FakecreditcardHow PayPal test cards work
These cards are for Expanded Checkout card fields (also called advanced credit and debit card payments). They work only in the sandbox, with a sandbox client ID and the api-m.sandbox.paypal.com endpoints. Use any future expiry date and a three-digit CVV (four digits for American Express).
PayPal does not use special card numbers for declines. Instead, you type a rejection trigger into the first name or name-on-card field. The order is still created, but the capture comes back DECLINED with the processor response code shown below. PayPal suggests a Visa such as 4012 8888 8888 1881 for these tests. Trigger values are case-sensitive.
PayPal’s developer site also has a card generator for sandbox numbers by brand and country. The 3D Secure test cards differ by issuing country and by flow: cards for purchase flows don’t work for saving a payment method, and the reverse is also true.
3D Secure test cards (US-issued, purchase flow)
US-issued Visa and Mastercard cards for the purchase flow. PayPal lists equivalent cards for other brands and for the UK, China, Australia, France, Germany, Italy, Japan, Mexico and Spain. Pick cards from the country you are testing.
| Brand | Number | Result | Copy |
|---|---|---|---|
| Visa | 4868 7191 9682 9038 | Successful Frictionless Authentication | |
| Mastercard | 5329 8797 0782 4603 | Successful Frictionless Authentication | |
| Visa | 4868 7191 5813 0060 | Failed Frictionless Authentication | |
| Mastercard | 5329 8797 6957 1910 | Failed Frictionless Authentication | |
| Visa | 4868 7195 8192 0723 | Attempts Stand-In Frictionless Authentication | |
| Mastercard | 5329 8797 1539 6727 | Attempts Stand-In Frictionless Authentication | |
| Visa | 4868 7190 3348 2561 | Unavailable Frictionless Authentication | |
| Mastercard | 5329 8797 0577 7613 | Unavailable Frictionless Authentication | |
| Visa | 4868 7190 8156 4153 | Rejected Frictionless Authentication | |
| Mastercard | 5319 5418 6551 8409 | Rejected Frictionless Authentication | |
| Visa | 4868 7194 8865 1967 | Authentication Not Available on Lookup | |
| Mastercard | 5329 8797 1446 2553 | Authentication Not Available on Lookup | |
| Visa | 4868 7191 6610 1368 | Successful Step-up Authentication | |
| Mastercard | 5329 8797 3531 6929 | Successful Step-up Authentication | |
| Visa | 4868 7191 8189 5556 | Failed Step-Up Authentication | |
| Mastercard | 5329 8797 6801 3724 | Failed Step-Up Authentication | |
| Visa | 4868 7195 5771 8580 | Step-Up Authentication is Unavailable | |
| Mastercard | 5329 8797 3480 8405 | Step-Up Authentication is Unavailable |
Decline triggers (name on card)
Type one of these values in the first name or name-on-card field, with any card from the table above, to force a declined capture:
| Name on card | Result |
|---|---|
| CCREJECT-REFUSED | Card refused: processor response_code 0500 (DO_NOT_HONOR) |
| CCREJECT-SF | Fraudulent card: processor response_code 9500 (SUSPECTED_FRAUD. Try using another card. Do not retry the same card.) |
| CCREJECT-EC | Card expired: processor response_code 5400 (EXPIRED_CARD) |
| CCREJECT-IRC | Luhn Check fails: processor response_code 5180 (INVALID_OR_RESTRICTED_CARD. Try using another card. Do not retry the same card.) |
| CCREJECT-IF | Insufficient funds: processor response_code 5120 (INSUFFICIENT_FUNDS) |
| CCREJECT-LS | Card lost, stolen: processor response_code 9520 (LOST_OR_STOLEN. Try using another card. Do not retry the same card.) |
| CCREJECT-IA | Card not valid: processor response_code 1330 (INVALID_ACCOUNT) |
| CCREJECT-BANK_ERROR | Card is declined: processor response_code 5100 (GENERIC_DECLINE) |
| CCREJECT-CVV_F | CVC check fails: processor response_code 00N7 (CVV2_FAILURE_POSSIBLE_RETRY_WITH_CVV) |
All rejection scenarios return AVS code G (globally unavailable) and CVV code P (not processed).
Testing PayPal payments step by step
- Create a sandbox app in the PayPal developer dashboard and use its sandbox client ID and secret.
- Render the card fields and pay with a card from the first table to confirm order creation and capture.
- Type a
CCREJECT-…value in the name field to simulate each decline and check how your UI handles theDECLINEDcapture status. - Run the 3D Secure cards with SCA set to
SCA_ALWAYSorSCA_WHEN_REQUIREDand check theliability_shiftvalue in the response.
Common errors and fixes
- Card accepted in sandbox but rejected in production
- Expected: sandbox cards are only valid against the sandbox endpoints.
- Decline trigger ignored
- Values are case-sensitive and go in the first name / name on card field, not the card number.
- 3DS card returns an unexpected result
- Purchase-flow cards and save-payment-method cards are different lists. Save-payment-method cards also need expiry month 01 and the current year + 3.
Sources
Every number on this page was copied from PayPal’s official documentation and passes the Luhn check. Checked October 2026; gateways change their test data from time to time, so if a number stops working, check the source:
Frequently asked questions
What test card can I use for PayPal sandbox?
For example 4012 8888 8888 1881 (Visa) or 2223 0000 4840 0011 (Mastercard) with any future expiry date and any three-digit CVV.
How do I simulate a declined card in PayPal sandbox?
Enter a rejection trigger such as CCREJECT-REFUSED or CCREJECT-IF (insufficient funds) as the name on the card. The capture is declined with the matching response code.
Do PayPal sandbox cards work with a PayPal account login?
These numbers are for card payments in Expanded Checkout. To test paying with a PayPal wallet, log in with a sandbox personal account instead.
Can I use these test cards on another gateway?
Usually not. Each gateway only recognises its own documented test numbers in its own sandbox. Some numbers, such as 4111 1111 1111 1111, appear in several lists, but the results they trigger differ. For format-only testing on your own forms, use our card generator.