Cybersource test cards

Use these details to try payments in a Cybersource sandbox (test) account. They work only in the sandbox: never use them in live, and never put real card or bank details into a sandbox.

You need Cybersource sandbox credentials first: see Cybersource sandbox credentials.

Where these details come from

These are Cybersource’s test details, not ours. They were copied from Cybersource’s Testing guide and its 3-D Secure test case pages (Test Cases for 3-D Secure 2.x, Frictionless Authentication Is Successful, Frictionless Authentication Is Unsuccessful, Step-Up Authentication Is Successful and Step-Up Authentication Is Unsuccessful) on 19 October 2026, and were correct on that date as far as those pages show. Cybersource can change or withdraw them at any time, and we can’t confirm that they work. Check Cybersource’s pages for the current details, and ask Cybersource if one doesn’t behave as described.

How to choose a test result

• Any card below with an expiry date after today is approved. Cybersource says its sandbox’s responses mostly depend on the payment amount, and the decline, address check and CVC triggers depend on the processor your sandbox account uses: choose yours on the Testing guide. Enter the amount at the checkout as you’d normally type it (for example 1.00): we send it to Cybersource unchanged.
• For address check results, set Address Verification in the Cybersource connection settings to Full Address (incl. email), Full Address (relaxed) or Zip Only (relaxed), so that the checkout asks for a billing address and we send it. With Zip Only (relaxed), we send unknown for the street, city and state. With Disabled, no address is sent and address checks can’t be tested.
• Enter CVC triggers in the checkout’s CVC field.
• For 3D Secure, switch on Enable 3DS in the Cybersource connection settings (3-D Secure must also be enabled on your Cybersource account). We run 3D Secure only when the customer pays online, not for payments staff take over the phone or for scheduled payments. Use the expiry date given above the 3D Secure table (Test Cases for 3-D Secure 2.x).

Cards

Use any expiry date after today. If a CVC is needed, use any three digits, or four digits for American Express. Cybersource lists more cards on its testing guide.

Decline, address check and CVC results in Cybersource’s sandbox depend on the processor your sandbox account is set up with. Cybersource’s Testing guide lists the triggers for each processor: choose yours from the list on that page.

Successful payments

Card	Number	Notes
Visa	4111 1111 1111 1111
Mastercard	5555 5555 5555 4444
Mastercard (2-series)	2222 4200 0000 1113
American Express	3782 822463 10005	Four-digit CVC
Discover	6011 1111 1111 1117
JCB	3566 1111 1111 1113
Maestro (international)	5033 9619 8909 17
Maestro (UK domestic)	6759 4111 0000 0008

3D Secure

Use expiry month January and a year three years from now (for example, 01/2029 in 2026). Cybersource lists more card brands on its 3-D Secure test case pages.

Number	Result
4000 0000 0000 2701 (Visa)	No challenge: authentication succeeds
3400 000000 02708 (American Express)	No challenge: authentication succeeds
6011 0000 0000 2117 (Discover)	No challenge: authentication succeeds
4000 0000 0000 2925 (Visa)	No challenge: authentication fails, so the payment shouldn’t go ahead
5200 0000 0000 2276 (Mastercard)	No challenge: authentication fails, so the payment shouldn’t go ahead
3400 000000 02096 (American Express)	No challenge: authentication fails, so the payment shouldn’t go ahead
4000 0000 0000 2503 (Visa)	Challenge, then authentication succeeds
5200 0000 0000 2151 (Mastercard)	Challenge, then authentication succeeds
3400 000000 02534 (American Express)	Challenge, then authentication succeeds
4000 0000 0000 2370 (Visa)	Challenge, then authentication fails, so the payment can’t go ahead
5200 0000 0000 2490 (Mastercard)	Challenge, then authentication fails, so the payment can’t go ahead
3400 000000 02237 (American Express)	Challenge, then authentication fails, so the payment can’t go ahead

Apple Pay and Google Pay

We take Apple Pay and Google Pay as network tokens, through our own wallet integration rather than Cybersource’s. To test them, see Testing Apple Pay and Google Pay.