Use 4242 4242 4242 4242 with any future expiry and any CVC for a successful test payment on Stripe, and on Flint. Every processor documents its own test values, and they differ more than most developers expect: only Stripe has a per-scenario card-number matrix; the rest trigger failures with magic CVVs, cardholder names, amounts, or ZIP codes.
Flint's payments API with orders built in processes cards on Stripe, so Stripe's standard test cards work in every Flint sandbox with no Stripe account needed. Use the nine test cards from the testing guide. Any future expiry, any 3-digit CVC, and any ZIP work. A decline never ends a Flint checkout session: the order stays open and the buyer can retry.
Card
Scenario
What happens
Success
Payment succeeds immediately; the order becomes paid.
Requires authentication
A 3D Secure challenge opens; complete it and the payment succeeds.
3D Secure challenge
Same challenge flow; complete it to succeed, fail it to decline.
Decline: insufficient funds
Checkout shows a payment-failed message; the order stays open.
Decline: generic
Same, simulating a generic issuer decline.
Decline: expired card
Same, simulating an expired card.
Decline: incorrect CVC
Same, simulating a bad security code.
Decline: processing error
Same, simulating a processor-side failure.
Saves, then fails
Attaches to a customer, but every charge fails. Use it to rehearse renewal failures and dunning.
Find a card by scenario
What you enter, per processor. Where a cell names a trigger instead of a card, use any of that processor's success cards and apply the trigger.
Successful payment
Stripe
Square
4111111111111111 with CVV 111
Adyen
4111111111111111, 03/2030, CVC 737
Braintree
4111111111111111, amount under 2000.00
PayPal (cards)
371449635398431 (Amex) or generator card
Authorize.net
Generic decline
Stripe
Square
Adyen
cardholder name DECLINED
Braintree
amount 2000.00 (Do Not Honor)
PayPal (cards)
cardholder name CCREJECT-REFUSED
Authorize.net
ZIP code 46282
Insufficient funds
Stripe
Square
not documented for cards
Adyen
cardholder name NOT_ENOUGH_BALANCE
Braintree
amount 2001.00
PayPal (cards)
not documented
Authorize.net
not documented
3D Secure challenge
Stripe
Square
4310000000201019, code 123456
Adyen
4917610000000000, password 'password'
Braintree
4000000000002503, expiry 01/(year+3)
PayPal (cards)
4868719166101368, expiry 01/(year+3)
Authorize.net
not documented
Authentication fails
Stripe
click Fail in the test challenge dialog
Square
Adyen
enter any wrong challenge password
Braintree
PayPal (cards)
Authorize.net
not documented
Expired card
Stripe
Square
expiry 01/40 (validation error)
Adyen
cardholder name CARD_EXPIRED
Braintree
amount 2004.00
PayPal (cards)
cardholder name CCREJECT-EC
Authorize.net
not documented
Incorrect CVC
Stripe
Square
CVV 911
Adyen
cardholder name CVC_DECLINED
Braintree
amount 2010.00
PayPal (cards)
cardholder name CCREJECT-CVV_F
Authorize.net
CVV 901
Dispute / chargeback
Stripe
Square
amount 8801 to 8809 (minor units)
Adyen
not documented
Braintree
PayPal (cards)
not documented
Authorize.net
not documented
Every processor's test values
Stripe
Card-number-driven: nearly every scenario has a dedicated card number, which is why Stripe's matrix is the one most developers memorize. Official testing docs.
Any future expiry, any CVC (4 digits for Amex), any postal code.
If you omit the CVC or postal code, Stripe skips that check entirely, so omission can never fail.
Real card numbers are prohibited in test mode by the Stripe Services Agreement.
Card
Brand
Scenario
Behavior
Visa
Success
Succeeds immediately.
Mastercard
Success
Succeeds immediately.
Mastercard (2-series)
Success
Succeeds; exercises the 2-series BIN.
Amex
Success
Succeeds immediately. Requires: 4-digit CVC.
Discover
Success
Succeeds immediately.
Diners Club
Success
Succeeds immediately.
JCB
Success
Succeeds immediately.
UnionPay
Success
Succeeds immediately.
Visa (debit)
Success
Succeeds as a debit card.
Mastercard (prepaid)
Success
Succeeds as a prepaid card.
Visa
Generic decline
Declined with card_declined / generic_decline.
Visa
Insufficient funds
Declined with insufficient_funds.
Visa
Lost card
Declined with lost_card.
Visa
Stolen card
Declined with stolen_card.
Visa
Expired card
Declined with expired_card.
Visa
Incorrect CVC
Declined with incorrect_cvc. Requires: provide a CVC.
Visa
Processing error
Declined with processing_error.
Visa
Incorrect number
Rejected with incorrect_number; deliberately fails the Luhn check.
Visa
Velocity exceeded
Declined with card_velocity_exceeded.
Visa
3DS: required for setup
Requires authentication; on-session it challenges, then off-session use succeeds.
Visa
3DS: always
Requires authentication on every transaction.
