SagePay / Opayo Test Cards

First published in 2013, rewritten in 2026 so the advice holds today.

If you take payments through Opayo, you need to test the checkout thoroughly before any site goes live or gets updated. Opayo was known as SagePay until its rebrand in 2020, and it's now owned by Elavon. It's still a common choice for UK merchants on Magento (now officially Adobe Commerce), Shopify Plus, BigCommerce and other platforms, largely because it's well established and integrates widely.

Testing matters just as much now as it always has. A checkout that fails silently, or throws an unexpected error at the 3D Secure step, costs you sales. Test properly before launch and you catch these problems before customers do.

Why testing your payment setup matters

Running transactions through Opayo's test environment before you go live lets you:

• Catch integration issues before real customers hit them.
• Confirm the checkout flow is smooth, which reduces cart abandonment.
• Verify transactions, including 3D Secure, process correctly and securely.

This is worth doing not just at launch but any time you change platform, upgrade your payment plugin, or move to a new theme or checkout template. Payment integrations are exactly the kind of thing that break quietly during an otherwise unrelated update.

Accessing the Opayo test environment

You'll need a MyOpayo test account to run test transactions. Historically this was accessed at test.sagepay.com/mysagepay/login.msp. Opayo has been consolidating its branding onto opayo.co.uk domains, so if that link doesn't work, search Opayo's own support documentation for "MyOpayo test login" to get the current address, or ask your developer or agency, who will typically have this set up as part of the integration.

Standard test transaction details

When running test transactions, the generic details normally used are:

• Expiry date: any date in the future
• CV2: 123
• Billing address: 88
• Billing postcode: 412
• 3D Secure password: password

These simulate a transaction in the test environment only. They will not work, and must never be used, in a live environment.

Finding the current test card numbers

Opayo publishes a list of test card numbers covering different card types (Visa, Mastercard, declined transactions, 3D Secure variations, and so on), used together with the generic details above. These numbers do get updated periodically, so rather than relying on a fixed list that may go stale, check Opayo's own developer documentation or your MyOpayo test account for the current set before you start testing.

If you can't find them, your web agency or the platform's payment plugin documentation (for Magento/Adobe Commerce, Shopify Plus, WooCommerce, and so on) will usually list the specific test cards recommended for that integration.

Best practice before you go live

• Document your tests. Record which card type you used, what happened, and any errors. This saves time if something needs debugging later.
• Test across devices and browsers. If your customers check out on mobile, tablet and desktop across different browsers, test each combination rather than assuming one covers all.
• Test the failure paths too. Use declined test cards and cancelled 3D Secure attempts to check your site handles these gracefully, not just the successful path.
• Retest after platform updates. A checkout that worked fine last month can break after a plugin update, theme change or payment gateway upgrade.
• Do a final live test with a real card. Once test transactions pass, set up a genuine low-value product (a penny is the classic approach) and run a real transaction with your own card before opening the site to customers.

Testing thoroughly before launch is one of the least glamorous parts of running an e-commerce site, and one of the most important. A checkout that fails, or feels untrustworthy, loses you sales you'd otherwise have kept. Build proper testing into every launch and every significant update, use Opayo's current test card details rather than an old bookmarked list, and finish with a real, small-value transaction before you go live.