I am now working on payment gateway testing - manual testing-

this project has many payments gateways, like credit card and other payments providers like Paypal

is there any kind of check list I should go though while I'm testing a new gateway or any special test cases I should keep them in mind, regarding security or regression test?

2 Answers 2


I tested credit provider gateways and implementations for years, so I can give a few suggestions:

  • Security - no matter where you are in the world, there will be security requirements. Some common ones, depending on the gateway:
    • Data transmitted to the gateway is sent over a secured channel (https or some other secure means)
    • Data logged does not include card holder name, card number, account number, PIN
    • If card number is stored by your application (e.g. for recurring payments), it must be stored in an encrypted format, the ability to view the unencrypted data must be limited, and any such views must be logged. This is pretty common because if there's a disputed payment someone has to track the full data of the transactions to determine what happened on their end.
  • Certification - some gateway providers require that any application using their gateway be certified with them. In this situation, the provider will provide the tests and the data you're expected to provide. Some allow you to perform the tests on your time frame and send you the data, others you'll wind up sitting on the phone performing transactions while the person on the other end checks that everything has worked correctly. I've done both. If certification is required, you need to do it, or your organization is liable for any disputed payments.
  • Hardware - some gateway providers are bound to specific hardware. In this case you need to test the hardware integration as well as the payment process.
  • Plugin function - plugin gateways are nice because someone else has done the certification testing for you. Your main concern with these are making sure that all the legal requirements for using the gateway are met and making sure that the plugin integrates nicely with your application.
  • Configuration - most gateway providers offer a test server of some flavor. You need to be able to easily switch to the live server once testing is done. The most difficult payment provider testing I've done has been with providers who don't use a test server and provide test access for a limited set of card numbers and time. It makes debugging a nightmare.
  • Regression can be difficult - Regression testing pretty much by definition has to be performed against a provider's test server, which is not always going to be available. Some organizations block access to their test servers after they've certified your software. Others will remove older accounts after some set period of time. In addition, test servers invariably have looser validation rules than live servers, and bugs in test servers tend to remain rather longer. This means that unless you have your own simulators (which bring their own issues), your ability to perform systematic regression is often limited.
  • Batch vs Per-Transaction providers - Some providers will perform batch processing, meaning that they will give a provisional authorization at the time of transaction, but full authorization and funds transfer doesn't occur until the end of day batch processing. This usually includes a limit to the size of the batch, meaning you need to make sure you perform more than that many transactions in a day so you can test that the batch splits correctly and all the transactions process. When you've got a maximum batch size of 1000 and strict rules about duplicate transactions, things get... interesting.

Fortunately, once you get a particular gateway working correctly and certified, it won't change much over its lifetime. When I was working with an application that supported more than 30 different gateway providers around the world, that was possibly the only thing that saved my sanity.

  • thanks for the terrific answer,but can you explain more about hardware, and to make sure that I've got your point in certification did you meant SSL certification? and do you think its better to go through all the gateways once a new one was added?
    – user6336
    Commented Feb 3, 2015 at 7:13
  • Certification in this case is the gateway provider certifying that your software meets their requirements - this is a legal/contractual matter - say you're running payments through Big Credit Corp and a customer claims that their $5000 purchase was made by someone impersonating them. If you've certified with Big Credit Corp, they pay the customer. If not, you have to.
    – Kate Paulk
    Commented Feb 3, 2015 at 11:49
  • If you can do regression against your existing gateways, it's a good thing to do, although it can be quite challenging if you no longer have access to the test servers.
    – Kate Paulk
    Commented Feb 3, 2015 at 11:51
  • In the case of hardware - some providers will supply terminals for point-of-sale gateways, where the terminal does all the transaction processing and all the software needs to do is pass the amounts to the terminal and receive the result. A lot of the fancier systems at grocery stores are like this.
    – Kate Paulk
    Commented Feb 3, 2015 at 11:54

According to me you should keep concentrate on given requirement first. Then you can do other type of testing. As you are doing gateway testing then security testing is must.

Also if you want to do more and more test cases to apply on those things then better you create automated test scripts with diff. types of all scenarios and run them so it will give you confidence if tests pass perfectly. Also automation will save your time , efforts. It will help you to get things reliable in minimum time.

In related to security testing , you can check it as per credit card bank rules for name , pin , 16 digit num & date. It will help you to do correct testing.

  • Can you summarize the content of the link you have provided? The article under link requires signing in and also one day the site under this link maybe be down.
    – dzieciou
    Commented Jan 25, 2015 at 17:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.