We had customers complain that their CVV is correct, but the system kept telling them that it was invalid, when they were really just mistyping their expiration date. While our backend uses the auth.net API, i went directly to VT to test this out and i was able to reproduce this with any real MC card with invalid expiration date being entered. It doesn't matter what date you use. I punched in arbitrary 0613 (mmyy) and it declined the transaction. But as soon as i entered the expiration date belonging to the card, it no longer complained that CVV was invalid and let the transaction through.
Now, perhaps i am misunderstanding something, but I don't see how i can test this scenario in sandbox w/ a fake but valid MC account number. The Sandbox environment doesn't actually "talk" to banks, so how would it know if the expiration date is valid or not if the account number is fake? We have unit-tests which replicate these scenarios by feeding auth.net certain values to trigger certain responses in Sandbox, but this is not a good test. Sandbox will just let everything through so long as it's a valid card number. But like i said maybe i'm missing something. I'll take another look at it in sandbox.
UPDATE.
I tried to repro this in sandbox and it just blows everything through as successful transaction.
