Skip to main content

Test Data

This page is the reference for the test cards and test values that the Basis Theory sandbox recognizes in a TEST tenant. Use them to simulate specific success and error scenarios for each feature.

For how to design a testing strategy across the platform (unit, integration, and end-to-end), see the Platform Testing guide.

Test Data​

Card Numbers​

The card and card_number token types accept any card numbers and are not restricted to a particular set of card numbers, even for tenants only used for testing purposes. However, every provider in a payment flow runs its own sandbox with its own test data, so a card that works in one will not necessarily work in another. If you exchange card tokens with any external systems (using reactors, the proxy, or your PSP), those systems have their own test card requirements that you should follow to ensure the integration works as expected. For a full picture of how to validate each leg of the chain, see Platform Testing.

BIN Details Test Cards​

Your Test Tenant can be configured to return fake data for the BIN Details enrichment and can be requested in the Tenant's Quota Page.

When fake responses are enabled the following will occur:

  1. If a card does not have a static value below, on every request a random set of BIN details following the enhanced data structure.
  2. If a card does have a static value below, on every request the BIN details will be the same.

The following card numbers ranges have static BIN Details:

All the 3DS Test Cards are included in the fake BIN database as CREDIT cards.
Card Number BeginCard Number EndTypeCard BrandSegmentTest Card ExampleIssuer Country
42424242424242424242424242424242CREDITVISACommercial4242424242424242Bermuda
42424300000000174242430000000017CREDITVISAConsumer4242430000000017United States
55555555555500005555555555560000CREDITMASTERCARDCommercial5555555555554444Türkiye
27203946124650722720394612465072CREDITMASTERCARDCommercial2720394612465072United States
378282246310000378282246310010CREDITAMEXConsumer378282246310005Faroe Islands
40000566556655504000056655665550CREDITVISABusiness4000056655665556Chile
62000000000000006200000000000000CREDITUNIONPAY6200000000000005Svalbard & Jan Mayen Islands
60110100000000006011010000000005DEBITDISCOVERCommercial6011010000000003Bermuda
60119811111111136011981111111113DEBITDISCOVERCommercial6011981111111113United States
35660020203605043566002020360506DEBITJCBCommercial3566002020360505Bermuda
35301113333000003530111333300000DEBITJCBCommercial3530111333300000United States
378282246310011378282246310020DEBITVISACommercial378282246310013Bermuda
42424200000000184242420000000018DEBITVISAConsumer4242420000000018United States
40055500000810184005550000081020DEBITVISACommercial4005550000081019Bermuda
51120004000000005112000400000001DEBITMASTERCARDCommercial5112000400000000Bermuda
51120100000000035112010100000002DEBITMASTERCARDCommercial5112010000000003Bermuda
52008282828282105200828282828210DEBITMASTERCARDCommercial5200828282828210United States
60110009901394206011000990139430CREDITDISCOVERCommercial6011000990139424Bermuda
60110009955000006011000995500000CREDITDISCOVERCommercial6011000995500000United States
55890920000000000065589092000000000006DEBITMASTERCARDCommercial5589092000000000006United States
55896200000000000075589620000000000007DEBITMASTERCARDCommercial5589620000000000007United States

Partial and Empty BIN Details​

In production, not every card returns complete BIN details. Cards from regional or less common networks, or BINs that aren't yet covered, frequently tokenize successfully but come back with some enrichment fields empty — or with no bin_details at all. Your integration has to keep working when funding, brand, or issuer_country are missing. See Handling Incomplete Data for guidance on treating these fields as optional.

The following Test-Tenant card numbers reproduce that behavior on demand, so you can write CI tests that prove your fallback logic works without mocking our API or waiting for a real partial-data card in production. Each one tokenizes successfully but deliberately omits one or more enrichment fields. Like the static table above, these only return this deterministic data when your Test Tenant's BIN Details enrichment is set to fake — otherwise a random, complete enhanced response is returned.

