Guides for payment testing and card data

Practical, source-checked guides for developers, QA engineers and merchants: how card numbers work, how to test checkouts in each gateway’s sandbox, and how to keep fraud and real card data out of your systems.

Testing payments

Sandboxes, test cards, 3-D Secure and webhooks, gateway by gateway.

Testing payments 3-D Secure testing explained Frictionless vs challenge flows, the outcomes to test, and official 3DS test cards for six gateways with their quirks. 10 min read Testing payments How to test PayPal and Braintree sandbox payments Sandbox accounts, CCREJECT name triggers, Braintree’s amount-based declines, CVV/AVS values and 3D Secure test cards. 9 min read Testing payments How to test a Stripe checkout end to end Sandbox keys, test cards for every outcome, 3D Secure, Radar and webhooks with the Stripe CLI, plus a go-live checklist. 9 min read

Card numbers explained

What the digits, security codes and expiry dates on a card mean.

Card numbers explained Card expiry dates: formats, validation and edge cases MM/YY parsing, the last-day-of-month rule, time zones, autofill attributes and how gateways treat expiry in test mode. 8 min read Card numbers explained CVV vs CVC vs CID: card security codes explained The names each network uses for the security code, how it is generated, how to validate it, and the PCI DSS rule on storing it. 8 min read Card numbers explained Do credit card generators work? What a generator really produces, why the numbers carry no money, what is legal, and where they are genuinely useful. 8 min read Card numbers explained Virtual credit cards explained: how real VCCs work and when to use one Real virtual cards from banks and fintechs: single-use and merchant-locked numbers, limits, wallet tokens, and when to use one. 8 min read

BIN & issuers

Bank identification numbers, the 8-digit change and what a lookup tells you.

BIN & issuers 6-digit vs 8-digit BINs: the ISO/IEC 7812 change explained Why issuer prefixes grew to eight digits, the 2022 network timeline, PCI DSS truncation rules and a migration checklist. 7 min read BIN & issuers What is a BIN number, and what does a BIN lookup tell you? BIN vs IIN, the first digit, network ranges, and what a BIN lookup can and can’t tell a merchant or developer. 8 min read

Fraud prevention for merchants

Spot invalid numbers and stop card-testing attacks on your checkout.

Fraud prevention for merchants Card-testing fraud: how merchants detect and stop it Recognize an enumeration attack on your checkout, then shut it down with bot protection, velocity limits, CVV/AVS and 3-D Secure. 9 min read Fraud prevention for merchants How to spot a fake credit card number The format, BIN and issuer checks a merchant can run, and what each one can and cannot prove about a card number. 9 min read

Developer how-tos

Validation code, regex, IBANs and keeping real card data out of test systems.

Developer how-tos Credit card regex: validation patterns for every brand Tested patterns for eight card brands, ready-made JS, Python and PHP code, and the pitfalls that reject real customers. 8 min read Developer how-tos IBAN explained: structure, check digits and test IBANs Country code, check digits and BBAN, a worked mod-97 example, lengths by country, code, and safe IBANs for testing. 9 min read Developer how-tos Test data and PCI DSS: keeping real card data out of non-production PCI DSS 6.5.5 and 6.5.6 in practice: synthetic card data, gateway test cards, log scrubbing, PAN scanning and safe staging copies. 8 min read

Written for developers, QA teams and merchants. Generated card numbers are test data: they are not real cards and cannot pay for anything.