You cannot buy real CVV codes for testing. Free test card numbers from payment processor sandboxes are the correct substitute, and US card networks treat the sale of live card data as access device fraud. Shops that advertise "CVV for sale" trade in stolen cards, whatever the listing claims.
Why live CVVs do not belong in a test environment
PCI DSS requirement 3.2 bars merchants from storing sensitive authentication data after authorization. The CVV2, the CVC2, and the PIN block all fall under that rule. Holding a live code in a staging database breaks compliance even when your test run never settles a charge.
find cvv shop with cheap prices
No money moves in a sandbox. Any number that passes a Luhn check walks the same code path as a real one, so the return on buying live data is zero while the legal risk is not.
Buying card data is federal access device fraud under 18 U.S.C. 1029. Prosecutors stack counts by card volume, and carding forums sit under near-constant law enforcement watch.
The same three-digit code carries a different name per brand: CVV2 at Visa, CVC2 at Mastercard, CID at American Express, and CVV at Discover. All four sit in one PCI category, so the rules apply to every brand you accept.
Where legitimate test CVV data comes from
Processor sandbox card sets
Stripe test mode accepts 4242 4242 4242 4242 with any three-digit CVC and any future expiry date. Adyen, Braintree, Checkout.com, Square, and PayPal publish comparable sets in their developer documentation.
Most sets cover one brand per number. Stripe lists Visa at 4242 4242 4242 4242, Mastercard at 5555 5555 5555 4444, and American Express at 3782 822463 10005.
Test keys and live keys are separate. A request signed with a test key never reaches an issuer, so no authorization, settlement, or chargeback follows.
- Stripe: test cards plus dedicated numbers for CVC failure, expired card, and generic decline.
- Adyen: test cards for Visa, Mastercard, Amex, and several local schemes.
- Braintree: sandbox numbers with matching 3D Secure test flows.
- Checkout.com and Square: test PANs and simulated dispute outcomes.
Decline and error simulation
Each suite includes numbers that trigger a set response: insufficient funds, do not honor, lost or stolen card, CVC mismatch, and expired card. You pick the scenario by card number instead of hunting for a purchased code.
Tokenized and synthetic PANs
Network tokens replace the PAN with a surrogate that maps to one merchant and one device. For load testing, teams mint synthetic PANs that satisfy the Luhn algorithm and never route to an issuer.
Open-source faker libraries generate Luhn-valid numbers for unit tests. They suit form validation and database load, but they cannot produce a gateway decline, so pair them with sandbox cards for end-to-end runs.
Parameters to check before you pick a test data set
- Brand coverage: Visa, Mastercard, Amex, Discover, and the regional schemes you accept.
- Decline coverage: soft declines, hard declines, and issuer timeouts.
- Authentication paths: 3D Secure 2 challenge and frictionless flows, plus SCA exemptions.
- AVS behavior: address and ZIP match results that mirror your risk rules.
- Checksum validity: every number must pass Luhn, or your own validator rejects it first.
- Expiry edge cases: cards dated for this month, future months, and past dates.
- Refresh cadence: processors retire test numbers when schemes change BIN ranges.
Pitfalls that cost teams money and compliance
- Carding shops and Telegram vendors. Listings mix stolen cards with recycled test numbers. You pay in crypto, hand over identity signals, and receive data tied to open fraud cases.
- Packs that fail Luhn. Fake "test CVV" bundles often break the checksum. Your form rejects them before the gateway sees a request, so the test proves nothing.
- Test PANs in production. A hard-coded sandbox card that ships to prod can create bogus orders or trip your own fraud rules.
- CVV in logs. Any plain-text CVC in a log file, an error tracker, or an analytics event violates PCI DSS.
- Skipping the 3DS path. A test plan that ignores authentication leaves the riskiest part of checkout unverified.
- Paying for free data. Every number you need sits in public developer docs at no cost.
What to do when a vendor offers to sell you test CVVs
Walk away and report the listing. A real vendor of test data has no product to sell, because the data is free and the numbers carry no value.
Legitimate testing vendors sell tooling: sandbox orchestration, card lifecycle simulation, and fraud rule testing. Ask for a sandbox account, not a card dump.
Pre-flight checklist
- Confirm test mode keys are separate from live keys.
- Pull the current test card list from each processor you integrate.
- Map each decline scenario to a card number in your suite.
- Enable 3D Secure test flows and record both challenge and frictionless outcomes.
- Scrub CVV fields from logs, traces, and analytics.
- Retire old test numbers when you see gateway warnings or brand changes.
FAQ
Is buying a CVV for testing legal?
No. No legal market exists for live card verification values, and intent does not change the charge. Use sandbox test cards instead.
Do test cards need a real CVV?
No. Sandbox environments accept fixed or arbitrary CVC values, and some lists supply specific codes only to force a CVC failure response.
Can I test with my own credit card?
Yes, for a small live purchase that you refund. Your own card carries real risk rules, real 3DS prompts, and real fees, so keep this to a last smoke test.
Where do I find test CVVs for Amex or Discover?
Amex and Discover test PANs appear in the same processor docs as Visa and Mastercard. Discover coverage varies by processor, so check the list before you build a test case around it.
How often should test data rotate?
Re-check the processor lists each quarter, and any time a scheme announces BIN changes. Test numbers do get retired without notice.