Sandbox Test Cards
The Sandbox Gateway is a fictitious card processor for sandbox tenants. It needs no API keys and never moves money, so you can test every card outcome your integration has to handle.
Add "Sandbox Gateway" to your connectors on a sandbox tenant. A sandbox tenant with no card connector uses it automatically.
Every card number is approved, except the test cards on this page. Use any future expiry date, any 3-digit CVC and any cardholder name.
Declined payments
These cards are declined. The payment intent stays open, so the customer can try another card, and the transaction's failure reason carries the code below.
| Card number | Scenario | Failure reason |
|---|---|---|
4000000000000002 | Generic decline | rejected_by_bank |
4000000000009995 | Insufficient funds | insufficient_funds |
4000000000009987 | Lost card | card_reported_lost_or_stolen |
4000000000009979 | Stolen card | card_reported_lost_or_stolen |
4000000000000069 | Expired card | card_expired |
4000000000000127 | Incorrect CVC | wrong_card_credentials |
4000000000000119 | Processing error | issuer_unavailable |
4242424242424241 | Incorrect number | wrong_card_credentials |
4000000000006975 | Velocity limit exceeded | card_limit_exceeded |
4000000000000341 | Declined when charged after being saved | rejected_by_bank |
4100000000000019 | Always blocked as fraud | suspected_fraud |
4000000000004954 | Highest risk, blocked as fraud | suspected_fraud |
4000000000000101 | CVC check fails | wrong_card_credentials |
4000008400001280 | 3D Secure lookup error, then declined | rejected_by_bank |
4242424242424241 fails the card number check, so the Orchestrapay payment form refuses it before it reaches the gateway. Send it through the API to see the decline.
3D Secure
These cards ask for 3D Secure authentication. The payment form opens the authentication step in a modal, the same way it does for a real bank, and the Sandbox Gateway shows a test page there with two buttons:
- Complete authentication finishes the payment with the result in the table.
- Fail authentication declines it with the failure reason
authentication_required.
The four 3D Secure 2 cards each show their own kind of challenge, so you can see how it looks inside your checkout. Every challenge also has a Fail authentication button.
| Card number | Scenario | After you complete authentication |
|---|---|---|
4000000000003220 | 3D Secure required | Approved |
4000008400000027 | 3D Secure required, US card | Approved |
4000002760003184 | 3D Secure on every payment | Approved |
4000002500003155 | 3D Secure unless the card is set up for future payments | Approved |
4000003800000446 | Card already set up, 3D Secure on every payment the customer makes | Approved |
4000582600000094 | 3D Secure 2, out-of-band: approve the payment in a banking app, then confirm | Approved |
4000582600000045 | 3D Secure 2, one-time passcode: enter any 6 digits | Approved |
4000582600000102 | 3D Secure 2, single select: pick where to send the code | Approved |
4000582600000110 | 3D Secure 2, multi select: tick the purchases you recognise | Approved |
4000008400001629 | 3D Secure required, then declined | Declined, rejected_by_bank |
4000008260003178 | 3D Secure required, then insufficient funds | Declined, insufficient_funds |
These cards support 3D Secure but do not need it, so they are approved without the test page:
| Card number | Scenario |
|---|---|
4242424242424242 | Not enrolled in 3D Secure |
4000000000003055 | 3D Secure supported, not required |
4000000000003097 | 3D Secure supported, its lookup errors, not required |
4000000032200000 | Frictionless authentication |
4000008405600003 | Authenticated only when your risk rules ask for it |
378282246310005 | 3D Secure not supported |
Forcing 3D Secure
When an orchestrator node's processing options force 3D Secure on the Sandbox Gateway, every card that would be approved shows the test page first. Declining cards are still declined straight away.
Disputes
These cards are approved, and a few seconds later the Sandbox Gateway opens a dispute on the payment. Your webhook endpoints receive dispute.created (see Dispute Webhook), and the dispute appears on the Disputes page with 7 days to respond.
| Card number | Scenario | Dispute |
|---|---|---|
4000000000000259 | Fraudulent dispute | Chargeback, fraudulent |
4061219946393810 | Fraudulent dispute, opened shortly after the payment | Chargeback, fraudulent |
6026507838377928 | Fraudulent dispute on a Discover card | Chargeback, fraudulent |
4000000000002685 | Product not received | Chargeback, product_not_received |
4000000000001976 | Inquiry | Inquiry, general |
4000000404000079 | Two disputes on one payment | Two chargebacks, fraudulent and product_not_received |
4000000404000038 | Fraudulent dispute, Visa Compelling Evidence 3.0 eligible | Chargeback, fraudulent |
4000008400000779 | Visa compliance dispute | Chargeback, noncompliant |
5105008400000002 | Mastercard compliance dispute | Chargeback, noncompliant |
4000000001000043 | Fraudulent dispute, eligible for automatic responses | Chargeback, fraudulent |
4000000404004816 | Visa Rapid Dispute Resolution card | Chargeback, fraudulent |
4000000404005649 | Verifi dispute deflection card | Chargeback, fraudulent |
5105000300000018 | Ethoca alert card | Chargeback, fraudulent |
4000008400000795 | A partial refund opens a dispute for the rest | Chargeback, fraudulent, see Refunds |
A sandbox tenant is not enrolled in dispute prevention, so the Rapid Dispute Resolution, Verifi and Ethoca cards always open a dispute.
Settling a test dispute
Respond to the dispute from the Disputes page. The Sandbox Gateway decides the outcome from the explanation you write:
| Write in the explanation | A chargeback becomes | An inquiry becomes |
|---|---|---|
winning_evidence | Won | Closed |
losing_evidence | Lost | Closed |
escalate_inquiry_evidence | Under review | A chargeback that needs a response |
| Anything else | Under review | Closed |
Sandbox disputes take evidence as submitted and cannot hold a draft. Each change sends dispute.updated, or dispute.closed once the dispute is won, lost or closed.
Refunds
These cards are approved. Their refunds behave as follows:
| Card number | Scenario |
|---|---|
4000000000005126 | The refund fails |
4000000000007726 | The refund stays pending, then succeeds within about 5 minutes, when Orchestrapay next checks it |
4000008400000795 | The first partial refund succeeds and opens a fraudulent dispute for the amount left. Later refunds leave that dispute as it is, and a full refund opens no dispute. |
See Refunds for how refunds and their statuses work.
Cards that are approved
Every other card number is approved, including the cards that simulate a check your sandbox does not run:
| Card number | Scenario |
|---|---|
4000000000009235 | Elevated fraud risk |
4000008400000407 | High fraud dispute score |
4000008400000159 | High early fraud warning score |
4000008400001017 | Dynamic risk thresholds |
4001858821843804 | Free trial abuse |
4000058400307872 | CVC check fails with elevated risk |
4000058400306072 | Postal code check fails with elevated risk |
4000000000000036 | Postal code check fails |
4000000000000028 | Address line check fails |
4000000000000010 | Postal code and address line checks fail |
4000000000000044 | Address checks unavailable |
4000000000005423 | Early fraud warning |
4000000000001208 | Captcha challenge |
4000000000003725 | Captcha challenge |
4000000000000077 | Funds go straight to your available balance |
4000003720000278 | Funds go straight to your available balance, international card |