Test Credit Card Entry Forms
When testing payment forms, never use real credit card numbers on test systems. PCI DSS explicitly prohibits this. Instead, use the designated test card numbers published by payment gateways and card brands.
Common test cards
| Brand | Test Number | Notes |
|---|---|---|
| Visa | 4444 3333 2222 1111 | Corporate card (GB), widely accepted |
| Visa | 4111 1111 1111 1111 | Consumer card, universal test number |
| Mastercard | 5555 5555 5555 4444 | Credit (GB) |
| Mastercard | 2222 4000 1000 0008 | Credit (CA) |
These cards pass the Luhn check (mod-10 checksum) and are recognized by most payment gateways as test cards. They typically do not have a valid CVC or expiration date in production systems — use any future date and any 3-digit CVC.
Gateway-specific notes
- Adyen — Publishes an extensive list of test cards by region and card type.
- Worldpay — Lists
4444333322221111as a “Restricted card Visa” for testing. - Stripe, PayPal, CyberSource — Each maintains their own test card registry; consult the gateway documentation.
PCI compliance reminder
Using real PANs on test systems violates PCI DSS and can trigger audit findings. Always use officially designated test numbers. If a real card number is accidentally entered into a test environment, treat it as a potential data breach and follow incident-response procedures.
Related: pci-compliance-attestation (AOC and compliance), xss-attacks (form security testing).
Sources
- Test card numbers — Adyen
- Card payment testing — Worldpay
- PCI Audit: Using “test” cards — Security Stack Exchange