Test cards on Flint
Flint processes cards on Stripe, so Stripe's standard test cards work in every Flint sandbox with no Stripe account needed. These are the nine worth knowing, from the testing guide. Any future expiry, any 3-digit CVC, and any ZIP work. A decline never ends a Flint checkout session: the order stays open and the buyer can retry.
| Card | Scenario | What happens |
|---|---|---|
| Success | Payment succeeds immediately; the order becomes paid. | |
| Requires authentication | A 3D Secure challenge opens; complete it and the payment succeeds. | |
| 3D Secure challenge | Same challenge flow; complete it to succeed, fail it to decline. | |
| Decline: insufficient funds | Checkout shows a payment-failed message; the order stays open. | |
| Decline: generic | Same, simulating a generic issuer decline. | |
| Decline: expired card | Same, simulating an expired card. | |
| Decline: incorrect CVC | Same, simulating a bad security code. | |
| Decline: processing error | Same, simulating a processor-side failure. | |
| Saves, then fails | Attaches to a customer, but every charge fails. Use it to rehearse renewal failures and dunning. |
Find a card by scenario
What you actually enter, per processor. Where a cell names a trigger instead of a card, use any of that processor's success cards and apply the trigger.
Successful payment
| Stripe | |
| Square | 4111111111111111 with CVV 111 |
| Adyen | 4111111111111111, 03/2030, CVC 737 |
| Braintree | 4111111111111111, amount under 2000.00 |
| PayPal (cards) | 371449635398431 (Amex) or generator card |
| Authorize.net |
Generic decline
| Stripe | |
| Square | |
| Adyen | cardholder name DECLINED |
| Braintree | amount 2000.00 (Do Not Honor) |
| PayPal (cards) | cardholder name CCREJECT-REFUSED |
| Authorize.net | ZIP code 46282 |
Insufficient funds
| Stripe | |
| Square | not documented for cards |
| Adyen | cardholder name NOT_ENOUGH_BALANCE |
| Braintree | amount 2001.00 |
| PayPal (cards) | not documented |
| Authorize.net | not documented |
3D Secure challenge
| Stripe | |
| Square | 4310000000201019, code 123456 |
| Adyen | 4917610000000000, password 'password' |
| Braintree | 4000000000002503, expiry 01/(year+3) |
| PayPal (cards) | 4868719166101368, expiry 01/(year+3) |
| Authorize.net | not documented |
Authentication fails
| Stripe | click Fail in the test challenge dialog |
| Square | |
| Adyen | enter any wrong challenge password |
| Braintree | |
| PayPal (cards) | |
| Authorize.net | not documented |
Expired card
| Stripe | |
| Square | expiry 01/40 (validation error) |
| Adyen | cardholder name CARD_EXPIRED |
| Braintree | amount 2004.00 |
| PayPal (cards) | cardholder name CCREJECT-EC |
| Authorize.net | not documented |
Incorrect CVC
| Stripe | |
| Square | CVV 911 |
| Adyen | cardholder name CVC_DECLINED |
| Braintree | amount 2010.00 |
| PayPal (cards) | cardholder name CCREJECT-CVV_F |
| Authorize.net | CVV 901 |
Dispute / chargeback
| Stripe | |
| Square | amount 8801 to 8809 (minor units) |
| Adyen | not documented |
| Braintree | |
| PayPal (cards) | not documented |
| Authorize.net | not documented |
Every processor's test values
Stripe
Card-number-driven: nearly every scenario has a dedicated card number, which is why Stripe's matrix is the one most developers memorize. Official testing docs.
- Any future expiry, any CVC (4 digits for Amex), any postal code.
- If you omit the CVC or postal code, Stripe skips that check entirely, so omission can never fail.
- Real card numbers are prohibited in test mode by the Stripe Services Agreement.
