Testing with Processors
Most payment processors give you two completely separate environments: a test
(sandbox) account for trying things out, and a live account for taking real
money. They have separate logins, separate credentials, and separate data.
Use the right cards in the right place
- In a test environment, only ever use the processor's test cards. Test
cards are fake numbers that simulate approvals, declines, and other outcomes
without any money moving. - In a live environment, only ever use real cards for genuine transactions.
Never mix the two. Don't put a real card into a test environment, and don't use
test cards in live.
Putting real cardholder data through a non-production environment is a breach of
the PCI DSS rules that govern how card
data must be handled — test environments are not built to protect real card
numbers. And test cards in a live environment simply won't work, and may be flagged
as fraud.
Test and live don't promote
A test account is not a draft of your live account. There is no promotion of a
test account — its configuration or its data — into live. The two are entirely
independent. When you're ready to go live, you connect the live account
separately and set it up in its own right.
Where to find each processor's test cards
Every processor has its own test cards. Each one is listed on that processor's page
under Processors — look for the Test cards link in the
At a glance section, which takes you straight to that processor's official test
card details.
Where a processor doesn't publish test cards openly, request them from the gateway
directly.