CVV Test Checkout Page: What It Is and How Test CVVs Work
A CVV test checkout page is a sandbox payment form that accepts test card numbers and dummy CVVs. Real CVVs cannot be bought or used in test mode.
Redeem your gift cards at any of our Merchants
You can purchase a gift card from any of these locations
Onyx Gift Cards is a Grenadian company designed to introduce, market and manage gift cards systems in Grenada for retailers and corporations. We are enthusiastic about the effect and influence we will have on the local market. We intend to expand our systems regionally with a range of product offerings and services.
Gift cards are the preferred way of giving and receiving gifts. They carry a monetary value that can be redeemed for gifts at your favorite store.
Onyx GiftCards are “Open Gift Cards” which means that they can be redeemed at multiple merchant locations. They are standard credit card size, can fit into the average wallet and made of PVC plastic. Onyx GiftCards are Barcoded for security and safety for the consumer and bear a disclaimer at the back.
Onyx Giftcards can be bought with a branded Card backer which is black in colour and is designed to fit the card. There is an area to write a brief message to the recipient as well.
"Test CVV checkout" describes two different activities. One is a developer checking a payment form in a sandbox with published test card numbers. The other is a person typing a card number they do not own into a checkout to see if it authorizes. The first is routine engineering. The second is card testing, a federal crime in the US under 18 U.S.C. § 1029, and the usual source of the thousands of small authorization attempts that hit online stores.
The CVV is a 3-digit code printed on the back of most Visa, Mastercard and Discover cards, and a 4-digit code on the front of American Express cards. The issuer generates it from the card number, the expiry date and a key the issuer holds. It is not in the magnetic stripe and not in the chip. PCI DSS forbids storing it after authorization, even encrypted.
Payment processors publish test card numbers for integration work. Stripe's standard test card is 4242 4242 4242 4242. In test mode any 3-digit CVC and any future expiry date produce a successful authorization, and designated numbers trigger designated declines. Adyen, Braintree, PayPal and Checkout.com publish similar tables. A sandbox authorization never reaches an issuer. No money moves. No real card is involved.
Rules for sandbox work: use only the processor's published numbers, keep the account in test mode, never paste a live card number into a test environment, and never send live card data to a staging server. A live card number in a test environment pulls that environment into PCI scope.
Card testing is a scripted run of authorization attempts against a merchant's checkout. The operator holds a list of card numbers, frequently from a breach, and wants to learn which ones still authorize. Signs on the merchant side: a jump in declines, many attempts across sequential card numbers (a BIN attack), one address hitting the checkout with dozens of different cards, and small order values. Each attempt costs an authorization fee. Successful attempts end in chargebacks, and card networks place merchants with high fraud ratios into monitoring programs.
18 U.S.C. § 1029 covers access devices, a category that includes card numbers and CVVs. Producing, selling, transferring or possessing unauthorized access devices with intent to defraud is a federal offense. Penalties reach 10 to 15 years for offenses involving multiple devices or $1,000 or more in value in a one-year period. Wire fraud (18 U.S.C. § 1343) and aggravated identity theft (18 U.S.C. § 1028A) often apply as separate counts. State statutes add their own charges.
Most storefronts advertising CVV sales are scams. The data is stale, the numbers are generated, or the operator takes payment and disappears. Some are run by law enforcement. A purchase is a crime whether the card works or not, and the buyer's own payment details go to the seller. There is no legitimate vendor of card data.
Rate limits on the checkout endpoint, a challenge on the payment step, device fingerprinting, and velocity rules per card, per IP address and per email address. Most processors ship card testing rules. Turn them on before launch. A CVV check alone does not stop a card test, because the attacker already has the code.