Visa
3DS: challenge
3D Secure required; complete the challenge to succeed.
Visa
3DS: frictionless
Authentication required but completes without a challenge UI.
Visa
3DS: authenticate, then decline
Challenge succeeds, then the charge is declined.
Visa
3DS: then insufficient funds
Challenge succeeds, then declines with insufficient_funds.
Visa
Dispute: fraudulent
Charge succeeds, then is immediately disputed as fraudulent.
Visa
Dispute: not received
Charge succeeds, then disputed as product not received.
Visa
Dispute: inquiry
Charge succeeds, then disputed as an inquiry.
Visa
Early fraud warning
Charge succeeds, then receives an early fraud warning.
Visa
Refund: async success
Refund starts pending, then transitions to succeeded.
Visa
Refund: fails later
Refund initially succeeds, then transitions to failed.
Visa
Attach, then charge fails
Saves to a customer but every charge fails; the renewal-failure rehearsal card.
Visa
CVC check fails
CVC check fails if a CVC is provided; the charge itself may still succeed. Requires: provide a CVC.
Visa
Postal check fails
Postal code check fails if one is provided. Requires: provide a postal code.
Trigger values
Field
Value
Effect
Challenge dialog
Complete / Fail buttons
Authentication failure is a UI mechanism, not a card: the test-mode 3DS dialog offers explicit Complete and Fail buttons.
Square
Hybrid: fixed success numbers per brand, then magic values (CVV, postal code, expiry, amount) for failures. There is no per-scenario decline card matrix. Official testing docs.
The CVV is semantically significant: 111 succeeds (1111 for Amex), 911 fails.
Postal code is required for USD, CAD, and GBP; 99999 specifically fails verification.
Sandbox environment only, with separate sandbox credentials.
Card
Brand
Scenario
Behavior
Visa
Success
Approved. Requires: CVV 111.
Mastercard
Success
Approved. Requires: CVV 111.
Amex
Success
Approved. Requires: CVV 1111.
Discover
Success
Approved. Requires: CVV 111.
JCB
Success
Approved. Requires: CVV 111.
UnionPay
Success
Approved. Requires: CVV 123.
Visa
Generic decline
Declined with GENERIC_DECLINE.
Visa
Card-on-file declined
Card-on-file authorization declined; the save-card failure path.
Visa
SCA: frictionless
Strong customer authentication succeeds without a challenge. Requires: CVV 111.
Visa (EU)
SCA: challenge
Opens a challenge modal; enter code 123456 to succeed. Requires: CVV 111.
Mastercard
SCA: challenge
Challenge modal; code 123456 to succeed. Requires: CVV 111.
Visa
SCA: fails
Verification fails without showing a challenge. Requires: CVV 111.
Trigger values
Field
Value
Effect
CVV
911
Incorrect CVV (CVV_FAILURE).
Postal code
99999
Postal code verification fails (AVS failure).
Expiry
01/40
Expiration error; a validation-style failure rather than an issuer expired-card decline.
Charge amount
8801 to 8809 (minor units)
Triggers a sandbox dispute; the reason maps per amount (8806 is NOT_RECEIVED). Sandbox disputes are API-only.
Not officially documented for Square: Insufficient funds for card payments (documented for ACH only). Lost or stolen card declines.
Adyen
Trigger-driven: brand test cards authorize by default, and you force specific refusals by setting the cardholder name to a trigger string. Declines are not dedicated card numbers. Official testing docs.
Standard test expiry is 03/2030; CVC 737 (7373 for Amex).
The 3DS2 challenge completes with the password 'password' on web or '1234' in native apps; any other value fails authentication.
Test platform only.
Card
Brand
Scenario
Behavior
Visa
Success
Authorized. Requires: 03/2030, CVC 737.
Mastercard
Success
Authorized. Requires: 03/2030, CVC 737.
Amex
Success
Authorized. Requires: 03/2030, CID 7373.
Discover
Success
Authorized. Requires: 03/2030, CVC 737.
Visa
3DS2: enrolled
Runs the 3DS2 flow; challenge password completes it.
Mastercard
3DS2: frictionless
Device fingerprint only; no shopper interaction.
Mastercard
3DS2: timeout
Produces a 3DS timeout error.
Trigger values
Field
Value
Effect
Cardholder name
DECLINED
Refused (acquirer code 2).
Cardholder name
NOT_ENOUGH_BALANCE
Refused: Not enough balance (code 12).
Cardholder name
CARD_EXPIRED
Refused: Expired Card (code 6).
Cardholder name
BLOCK_CARD
Refused: Blocked Card (code 5).
Cardholder name
CVC_DECLINED
Refused: CVC Declined (code 24).
Cardholder name
FRAUD
Refused: FRAUD (code 20).
Cardholder name
ISSUER_UNAVAILABLE
Refused: Issuer Unavailable (code 9).
Cardholder name
refund failed
Simulates a failed refund.
Not officially documented for Adyen: Lost or stolen card triggers. Dispute simulation cards.