Test Cardcard.brandcard.fundingcard.issuer_countryenrichments.bin_detailsSimulates
4900000000000011visaabsentBermudaReturnedMissing funding (debit/credit unknown)
4900000000000029visacreditabsentReturnedMissing issuer country
9000000000000019absentcreditBermudaReturnedMissing brand
9000000000000027absentabsentabsentReturnedMissing brand, funding, and issuer country
4900000000000003visaabsentabsentabsentNo bin_details object on a successful token

The most instructive case is 4900000000000003, where the entire enrichments.bin_details object is absent even though tokenization succeeds — mirroring a regional BIN whose network is known but whose enrichment data is unavailable:

{
  "id": "<TOKEN_ID>",
  "type": "card",
  "card": {
    "bin": "49000000",
    "last4": "0003",
    "expiration_month": 12,
    "expiration_year": 2025,
    "brand": "visa"
  },
  "enrichments": {}
  // enrichments.bin_details is absent — your code must not assume it is present
}

3DS Test Cards​

The following test card numbers can be used to test various 3D Secure scenarios.

Card NumberCard Brand3DS ScenarioIs Luhn Valid
5204247750001471MASTERCARDSuccessful Frictionless AuthenticationYes
6011601160116011DISCOVERSuccessful Frictionless AuthenticationYes
340000000004001AMEXSuccessful Frictionless AuthenticationYes
4000020000000000VISASuccessful Challenge AuthenticationYes
370000000000002AMEXSuccessful Challenge AuthenticationYes
3566002020360505JCBSuccessful Challenge AuthenticationYes
3566006663297692JCBSuccessful Challenge AuthenticationYes
4005562231212123VISASuccessful Challenge Authentication - Method not RequiredYes
4761369980320253VISASuccessful Mandated Challenge AuthenticationYes
5200000000001104MASTERCARDSuccessful Mandated Challenge AuthenticationYes
4000000000000341VISASuccessful Out-of-Band Challenge AuthenticationYes
4005571701111111VISAAttempted Challenge AuthenticationYes
4111111111111111VISAAuthentication AttemptedYes
5424180011113336MASTERCARDAuthentication AttemptedYes
4264281511112228VISAAuthentication FailedYes
5424180000000171MASTERCARDAuthentication FailedYes
5405001111111165MASTERCARDAuthentication UnavailableYes
5405001111111116MASTERCARDAuthentication RejectedYes
4055011111111111VISAFailed Challenge AuthenticationYes
5427660064241339MASTERCARDFailed Challenge AuthenticationYes
6011361011110004DISCOVERFailed Out of Band Challenge AuthenticationYes
6011361000008888DISCOVERUnavailable Challenge AuthenticationYes
6011361000001115DISCOVERRejected Challenge AuthenticationYes
4264281500003339VISA3DS Directory Server ErrorYes
5424180011110001MASTERCARD3DS Directory Server ErrorYes
4264281500001119VISAInternal 3DS Server ErrorYes
4200000000000002VISASuccessful Frictionless AuthenticationNo
4200000000000004VISASuccessful Challenge AuthenticationNo
4200000000000014VISASuccessful Challenge Authentication - Method not RequiredNo
4200000000000015VISASuccessful Mandated Challenge AuthenticationNo
4200000000000016VISASuccessful Out-of-Band Challenge AuthenticationNo
4200000000000008VISAAttempted Challenge AuthenticationNo
4200000000000003VISAAuthentication AttemptedNo
4200000000000005VISAAuthentication FailedNo
4200000000000006VISAAuthentication UnavailableNo
4200000000000007VISAAuthentication RejectedNo
4200000000000009VISAFailed Challenge AuthenticationNo
4200000000000017VISAFailed Out of Band Challenge AuthenticationNo
4200000000000010VISAUnavailable Challenge AuthenticationNo
4200000000000011VISARejected Challenge AuthenticationNo
4200000000000012VISA3DS Directory Server ErrorNo
4200000000000013VISAInternal 3DS Server ErrorNo

Account Updater Test Cards​

The following test card numbers can be used to test various Account Updater scenarios.

