Test Card Numbers & 3D Secure Testing
This guide provides the simulated credit card numbers and step-by-step instructions you'll need to test payment flows including 3D Secure (3DS) authentication in the sandbox environment before going live.
Never use real card details in the sandbox. All numbers below are simulated test values only and will not process real transactions.
When submitting these cards via the API or VoPay Account portal, you can use any cardholder name, CVV, and future-dated expiry unless a specific value is called out below.
Successful Transactions
Use these cards to simulate a fully successful, non-3DS payment.
| Card Number | Card Type | Description |
|---|---|---|
| 4263970000005262 | Visa | Successful transaction |
| 5425230000004415 | Mastercard | Successful transaction |
| 374101000000608 | American Express | Successful transaction |
| 36256000000725 | Diners Club | Successful transaction |
| 6011000000000087 | Discover | Successful transaction |
Declined Transactions
Use these to simulate common decline scenarios by card brand.
| Card Number | Card Type | Result Code | Description |
|---|---|---|---|
| 4000120000001154 | Visa | 101 | Declined by the bank |
| 4000130000001724 | Visa | 102 | Referral B |
| 4000160000004147 | Visa | 103 | Referral A – Card reported lost/stolen |
| 4009830000001985 | Visa | 200 | Communication error |
| 4242420000000091 | Visa | 111 | Strong Customer Authentication required |
| 5114610000004778 | Mastercard | 101 | Declined by the bank |
| 5114630000009791 | Mastercard | 102 | Referral B |
| 5121220000006921 | Mastercard | 103 | Referral A – Card reported lost/stolen |
| 5135020000005871 | Mastercard | 200 | Communication error |
| 5100000000000131 | Mastercard | 111 | Strong Customer Authentication required |
| 376525000000010 | American Express | 101 | Declined by the bank |
| 375425000000907 | American Express | 102 | Referral B |
| 343452000000306 | American Express | 103 | Referral A – Card reported lost/stolen |
| 372349000000852 | American Express | 200 | Communication error |
| 374205502001004 | American Express | 111 | Strong Customer Authentication required |
3D Secure 2 (3DS2) Testing
A simulated issuer Access Control Server (ACS) is provided so you can test different 3DS2 outcomes for Visa and Mastercard without a live issuer.
Setup note: To use the newer message-version 2.2 fields and values, include the header X-GP-VERSION: 2.2.0 on your requests.
Visa — Message Version 2.2
| Card Number | Flow Type | Transaction Result | Expected ECI |
|---|---|---|---|
| 4222000006285344 | Frictionless | Authentication successful | 05 |
| 4222000009719489 | Frictionless | Authentication successful – no method URL | 05 |
| 4222000005218627 | Frictionless | Authentication attempted but not successful* | 06 |
| 4222000002144131 | Frictionless | Authentication failed | 07 |
| 4222000007275799 | Frictionless | Authentication issuer rejected | 07 |
| 4222000008880910 | Frictionless | Authentication could not be performed | 07 |
| 4222000001227408 | Challenge | Challenge required | N/A |
*The bank still offers chargeback protection in this scenario, so the transaction is expected to proceed as a success.
Mastercard — Message Version 2.2
| Card Number | Flow Type | Transaction Result | Expected ECI |
|---|---|---|---|
| 5354560000000004 | Frictionless | Authentication successful | 02 |
| 5571596304025153 | Frictionless | Authentication successful – no method URL | 02 |
| 5580364874958322 | Frictionless | Authentication attempted but not successful | 01 |
| 5540010585397800 | Frictionless | Authentication failed | 00 |
| 5588312194362669 | Frictionless | Authentication issuer rejected | 00 |
| 5520680211891022 | Frictionless | Authentication could not be performed | 00 |
| 5506874496684651 | Challenge | Challenge required | N/A |
The Electronic Commerce Indicator returned will always tell you whether liability has shifted to the issuer in your favor. Exact values can vary slightly by issuer in production, but the values above are what the sandbox simulator returns.
3DS Testing Tips
- Use the exact card numbers above - substituting your own test PAN won't trigger the ACS simulator correctly, and challenge screens may fail to load.
- Challenge flow cards (4222000001227408 for Visa, 5506874496684651 for Mastercard) will route the user to a hosted challenge page during testing build your integration to expect a redirect/iframe step for these.
- Frictionless flow cards complete authentication in the background with no shopper interaction, so your integration should proceed straight to authorization.
General Testing Notes
- No real data: These are simulated values only — do not attempt to process live transactions with them.
- Free-form fields: Outside of the specific expiry/CVV combinations called out for network tokens or Click to Pay, you can enter any cardholder name, CVV, and any future-dated expiry.
- Result codes: 00 = approved. Non-zero codes map to specific decline/referral/error reasons per the tables above — use these to validate your integration's handling of each scenario.
- Digital wallets (Apple Pay / Google Pay): These use amount-based simulation rather than card numbers reach out to your VoPay implementation contact if you need the wallet-specific test amount tables.
Updated 1 day ago