Learning & reference
Test credit card numbers: every brand, every decline, and the form edge cases
Payment testing needs three kinds of card number: ones that succeed, ones that fail for a specific reason, and ones that stress your own form. The first two come from your payment processor. The numbers below are from Stripe's testing documentation, the most widely used sandbox; the third kind is what your validator should survive before any processor sees it.
Numbers that succeed
Stripe test mode. Any future expiry date; any 3-digit CVC, or 4 digits for American Express.
| Brand | Number | Why it is useful |
|---|---|---|
| Visa | 4242 4242 4242 4242 | The default. If only one number is in your fixtures, it is this one. |
| Visa (debit) | 4000 0566 5566 5556 | Debit and credit can be priced or routed differently. |
| Mastercard | 5555 5555 5555 4444 | The classic 51 to 55 range. |
| Mastercard (2-series) | 2223 0031 2200 3222 | The 2221 to 2720 range that older brand checks reject. |
| Mastercard (debit) | 5200 8282 8282 8210 | |
| Mastercard (prepaid) | 5105 1051 0510 5100 | Prepaid cards are often subject to separate rules. |
| American Express | 3782 822463 10005 | 15 digits, 4-digit CVC, grouped 4-6-5. Breaks anything assuming 16 and 3. |
| American Express | 3714 496353 98431 | A second Amex, for tests that need two distinct cards. |
| Discover | 6011 1111 1111 1117 | |
| Discover (debit) | 6011 9811 1111 1113 | |
| Diners Club | 3056 9300 0902 0004 | |
| Diners Club (14 digit) | 3622 720627 1667 | A 14-digit number. Length checks fixed at 15 or 16 fail here. |
| JCB | 3566 0020 2036 0505 | |
| UnionPay | 6200 0000 0000 0005 | |
| UnionPay (19 digit) | 6205 5000 0000 0000 004 | 19 digits. The longest length a card field must accept. |
Numbers that fail on purpose
Each triggers one specific decline in Stripe test mode, so you can test the message your user sees for each case.
| Number | Result | What to check in your app |
|---|---|---|
| 4000 0000 0000 0002 | Generic decline | A clear message, and the form keeps what the user typed. |
| 4000 0000 0000 9995 | Insufficient funds | Suggests another card rather than a retry of the same one. |
| 4000 0000 0000 9987 | Lost card | Shown to the user as a generic decline; do not reveal why. |
| 4000 0000 0000 9979 | Stolen card | Same: a generic message, never "reported stolen". |
| 4000 0000 0000 0069 | Expired card | Points the user at the expiry field. |
| 4000 0000 0000 0127 | Incorrect CVC | Points the user at the CVC field. |
| 4000 0000 0000 0119 | Processing error | Safe to retry. Make sure a retry cannot charge twice. |
| 4242 4242 4242 4241 | Incorrect number | Fails the Luhn check, so your own form should catch it before the processor does. |
Lost and stolen are the ones to get right. Telling a user their card was reported stolen helps whoever is holding it. Show the same generic decline you show for anything else you cannot explain safely.
3D Secure
Strong customer authentication adds a challenge step. These exercise each path in Stripe test mode.
| Number | Behaviour |
|---|---|
| 4000 0025 0000 3155 | Requires authentication unless the card has been set up for future payments. |
| 4000 0027 6000 3184 | Always requires authentication. |
| 4000 0038 0000 0446 | Already set up: off-session payments succeed without a challenge. |
| 4000 0000 0000 3220 | 3D Secure 2 required; completes successfully. |
| 4000 0084 0000 1629 | 3D Secure required, then the card is declined after authentication. |
| 4000 0084 0000 1280 | 3D Secure required, and authentication returns an error. |
| 4000 0000 0000 3055 | 3D Secure supported but not required; succeeds. |
| 4242 4242 4242 4242 | 3D Secure supported, card not enrolled; succeeds without a challenge. |
What your own card form must survive
Before any processor sees a number, your form parses it. These are the inputs that break hand-written validation. Type them into your checkout.
| Input | Correct behaviour |
|---|---|
| 4242 4242 4242 4242 | Accepted. Spaces are how people copy card numbers. |
| 4242-4242-4242-4242 | Accepted, or rejected with a clear message. Never silently truncated. |
| 4242424242424242 | Leading and trailing whitespace trimmed, not counted as digits. |
| ３７８２８２２４６３１０００５ | Full-width digits, from Japanese and Chinese keyboards. Normalise to ASCII or reject clearly; do not store them as typed. |
| 3622 720627 1667 | 14 digits, accepted. So is 15 (Amex) and 19 (UnionPay). |
| 2223 0031 2200 3222 | Recognised as Mastercard, not as unknown. |
| 4242 4242 4242 4241 | Rejected by your Luhn check, with the error on the number field. |
| Paste into the field | Works. Blocking paste on a card field sends users to typos. |
Never log what the user typed. A validation error handler that writes the rejected value to a log is how real card numbers end up in log storage. Test that your error path records the reason, not the input.
Other processors
Adyen, Braintree, Checkout.com, PayPal and the rest each publish their own test numbers, and the numbers that trigger declines or 3D Secure differ between them. A number from this page may behave differently, or not work, in another sandbox. Use the list from the processor you integrate with, and keep this page for form validation, which does not depend on the processor at all.
Questions
What is the 4242 4242 4242 4242 card number?
Stripe's standard Visa test card. It succeeds in test mode with any future expiry and any CVC. It is not a real card; in live mode Stripe declines it.
What CVC and expiry date should I use?
Any three digits (four for Amex) and any future date. They are not checked, which is why specific numbers exist to trigger CVC and expiry failures.
How do I test a declined payment?
Use a number that declines on purpose, such as 4000 0000 0000 0002 for a generic decline or 4000 0000 0000 9995 for insufficient funds, in Stripe test mode.
Do test numbers work with every processor?
Not reliably. Each processor publishes its own list. Use the one from the processor you integrate with.
Is it safe to generate my own Luhn-valid numbers?
Not for anything that might reach a processor. A generated number on a real issuer prefix may be a real card. Use published test numbers.
Why does my form reject a valid Mastercard?
It probably only accepts 51 to 55. Mastercard also issues from 2221 to 2720; test with 2223 0031 2200 3222.
Keep going
All safe test data Test phone numbers → Fake data generator →
More from Learning
Guides and references for test data, file handling and AI evals. All free, no sign-up. See the full hub.