| Card | Brand | Scenario | Behavior |
|---|---|---|---|
| Visa | Success | Succeeds immediately. | |
| Mastercard | Success | Succeeds immediately. | |
| Mastercard (2-series) | Success | Succeeds; exercises the 2-series BIN. | |
| Amex | Success | Succeeds immediately. Requires: 4-digit CVC. | |
| Discover | Success | Succeeds immediately. | |
| Diners Club | Success | Succeeds immediately. | |
| JCB | Success | Succeeds immediately. | |
| UnionPay | Success | Succeeds immediately. | |
| Visa (debit) | Success | Succeeds as a debit card. | |
| Mastercard (prepaid) | Success | Succeeds as a prepaid card. | |
| Visa | Generic decline | Declined with card_declined / generic_decline. | |
| Visa | Insufficient funds | Declined with insufficient_funds. | |
| Visa | Lost card | Declined with lost_card. | |
| Visa | Stolen card | Declined with stolen_card. | |
| Visa | Expired card | Declined with expired_card. | |
| Visa | Incorrect CVC | Declined with incorrect_cvc. Requires: provide a CVC. | |
| Visa | Processing error | Declined with processing_error. | |
| Visa | Incorrect number | Rejected with incorrect_number; deliberately fails the Luhn check. | |
| Visa | Velocity exceeded | Declined with card_velocity_exceeded. | |
| Visa | 3DS: required for setup | Requires authentication; on-session it challenges, then off-session use succeeds. | |
| Visa | 3DS: always | Requires authentication on every transaction. | |
| Visa | 3DS: challenge | 3D Secure required; complete the challenge to succeed. | |
| Visa | 3DS: frictionless | Authentication required but completes without a challenge UI. | |
| Visa | 3DS: authenticate, then decline | Challenge succeeds, then the charge is declined. | |
| Visa | 3DS: then insufficient funds | Challenge succeeds, then declines with insufficient_funds. | |
| Visa | Dispute: fraudulent | Charge succeeds, then is immediately disputed as fraudulent. | |
| Visa | Dispute: not received | Charge succeeds, then disputed as product not received. | |
| Visa | Dispute: inquiry | Charge succeeds, then disputed as an inquiry. | |
| Visa | Early fraud warning | Charge succeeds, then receives an early fraud warning. | |
| Visa | Refund: async success | Refund starts pending, then transitions to succeeded. | |
| Visa | Refund: fails later | Refund initially succeeds, then transitions to failed. | |
| Visa | Attach, then charge fails | Saves to a customer but every charge fails; the renewal-failure rehearsal card. | |
| Visa | CVC check fails | CVC check fails if a CVC is provided; the charge itself may still succeed. Requires: provide a CVC. | |
| Visa | Postal check fails | Postal code check fails if one is provided. Requires: provide a postal code. |
Trigger values
| Field | Value | Effect |
|---|---|---|
| Challenge dialog | Complete / Fail buttons | Authentication failure is a UI mechanism, not a card: the test-mode 3DS dialog offers explicit Complete and Fail buttons. |
Square
Hybrid: fixed success numbers per brand, then magic values (CVV, postal code, expiry, amount) for failures. There is no per-scenario decline card matrix. Official testing docs.
- The CVV is semantically significant: 111 succeeds (1111 for Amex), 911 fails.
- Postal code is required for USD, CAD, and GBP; 99999 specifically fails verification.
- Sandbox environment only, with separate sandbox credentials.
| Card | Brand | Scenario | Behavior |
|---|---|---|---|
| Visa | Success | Approved. Requires: CVV 111. | |
| Mastercard | Success | Approved. Requires: CVV 111. | |
| Amex | Success | Approved. Requires: CVV 1111. | |
| Discover | Success | Approved. Requires: CVV 111. | |
| JCB | Success | Approved. Requires: CVV 111. | |
| UnionPay | Success | Approved. Requires: CVV 123. | |
| Visa | Generic decline | Declined with GENERIC_DECLINE. | |
| Visa | Card-on-file declined | Card-on-file authorization declined; the save-card failure path. | |
| Visa | SCA: frictionless | Strong customer authentication succeeds without a challenge. Requires: CVV 111. | |
| Visa (EU) | SCA: challenge | Opens a challenge modal; enter code 123456 to succeed. Requires: CVV 111. | |
| Mastercard | SCA: challenge | Challenge modal; code 123456 to succeed. Requires: CVV 111. | |
| Visa | SCA: fails | Verification fails without showing a challenge. Requires: CVV 111. |
Trigger values
| Field | Value | Effect |
|---|---|---|
| CVV | 911 | Incorrect CVV (CVV_FAILURE). |
| Postal code | 99999 | Postal code verification fails (AVS failure). |
| Expiry | 01/40 | Expiration error; a validation-style failure rather than an issuer expired-card decline. |
| Charge amount | 8801 to 8809 (minor units) | Triggers a sandbox dispute; the reason maps per amount (8806 is NOT_RECEIVED). Sandbox disputes are API-only. |
Not officially documented for Square: Insufficient funds for card payments (documented for ACH only). Lost or stolen card declines.
Adyen
Trigger-driven: brand test cards authorise by default, and you force specific refusals by setting the cardholder name to a trigger string. Declines are not dedicated card numbers. Official testing docs.
- Standard test expiry is 03/2030; CVC 737 (7373 for Amex).
- The 3DS2 challenge completes with the password 'password' on web or '1234' in native apps; any other value fails authentication.
- Test platform only.
| Card | Brand | Scenario | Behavior |
|---|---|---|---|
| Visa | Success | Authorised. Requires: 03/2030, CVC 737. | |
| Mastercard | Success | Authorised. Requires: 03/2030, CVC 737. | |
| Amex | Success | Authorised. Requires: 03/2030, CID 7373. | |
| Discover | Success | Authorised. Requires: 03/2030, CVC 737. | |
| Visa | 3DS2: enrolled | Runs the 3DS2 flow; challenge password completes it. | |
| Mastercard | 3DS2: frictionless | Device fingerprint only; no shopper interaction. | |
| Mastercard | 3DS2: timeout | Produces a 3DS timeout error. |
Trigger values
| Field | Value | Effect |
|---|---|---|
| Cardholder name | DECLINED | Refused (acquirer code 2). |
| Cardholder name | NOT_ENOUGH_BALANCE | Refused: Not enough balance (code 12). |
| Cardholder name | CARD_EXPIRED | Refused: Expired Card (code 6). |
| Cardholder name | BLOCK_CARD | Refused: Blocked Card (code 5). |
| Cardholder name | CVC_DECLINED | Refused: CVC Declined (code 24). |
| Cardholder name | FRAUD | Refused: FRAUD (code 20). |
| Cardholder name | ISSUER_UNAVAILABLE | Refused: Issuer Unavailable (code 9). |
| Cardholder name | refund failed | Simulates a failed refund. |
Not officially documented for Adyen: Lost or stolen card triggers. Dispute simulation cards.
