Slightly amusing story about “testing” payment flows in production: In Germany we have payment providers like Sofortüberweisung that ask you for your online banking credentials and then access your online banking via browser orchestration to initiate a transfer (I know it’s an utterly horrible idea from a privacy and security point of view).

What they didn’t know initially was that some banks provide test accounts to customers where you can simulate transfers without transferring any money, and where you can simply enter your desired bank account balance (now that would be a killer feature for real online banking). Some people figured this out and used those fake accounts to make fraudulent orders.

So if you offer such testing card numbers you should make sure your customers need a specific workflow to handle them (e.g. by returning a special error response code that can be distinguished from a normal error).