PANExp. MonthExp. YearCard BrandResult CodeUpdate Details
4111111111111111122023VISAUPD_PAN4166676667666746
4012888888881881122023VISAUPD_PAN4212345678910006, 12/2026
5555555555554444122023MASTERCARDUPD_PAN5454545454545454
5105105105105100122023MASTERCARDUPD_PAN5233580618829955, 12/2026
6011111111111117122023DISCOVERUPD_PAN6011000990139424
6011601160116611122023DISCOVERUPD_PAN6445644564456445, 12/2026
378282246310005122023AMEXUPD_PAN375155165213132
371449635398431122023AMEXUPD_PAN348835199015504, 12/2026
4539097887163333122023VISAUPD_EXP_DATE12/2026
5325191087030619122023MASTERCARDUPD_EXP_DATE12/2026
6011690151507086122023DISCOVERUPD_EXP_DATE12/2026
373555735376156122023AMEXUPD_EXP_DATE12/2026
6011760519541711122023DISCOVERUPD_BRAND_CONVN/A
6011490740263725122023DISCOVERUPD_CORRECTEDN/A
4711358892785746122023VISANO_UPDATEN/A
5412000000001009122023MASTERCARDNO_UPDATEN/A
4929980395567582122023VISAWRN_CONTACT_CARDHOLDERN/A
6011444770992901122023DISCOVERWRN_CONTACT_CARDHOLDERN/A
4929544240318920122023VISAWRN_ISSUER_NOT_ENROLLEDN/A
5580422612666704122023MASTERCARDWRN_ISSUER_NOT_ENROLLEDN/A
4916725297925395122023VISAWRN_ISSUER_NO_DATAN/A
5157204564548129122023MASTERCARDWRN_ISSUER_NO_DATAN/A
4035501000000008122023VISAWRN_OPT_OUTN/A
5461310156953048122023MASTERCARDWRN_CLOSED_ACCOUNTN/A
6011168802268945122023DISCOVERWRN_CLOSED_ACCOUNTN/A
370488998077498122023AMEXWRN_CLOSED_ACCOUNTN/A
122000000000003122023N/AWRN_UNSUPPORTED_NETWORKN/A
4035501428146300122023VISAERR_INVALID_PANN/A
5555341244441115122023MASTERCARDERR_INVALID_PANN/A
6011829379808385122023DISCOVERERR_INVALID_PANN/A
378025849667382122023AMEXERR_INVALID_PANN/A
4111111145551142122023VISAERR_INVALID_EXP_DATEN/A
5577000055770004122023MASTERCARDERR_INVALID_EXP_DATEN/A
6011648103759866122023DISCOVERERR_INVALID_EXP_DATEN/A
378734493671000122023AMEXERR_INVALID_EXP_DATEN/A
4111112014267661122023VISAERR_INVALID_CONFIGN/A
5555444433331111122023MASTERCARDERR_INVALID_CONFIGN/A
370000000000002122023AMEXERR_INVALID_CONFIGN/A
6011178332216017122023DISCOVERERR_UNDEFINEDN/A

Network Tokens Test Cards​

The following test card numbers can be used to test various Network Token scenarios.