Braintree
Amount-driven declines: any valid test card charged an amount between 2000.00 and 2999.99 declines with the processor code equal to the amount. Dedicated cards exist for verification failures, 3DS, and disputes. Official testing docs.
- Amounts 0.01 to 1999.99 authorize; 2000.00 to 2999.99 decline with the code equal to the amount.
- 3DS test cards require expiry month 01 and year equal to the current year plus three.
- AVS and CVV responses come from magic values (postal 20000 fails; CVV 200 fails).
| Card | Brand | Scenario | Behavior |
|---|---|---|---|
| Visa | Success | Approved. Requires: amount under 2000.00. | |
| Mastercard | Success | Approved. Requires: amount under 2000.00. | |
| Amex | Success | Approved. Requires: amount under 2000.00. | |
| Visa | Verification fails | Card verification declines; cannot be vaulted with verification on. | |
| Visa | Dispute | Any sale is instantly disputed; respond with the documented evidence strings to win or lose. | |
| Visa | 3DS: frictionless success | Authenticates with no challenge. Requires: expiry 01/(year+3). | |
| Visa | 3DS: challenge success | Complete the challenge to authenticate. Requires: expiry 01/(year+3). | |
| Visa | 3DS: challenge fails | Challenge is presented and authentication fails. Requires: expiry 01/(year+3). | |
| Visa | 3DS: frictionless fails | Fails authentication with no challenge. Requires: expiry 01/(year+3). |
Trigger values
| Field | Value | Effect |
|---|---|---|
| Amount | 2000.00 | Processor decline 2000: Do Not Honor. |
| Amount | 2001.00 | Processor decline 2001: Insufficient Funds. |
| Amount | 2004.00 | Processor decline 2004: Expired Card. |
| Amount | 2010.00 | Processor decline 2010: Card Issuer Declined CVV. |
| Amount | 2044.00 | Processor decline 2044: Declined, Call Issuer. |
| CVV | 200 | CVV response N (does not match). |
| Postal code | 20000 | AVS response N (no match). |
PayPal (cards)
Name-field-driven declines: success numbers come mostly from the sandbox card generator, and declines are triggered by case-sensitive CCREJECT strings in the cardholder name. Official testing docs.
- Any future expiry; 3DS test cards require month 01 and year equal to the current year plus three.
- Visa and Mastercard success numbers come from the sandbox credit card generator.
| Card | Brand | Scenario | Behavior |
|---|---|---|---|
| Amex | Success | Approved. Requires: 4-digit CVV. | |
| Visa | 3DS: frictionless success | Authenticates without a challenge; liability shift possible. Requires: expiry 01/(year+3). | |
| Visa | 3DS: challenge success | Complete the step-up challenge to authenticate. Requires: expiry 01/(year+3). | |
| Visa | 3DS: challenge fails | Step-up authentication fails; no liability shift. Requires: expiry 01/(year+3). | |
| Visa | 3DS: frictionless fails | Frictionless authentication fails; no liability shift. Requires: expiry 01/(year+3). |
Trigger values
| Field | Value | Effect |
|---|---|---|
| Cardholder name | CCREJECT-REFUSED | Decline 0500: DO_NOT_HONOR. Case-sensitive. |
| Cardholder name | CCREJECT-SF | Decline 9500: SUSPECTED_FRAUD. |
| Cardholder name | CCREJECT-EC | Decline 5400: EXPIRED_CARD. |
| Cardholder name | CCREJECT-CVV_F | Decline 00N7: CVV failure, retry possible with CVV. |
Not officially documented for PayPal (cards): Insufficient funds trigger. Dispute-trigger cards.
Pitfalls
- Expiry and CVC conventions differ per processor and are a real gotcha: Stripe accepts any future expiry and any CVC, Square's CVV is semantically significant (111 succeeds, 911 fails), Adyen expects 03/2030 with CVC 737, and Braintree and PayPal 3DS cards demand month 01 with the year three years out.
- Test values only work in that processor's test or sandbox environment, and real card numbers are prohibited in Stripe test mode by the Stripe Services Agreement.
4242 4242 4242 4242and4111 1111 1111 1111both pass the Luhn check; Stripe also documents4242 4242 4242 4241as a deliberately Luhn-invalid card for testing your own validation.- Failure scenarios that a processor does not document cannot be simulated there; the per-processor notes above say what is missing rather than guessing.
Related
- Testing on Flint: end-to-end sandbox rehearsals for payments, webhooks, refunds, and renewals.
- Card decline codes: what each decline means and whether to retry it.
- Flint's order-first payment API: the platform these sandboxes rehearse against.