Checkout.com test cards

Use these details to try payments in a Checkout.com sandbox (test) account. They work only in the sandbox: never use them in live, and never put real card or bank details into a sandbox.

The sandbox keeps payments for 30 days, so finish each test payment flow within 30 days of starting it. SEPA Direct Debit has to be switched on in the sandbox by your Checkout.com account manager or implementation engineer before you can test it.

Where these details come from

These are Checkout.com’s test details, not ours. They were copied from Checkout.com’s Test cards, AVS check testing, ACH Direct Debit for Unified Payments API and SEPA direct debit for Unified Payments API pages on 19 October 2026, and were correct on that date as far as those pages show. Checkout.com can change or withdraw them at any time, and we can’t confirm that they work. Check Checkout.com’s pages for the current details, and ask Checkout.com if one doesn’t behave as described.

How to choose a test result

• The card number sets the result for most card tests, with any future expiry date and any valid CVV (Test cards).
• One decline is set by the amount: card 4242 4242 4242 4242 with an amount of 101 in minor units. We convert the amount you enter into minor units, so enter 1.01 in a two-decimal currency such as USD, GBP or EUR.
• We ask Checkout.com for 3D Secure on every card payment the customer makes in the checkout, but not on staff-entered (MOTO) or recurring payments. Use the 3D Secure cards below to choose how authentication ends.
• For address checks, the first line of the billing address sets the result (AVS check testing). Keep Requires address (AVS) switched on in the Checkout.com connection settings (it is on by default), and enter the value, for example Test_Y, exactly as address line 1 with any postcode. We send it unchanged.
• For ACH (USD only), switch on Enable ACH in the connection settings. The routing number, account number and, for some rows, the account holder name set the result (ACH Direct Debit). Enter the name exactly as shown in the name on account field: we send it to Checkout.com unchanged, as a single account holder name. Checkout.com documents these values for its Unified Payments API, whereas we create ACH payments through Checkout.com’s sources API, and our own tests don’t cover them.
• For SEPA Direct Debit (EUR only), switch on Enable SEPA in the connection settings. The IBAN doesn’t set the result: Checkout.com moves a test payment on only through sandbox links it returns to the API caller (SEPA direct debit). We don’t show those links, so a SEPA result can’t be chosen here.

Cards

Use any future expiry date and any valid three-digit CVV, or four digits for American Express, unless a row says otherwise.

Successful payments

Card	Number	Notes
Visa	4242 4242 4242 4242
Visa	4000 0200 0000 0000
Visa (debit)	4659 1055 6905 1157
Mastercard	5436 0310 3060 6378
Mastercard (debit)	5305 4847 4880 0098
American Express	3456 789012 34564	Four-digit CVV
Discover	6011 1111 1111 1117
Diners Club	3616 0940 9339 14
JCB	3566 0270 4676 5007

Declines and errors

The code in brackets is Checkout.com’s response code. Checkout.com lists more cards on its Test cards page.

Number or trigger	Result
4242 4242 4242 4242 with a payment amount of 101 in Checkout.com’s minor units (1.01 in a two-decimal currency)	Declined: insufficient funds (20051)
4544 2491 6767 3670	Declined: insufficient funds (20051)
5437 8211 3539 9682	Declined: insufficient funds (20051), Mastercard
4111 1111 1111 1129	Declined: refer to card issuer (20001)
4485 3815 7718 2090	Declined: invalid card number (20014)
4734 8689 5873 3862	Declined: CVV2 failure (200N7)
4151 5127 3630 5999	Declined: transaction not permitted to cardholder (20057)
4897 4535 6848 5113	Declined: suspected fraud (20059)
4818 9242 5013 1070	Declined: restricted card (20062)
4152 8125 2183 3588	Declined: blocked by cardholder (2009G)
4941 2020 6099 9329	Declined: lost card, pick up (30041)
4539 2536 5571 1767	Declined: stolen card, pick up (30043)
5525 1921 4223 0002	Declined: closed account (30046), Mastercard
4500 6228 6834 1387	Declined: 3D Secure authentication required (20154)
4095 2548 0264 2505	Error: response too late or timeout, transaction rejected, or internal error (20068)
4546 3812 1939 3284	A card verification (zero amount) succeeds; any payment above zero is declined: insufficient funds (20051)

3D Secure

If a challenge takes you to Checkout.com’s 3D Secure simulator page, enter the password Checkout1!.

Number	Result
4485 0403 7153 6584	Visa. Frictionless: authenticated
5588 6861 1642 6417	Mastercard. Frictionless: authenticated
4556 5747 2232 5580	Visa. Frictionless: authentication attempted
4539 6283 4711 7863	Visa. Frictionless: not authenticated
4275 7655 7431 9271	Visa. Frictionless: authentication rejected
4024 0071 8664 5015	Visa. Frictionless: authentication couldn’t be performed
4484 0700 0003 5519	Visa. Card not enrolled in 3D Secure
5385 3083 6013 5181	Mastercard. Challenge: authenticated
3726 885818 99681	American Express. Challenge: authenticated
4152 8685 5277 3614	Visa. Challenge: authentication attempted
4243 7542 7170 0719	Visa. Challenge: not authenticated
3759 822397 96002	American Express. Challenge: authentication rejected
4447 3367 7537 8848	Visa. Challenge: authentication couldn’t be performed
4539 9292 0712 0660	Visa. Challenge: error message during scheme communication
4532 4324 5290 0131	Visa, CVV 257. Not enabled for 3D Secure: a payment that asks for 3D Secure returns 20150, card not 3D Secure enabled

Address and CVC checks

Enter one of these as the first line of the billing address, and enter any postcode: the check only works when both are given. The checkout asks for the address only when Requires address (AVS) is switched on in the connection settings. Any other address line 1 gives a valid address.

Value	Result
Test_Y	AVS Y: street and five-digit postcode match
Test_A	AVS A: street matches
Test_Z	AVS Z: five-digit postcode matches
Test_N	AVS N: no address match
Test_R	AVS R: AVS not available
Test_U	AVS U: match not capable

For a CVV failure, use card 4734 8689 5873 3862 (see Declines and errors).

Apple Pay and Google Pay

We take Apple Pay and Google Pay as network tokens, through our own wallet integration rather than Checkout.com’s. To test them, see Testing Apple Pay and Google Pay.

ACH (US bank accounts)

Where a row has no account number, Checkout.com’s table doesn’t give one: the routing number, and the account holder name where shown, set the result. Enter the account holder name exactly as shown in the name on account field.

Routing number	Account number	Result
021000021	1234567890	Approved (captured)
091000022		Declined (20000). Account holder name Green Co
011075150		Returned, R01: insufficient funds (20051). Account holder name Widget Inc
	9999999999	Returned, R02: account closed (30046)
122105155		Returned, R05: unauthorised debit to consumer account (30R05)
082000549		Returned, R07: authorisation revoked by customer (20R07)
121122676		Returned, R10: customer advises not authorised (20R10)
122235821		Returned, R29: corporate customer advises not authorised (20R29)
	8888888888	Approved, then a notification of change, C01: incorrect bank account number. Account holder name Checkout Inc

Checkout.com lists more notification of change scenarios (C02 to C07) on its ACH Direct Debit page.

SEPA Direct Debit

Checkout.com doesn’t publish test IBANs: it says to use any valid IBAN, for example one made with an online IBAN generator. The IBAN doesn’t set the result: to move a test SEPA payment to accepted, rejected, returned or charged back, a developer calls the sandbox links that Checkout.com returns with the payment.

The SEPA Direct Debit network blocks refunds until seven days after the payment was created.