PANCard BrandResponseError Title
4000000000000002VisaSuccess[Not Applicable]
4000000000000085VisaSuccess[Not Applicable]
4000000000000093VisaSuccess[Not Applicable]
5100000000000008MastercardSuccess[Not Applicable]
5100000000000065MastercardSuccess[Not Applicable]
5100000000000073MastercardSuccess[Not Applicable]
6011000000000004DiscoverSuccess[Not Applicable]
370000000000002American ExpressSuccess[Not Applicable]
370000000000069American ExpressSuccess[Not Applicable]
370000000000077American ExpressSuccess[Not Applicable]
4012888888881881VisaProvision Data ExpiredPROVISION_DATA_EXPIRED
5105105105105100MastercardProvision Data ExpiredPROVISION_DATA_EXPIRED
6011601160116611DiscoverProvision Data ExpiredPROVISION_DATA_EXPIRED
371449635398431American ExpressProvision Data ExpiredPROVISION_DATA_EXPIRED
4330251207506660VisaCard Verification FailedCARD_VERIFICATION_FAILED
5461310156953048MastercardCard Verification FailedCARD_VERIFICATION_FAILED
6011168802268945DiscoverCard Verification FailedCARD_VERIFICATION_FAILED
370488998077498American ExpressCard Verification FailedCARD_VERIFICATION_FAILED
4539097887163333VisaCard Not EligibleCARD_NOT_ELIGIBLE
5325191087030619MastercardCard Not EligibleCARD_NOT_ELIGIBLE
6011690151507086DiscoverCard Not EligibleCARD_NOT_ELIGIBLE
373555735376156American ExpressCard Not EligibleCARD_NOT_ELIGIBLE
4929980395567582VisaCard Not AllowedCARD_NOT_ALLOWED
5580422612666704MastercardCard Not AllowedCARD_NOT_ALLOWED
6011444770992901DiscoverCard Not AllowedCARD_NOT_ALLOWED
378025849667382American ExpressCard Not AllowedCARD_NOT_ALLOWED
4929544240318920VisaCard DeclinedCARD_DECLINED
5157204564548129MastercardCard DeclinedCARD_DECLINED
6011760519541711DiscoverCard DeclinedCARD_DECLINED
348322853530243American ExpressCard DeclinedCARD_DECLINED
4916725297925395VisaProvision Not AllowedPROVISION_NOT_ALLOWED
5336475987107024MastercardProvision Not AllowedPROVISION_NOT_ALLOWED
6011490740263725DiscoverProvision Not AllowedPROVISION_NOT_ALLOWED
375155165213132American ExpressProvision Not AllowedPROVISION_NOT_ALLOWED
4711358892785746VisaCard Eligibility ErrorCARD_ELIGIBILITY_ERROR
5233580618829955MastercardCard Eligibility ErrorCARD_ELIGIBILITY_ERROR
6011000990139424DiscoverCard Eligibility ErrorCARD_ELIGIBILITY_ERROR
348835199015504American ExpressCard Eligibility ErrorCARD_ELIGIBILITY_ERROR
5555555555554444MastercardIssuer DeclinedISSUER_DECLINED

Agentic Payments Test Cards​

The following test card numbers can be used to test various Agentic Payments scenarios.

The matrix is deliberately small. Each card exercises one materially different integration or recovery behavior, and any card number not listed follows its brand's happy path. Tokenize the card in your test tenant first, then use the resulting token as source.token_id.

Because both rails see the same card number, one card can produce different outcomes per rail. That is what makes partial rail success testable with a single payment method.

Visa​

Card NumberPayment method railsVerificationScenario
4242424242424242agentic-token enabled, spt enabledFull ceremony to activeVisa happy path
4929980395567582agentic-token enabled, spt enabledsubmit_otp returns 400 INVALID_OTPVerification failure
4000000000000002agentic-token enabled, spt error (CARD_REJECTED)Full ceremony to activePartial rail success. Retrying the spt rail is rejected again
4000000000000119agentic-token enabled, spt errorFull ceremony to activeRecoverable provisioning failure. Retrying the spt rail succeeds
4000000000000341agentic-token enabled, spt enabledFull ceremony to activeCredential issuance failure. A spt mint returns 422 PROVIDER_CREDENTIALS_FAILED and releases the reservation
4000000000009995agentic-token enabled, spt enabledFull ceremony to activeIndeterminate credential outcome. An spt mint returns 409 CREDENTIAL_OUTCOME_UNKNOWN and consumes the requested allowance capacity
Any other Visa numberagentic-token enabled, spt enabledFull ceremony to activeDefault

Mastercard​

Card NumberPayment method railsVerificationScenario
5555555555554444agentic-token enabled, spt enabledHosted redirect to activeMastercard happy path
5186160000000001agentic-token error (CARD_REJECTED), spt enabledNot applicablePermanent network rejection. The spt rail still works
5186160000000003agentic-token enabled, spt enabledcomplete returns 422 PROVIDER_VERIFICATION_FAILEDVerification failure, with brand behavior differing from Visa's
Any other Mastercard numberagentic-token enabled, spt enabledHosted redirect to activeDefault

The agentic-token rail follows the card's network: Visa numbers provision vic and Mastercard numbers provision agentpay. Every card also provisions the spt rail, and the Stripe outcomes are keyed on the card number rather than the brand: 4000000000000002 declines permanently, 4000000000000119 fails once and succeeds on retry, 4000000000000341 provisions but conclusively fails to mint, 4000000000009995 simulates a lost mint response, and every other number succeeds.

Mock Credentials​

Mock credentials are deterministic so repeated runs see stable values.

