I worked for a large retailer on their iPhone app and our test environments were terribly slow so we tended to do most of our development against production.

This retailer is pretty old and had issued their own credit cards that didn't have any sort of checksum validation. This made making test orders easy because any sequence of numbers for that credit card type would let the "checkout" call succeed, and then the order wouldn't actually be fulfilled because the card would turn out to be invalid.

We usually used a sequential list of numbers because that was so fast to type and we used a made up Address in Tok Alaska. The state picker had Alaska first and Tok (also Eek) were the shortest city names we could find in Alaska.

One day someone took a look at one of our test account's order histories and noticed that there was a tracking link for the order. That "fake" credit card number turned out to be quite real. We shipped a dress to Alaska, which was then returned to sender because the address (1 A St) didn't exist.

We were much more careful after that but as far as I know, nobody ever complained and we never heard about it from anyone outside our team.