CVV Test Tokenization: What It Covers and What It Can't
CVV test tokenization runs tokenization in a sandbox with published test cards. See why a real CVV never becomes a token and what to test.
Redeem your gift cards at any of our Merchants
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
A CVV test response code is the result a payment gateway returns when a sandbox transaction is submitted with a test card to simulate card verification value (CVV) validation. It reports whether the simulated CVV matched, mismatched, was not processed, or was not supplied, without touching a real cardholder account. Developers use these codes to verify checkout logic, error messaging, and retry behavior before going live.
It reflects the issuer-style verification result for the three or four digit security value, not the final authorization decision. A transaction can pass CVV verification and still be declined for insufficient funds or a risk rule. Treat the CVV code as one input to your checkout logic, not the whole outcome.
Most processors model a small set of verification states. Names and numeric mappings vary by provider, so confirm the exact values in your gateway's developer documentation.
PCI DSS prohibits storing the card verification value after authorization, even in encrypted form. That is why no legitimate processor offers a CVV lookup service or sells CVV data, and why any offer to buy CVVs is a fraud signal. Test verification logic with sandbox data only.
A CVV response describes verification of the security value. A decline code describes the authorization decision made by the issuer or the gateway's risk engine. Test each layer separately so you can tell a data-entry problem from a funding or risk problem.
On a mismatch, show a generic message asking the buyer to check the card details, and never echo the raw code back to the customer. On not processed or unsupported, follow your gateway's guidance instead of blocking the order. Keep the codes in server-side logs for support and dispute evidence.
N means no match: the submitted CVV did not match the issuer's record in that simulated scenario. In live mode the same result usually triggers a decline or a step-up authentication prompt.
Yes. Use sandbox test cards from your payment provider. They return the same response structure as live transactions, so your code paths get realistic coverage with no cardholder data involved.
No. Single-letter ISO-style values are common, but message text and numeric mappings differ between processors. Always map the provider's documented codes to your own internal enum before writing assertions.