A test credit card is a card number that a payment processor publishes for sandbox use. It passes the same format and checksum checks as a live card, but it moves no money and belongs to no real account. Developers use test cards to run checkout flows, refunds, subscriptions, and decline handling before a site takes real payments.
What Is a Test Credit Card?
A test credit card is a fake number built to work inside a payment gateway's test mode. The digits follow real card rules: correct length for the brand, valid Luhn checksum, and a Bank Identification Number that the processor reserves for testing. No bank issues it, and no cardholder exists behind it.
Processors publish these numbers in their public documentation, so they are not secret. Anyone can copy them. That openness is the point: a developer can hand the same number to a whole team without risk of fraud.
Which Test Card Numbers Do Processors Publish?
Card networks assign test ranges by brand. The Visa range that starts with 4242 is the one most teams memorize. These numbers work in test mode only.
- 4242 4242 4242 4242 (Visa) - a normal successful payment.
- 4000 0000 0000 0002 (Visa) - a generic card decline.
- 4000 0000 0000 9995 (Visa) - a decline caused by insufficient funds.
- 4000 0000 0000 0069 (Visa) - an expired card.
- 5555 5555 5555 4444 (Mastercard) - a successful payment.
- 3782 822463 10005 (American Express) - a successful payment with a 4 digit security code.
Each processor keeps its own list, and the exact numbers differ from gateway to gateway. Always pull the list from the documentation of the gateway you integrate, not from a blog post.
How Does a Test Card Differ From a Real Card?
A real card is tied to a bank account, a person, and a credit line. A test card is tied to nothing. The comparison comes down to a short list of differences.
- Money: a real charge moves funds. A test charge creates a ledger entry in a sandbox database.
- Keys: test numbers work with test API keys. Live keys reject them.
- Reach: test cards work on your own sandbox, not on a live checkout page.
- Privacy: test numbers are published. Real card data is regulated and must be protected.
How Do You Run a Payment Test?
Most gateways follow the same basic flow. The steps below apply to Stripe, Braintree, Adyen, and similar platforms.
- Switch your account or API keys to test mode.
- Open your checkout page in a browser.
- Enter a published test number, any future expiry date, and any 3 digit code (4 digits for Amex).
- Submit the form and confirm that your app records the result.
- Repeat with a decline number to test your error message.
- Compare your order records against the sandbox dashboard.
Good test coverage means one success case, one hard decline, one soft decline, and one expired card. Those four runs catch most checkout bugs.
Why Does a Test Card Get Declined?
Declines in sandbox mode come from your code or your configuration, not from a bank. A failed Luhn checksum is the usual cause when a number is typed by hand. A wrong digit count for Amex (15 digits, not 16) is another common mistake.
The second group of failures comes from configuration. If your app still holds a live key, the gateway treats the test number as an invalid card. If your test clock is set to a past date, every card looks expired.
What About the CVV, Expiry, and ZIP Fields?
In test mode these fields are checked for format, not accuracy. Use any 3 digit code for Visa, Mastercard, or Discover, and 4 digits for American Express. The expiry date needs to be in the future unless you are testing an expired card case.
Some gateways accept any ZIP code and others check against a fixed test value. If a postal code check fails, look up the value your gateway documents for address verification tests.
Is It Legal to Use a Test Credit Card Number?
Yes, when you test your own integration inside a sandbox you control. Yes, when you test a client's checkout with their permission. No, when you enter a test number on a live payment page that belongs to someone else.
Real card data sits under different rules. Buying, selling, or storing card numbers and security codes without authorization is a federal crime in the United States under 18 U.S.C. 1029, and the PCI DSS standard forbids storing the CVV after a transaction authorizes. A test number carries none of that risk because it is public and tied to no account.
Frequently Asked Questions
Do test card numbers work on live websites?
No. A live gateway rejects them because they sit outside the issued card ranges. Attempting it on a site you do not own can count as fraud.
What CVV should I use with a test card?
Any 3 digit code works for most brands, and any 4 digit code works for American Express. Test mode checks the length, not the value.
Can a test credit card be charged?
No. Test transactions post to a sandbox ledger and settle nothing. No bank is contacted and no statement is produced.
Are test card numbers secret?
No. Processors publish them in public docs, and every developer on your team can use the same number.
Why do my test cards expire?
Sandbox time can drift if you use test clocks or freeze time in a fixture. Reset the clock or pick an expiry year far in the future, such as 2035.