FormatValue
cardA Luhn-valid virtual card number, 4000001000004242 for the 4242 Visa card and 5100001000004446 for the 4444 Mastercard, falling back to 4000001000000000 and 5100001000000006 for other cards. Expiration comes from the tokenized card; the security code is derived deterministically
network-tokenThe same virtual number as the payment_token, with a deterministic cryptogram. Visa returns ECI 07 and Mastercard returns ECI 06; cryptogram.type reads CARD_APPLICATION_CRYPTOGRAM_SHORT_FORM on both
identifierA Stripe token identifier prefixed spt_mock_
mppThe same network or Stripe data, packaged for the challenge you supplied

Credential expiry follows each network's real rule rather than a uniform test value. Mastercard supplies no cryptogram expiry — its short-form cryptogram is single-use and bound to the transaction — so cryptogram.expires_at falls back to the allowance's expires_at, in the mock exactly as in production. Visa's cryptogram expiry is network-supplied, and the mock returns a short synthetic window in its place, so do not calibrate "how long is a credential usable" against the Visa mock's value. Use any cryptogram immediately on both networks.

Mock credentials are suitable for integration tests. They are not provider certification evidence.

Deprecated Agentic Commerce Test Cards​

These cards apply to the deprecated Agents, Enrollments, and Instructions model only.

Visa Test Cards​

Enrollment Success​

Card NumberVerificationDescription
4242424242424242OTP challengeStandard flow — requires OTP verification and passkey creation.
4000000000000002OTP challengeStandard flow — requires OTP verification and passkey creation.
4000020000000000OTP challengeAlternate card for testing multiple enrollments.
4000056655665556Auto-approvedThe issuer approves without a challenge — verification returns approved with no OTP and no passkey step.
4711358892785746OTP challengeStandard flow — requires OTP verification.
Any other Visa PANOTP challengeDefault behavior for unrecognized Visa cards.

Verification Failures​

Card NumberVerificationDescription
4929980395567582Invalid OTPOTP submission always returns an INVALID_OTP error.
4916725297925395Max attempts exceededOTP submission returns a MAX_ATTEMPTS_EXCEEDED error.

Partial Failures (Retryable)​

Card NumberErrorDescription
4000000000003063PROVIDER_ENROLLMENT_FAILED (422)Card registers with the network but fails a subsequent provider step. Returns enrollment with failed status and card display data. Retryable via POST /enrollments/:id/retry.
4000000000003071PROVIDER_ENROLLMENT_FAILED (422)Card fails during token provisioning. Returns enrollment with failed status. Retryable via POST /enrollments/:id/retry.

Enrollment Failures​

Card NumberErrorDescription
4330251207506660CARD_REJECTED (422)Card fails network verification during enrollment.
4539097887163333CARD_REJECTED (422)Card is not eligible for agentic commerce enrollment.
4929544240318920CARD_REJECTED (422)Card is declined by the issuer during enrollment.

Mastercard Test Cards​

Enrollment Success​

Card NumberVerificationDescription
5555555555554444Popup challengeStandard flow — requires Mastercard popup authentication.
5200828282828210Auto-approvedEnrollment is automatically approved — no popup required.
2223003122003222Popup challengeMastercard 2-series card — requires popup authentication.
5425233430109903Popup challengeStandard flow — requires Mastercard popup authentication.
5204740009900014Passkey bypassVerification returns approved without the popup ceremony.
Any other Mastercard PANPopup challengeDefault behavior for unrecognized Mastercard cards.

Verification Failures​

Card NumberVerificationDescription
5186160000000003Invalid challengeCompleting the ceremony returns PROVIDER_VERIFICATION_FAILED (422).
5186160000000004Max attempts exceededCompleting the ceremony returns MAX_ATTEMPTS_EXCEEDED (400).

Enrollment Failures​

Card NumberErrorDescription
5105105105105100CARD_REJECTED (422)Card is not eligible for agentic commerce enrollment.
5186160000000001CARD_REJECTED (422)Card fails network verification during enrollment.
5186160000000002CARD_REJECTED (422)Card is declined by the issuer during enrollment.

Bank Verification Test Cards​

The following test bank account numbers can be used to test various Bank Verification scenarios.

Routing NumberAccount NumberStatus
02100002000000disabled
02100002100001enabled
02100002100002inconclusive
Last updated on