers only work with test keys. A live key returns a real decline or an unrecognized card error instead of the simulated result you expected.
Treating every decline as a CVC failure
Read the decline code and the cvc_check field, not the human-readable message. A generic decline and a CVC failure need different copy and different retry logic.
Hard-coding numbers with no fallback
Keep test cards in a single fixture file so a documentation change is a one-line edit rather than a broken build. Pair each number with the outcome you expect so a silent behavior change fails loudly in CI.