Short answer
In the 2Checkout sandbox the test CVV is 123 for the Visa and Mastercard test numbers and 1234 for the American Express test number. 2Checkout is a payment gateway owned by Verifone. The sandbox is a test environment. It approves or declines charges against fixed card numbers, not live accounts. No cardholder data is involved.
Use any expiry date in the future. Use any cardholder name and any billing address. The sandbox ignores those fields unless a rule is switched on.
Test card numbers and matching CVV values
- Visa: 4111 1111 1111 1111, CVV 123
- Mastercard: 5555 5555 5555 4444, CVV 123
- American Express: 3782 822463 10005, CID 1234
These numbers come from published gateway test sets. The same values appear in sandbox docs for many processors because the ranges are reserved for testing and cannot be issued to a cardholder.
When the sandbox checks the CVV
A 2Checkout account has a CVV rule setting. With the rule on, the sandbox compares the value in the request with the test value and returns a match or no-match code. With the rule off, the gateway returns an approval and skips the field. Test both states before you go live.
Steps to run a test charge
- Create a sandbox account in the Verifone developer portal.
- Copy the sandbox merchant code and API credentials.
- Send a charge request with a test card number, the matching CVV, and a future expiry.
- Read the response code and the order record.
- Repeat with a decline card to test your error path.
Errors developers see
CVV mismatch means the rule is on and the value is wrong. A generic card declined code often means the request hit the live endpoint. An authentication failure points to credentials, not the card. The docs list test numbers that force specific decline responses. Check the current list, because the values change between releases.
What test data cannot do
A test CVV works in a sandbox. Live gateways reject test card numbers. Card verification values are not stored after authorization under PCI DSS. Published test values have no link to a real account. Data sold as fresh CVV comes from card theft, and use of it falls under 18 U.S.C. 1029.