Braintree
Amount-driven declines: any valid test card charged an amount between 2000.00 and 2999.99 declines with the processor code equal to the amount. Dedicated cards exist for verification failures, 3DS, and disputes. Official testing docs.
Amounts 0.01 to 1999.99 authorize; 2000.00 to 2999.99 decline with the code equal to the amount.
3DS test cards require expiry month 01 and year equal to the current year plus three.
AVS and CVV responses come from magic values (postal 20000 fails; CVV 200 fails).
Card
Brand
Scenario
Behavior
Visa
Success
Approved. Requires: amount under 2000.00.
Mastercard
Success
Approved. Requires: amount under 2000.00.
Amex
Success
Approved. Requires: amount under 2000.00.
Visa
Verification fails
Card verification declines; cannot be vaulted with verification on.
Visa
Dispute
Any sale is instantly disputed; respond with the documented evidence strings to win or lose.
Visa
3DS: frictionless success
Authenticates with no challenge. Requires: expiry 01/(year+3).
Visa
3DS: challenge success
Complete the challenge to authenticate. Requires: expiry 01/(year+3).
Visa
3DS: challenge fails
Challenge is presented and authentication fails. Requires: expiry 01/(year+3).
Visa
3DS: frictionless fails
Fails authentication with no challenge. Requires: expiry 01/(year+3).
Trigger values
Field
Value
Effect
Amount
2000.00
Processor decline 2000: Do Not Honor.
Amount
2001.00
Processor decline 2001: Insufficient Funds.
Amount
2004.00
Processor decline 2004: Expired Card.
Amount
2010.00
Processor decline 2010: Card Issuer Declined CVV.
Amount
2044.00
Processor decline 2044: Declined, Call Issuer.
CVV
200
CVV response N (does not match).
Postal code
20000
AVS response N (no match).
PayPal (cards)
Name-field-driven declines: success numbers come mostly from the sandbox card generator, and declines are triggered by case-sensitive CCREJECT strings in the cardholder name. Official testing docs.
Any future expiry; 3DS test cards require month 01 and year equal to the current year plus three.
Visa and Mastercard success numbers come from the sandbox credit card generator.
Card
Brand
Scenario
Behavior
Amex
Success
Approved. Requires: 4-digit CVV.
Visa
3DS: frictionless success
Authenticates without a challenge; liability shift possible. Requires: expiry 01/(year+3).
Visa
3DS: challenge success
Complete the step-up challenge to authenticate. Requires: expiry 01/(year+3).
Visa
3DS: challenge fails
Step-up authentication fails; no liability shift. Requires: expiry 01/(year+3).
Visa
3DS: frictionless fails
Frictionless authentication fails; no liability shift. Requires: expiry 01/(year+3).
Trigger values
Field
Value
Effect
Cardholder name
CCREJECT-REFUSED
Decline 0500: DO_NOT_HONOR. Case-sensitive.
Cardholder name
CCREJECT-SF
Decline 9500: SUSPECTED_FRAUD.
Cardholder name
CCREJECT-EC
Decline 5400: EXPIRED_CARD.
Cardholder name
CCREJECT-CVV_F
Decline 00N7: CVV failure, retry possible with CVV.
Not officially documented for PayPal (cards): Insufficient funds trigger. Dispute-trigger cards.
Authorize.net
ZIP-code-driven declines: fixed success numbers per brand, and the general decline trigger is ZIP code 46282 rather than a card number. Amount-based triggers were retired in 2011. Official testing docs.
Any expiry after today.
The ZIP code is semantically significant: specific ZIPs trigger declines and AVS responses.
Card
Brand
Scenario
Behavior
Visa
Success
Approved.
Mastercard
Success
Approved.
Amex
Success
Approved.
Discover
Success
Approved.
Trigger values
Field
Value
Effect
ZIP code
46282
Response code 2: transaction declined (general bank decline) with any test card.
CVV
901
CVV response N (does not match).
ZIP code
46205
AVS response N (no match).
Not officially documented for Authorize.net: 3DS test cards. Insufficient funds, expired, lost, or stolen scenarios. Dispute triggers.
Pitfalls
Expiry and CVC conventions differ per processor and are a real gotcha: Stripe accepts any future expiry and any CVC, Square's CVV is semantically significant (111 succeeds, 911 fails), Adyen expects 03/2030 with CVC 737, and Braintree and PayPal 3DS cards demand month 01 with the year three years out.
Test values only work in that processor's test or sandbox environment, and real card numbers are prohibited in Stripe test mode by the Stripe Services Agreement.
4242 4242 4242 4242 and 4111 1111 1111 1111 both pass the Luhn check; Stripe also documents 4242 4242 4242 4241 as a deliberately Luhn-invalid card for testing your own validation.
Failure scenarios that a processor does not document cannot be simulated there; the per-processor notes above say what is missing rather than guessing.
Related
Testing on Flint: end-to-end sandbox rehearsals for payments, webhooks, refunds, and renewals.
