Checkout CVV Test: How to Validate CVV in a Sandbox

Our Cards

Choose from any of our gift cards to give to your loved ones

more on this topic

giftcardimage

Where to Use?

Redeem your gift cards at any of our Merchants

test cvv checkout

Where to Buy?

You can purchase a gift card from any of these locations

read more

ABOUT US

about

What is ONYX GiftCards?

Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.

What is a Gift Card?

Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.

How it Works?

  • Buy an Onyx Gift Card at these local stores
  • Give your gift card to friends, family, co-workers, etc.
  • The recipient can shop at our select merchants nationwide
  • Your friends, family, co-workers, etc. will present their gift card at checkout to pay for your item(s)
  • They will walk away happy with the best gift ever...the gift of Choice

Why ONYX GiftCards?

  • Save TIME. No need to run around looking for the perfect gift
  • Redeem from a variety of business island-wide. We will continue adding businesses as fast as ONYX grows.
  • ONYX Gift Cards do not expire
  • Cards are valued at convinient amounts to meet every need and occasion

What a checkout CVV test verifies

A checkout CVV test confirms three things: your payment form collects the 3- or 4-digit security code, your integration passes that code to the gateway with the authorization request, and your checkout handles the issuer's response, including a CVV mismatch decline. You run this test in a gateway sandbox using the test card numbers the gateway publishes. You do not run it with a live card, and you do not run it with a card you are not authorized to use. Submitting real card numbers to probe which ones authorize is card testing, and in the US that conduct falls under 18 U.S.C. § 1029.

Prerequisites

Steps

  1. Switch the checkout to test mode and confirm the API base URL points at the sandbox host, not the live host.
  2. Open the gateway's test card documentation and copy the test number that returns a CVV match approval.
  3. Complete the checkout with that number, any future expiry date, and the correct CVV value from the documentation.
  4. Open the gateway log and confirm the request carried the CVV field and the response returned an approval.
  5. Repeat the checkout with the same test number and a wrong CVV value.
  6. Confirm the response returns the CVV mismatch decline code your gateway documents, and that the decline reason is not shown as a generic failure.
  7. Submit the form with the CVV field left blank and confirm client-side validation blocks the request before it reaches the gateway.
  8. Test a 4-digit code against an Amex test number and a 3-digit code against a Visa or Mastercard test number to confirm the field length rule switches with the card brand.
  9. Inspect your application logs and database writes to confirm the CVV value is absent from both after the authorization call.
  10. Check the customer-facing decline message for the CVV mismatch case and confirm it prompts a retry without revealing issuer detail.

What the test cannot tell you

Sandbox results do not reflect how a real issuer will respond, and no test tells you whether a card number taken from a data dump is valid. CVV values cannot be verified outside an authorization request, so any service that claims to check a CVV in advance is either running live authorizations against stolen cards or fabricating the result. Buying, selling, or trading payment card data is a federal offense, and the PCI Council classifies the CVV as sensitive authentication data that must not be stored after authorization.

Record the results

Log each test case with the test card used, the CVV value sent, the response code, and the message shown to the customer. Keep this sheet with your release notes so the same cases run again after any change to the checkout form, the gateway library, or the decline messaging.

Contact Us

Latest

Read our complete guide: Should You Buy CVV From a Card Shop? The Honest Buyer's Guide