A test payment method is selectable on production

1. Mock Pay is active on some site of the account. The payment methods list covers every site of the account, so a storefront that does not filter it shows other sites' methods, including a test site's Mock Pay. Filter the list to the current site or no site, and deactivate the method anyway: an active Mock Pay method anywhere on the account is a risk to every site on it (the mock provider).
2. A Stripe or PayPal method is still in Test Mode. Test cards succeed and no money moves. Turn Test Mode off, then place a small real order to confirm the live method works.
3. A form offers it. A payment element on a form has its own choice of methods. Check every form that takes payments.
4. The list is cached or hardcoded. A payment step printed into a cached page, or built from fixed method ids, still shows a method after it has been deactivated. Fetch the list when the payment step opens.

The check after any change to payment methods: request the live list and confirm that no entry is Mock Pay and none is in test mode.

No output is the pass. Do the same for tax: no live tax zone, and not the fallback provider, may point at the Mock tax provider, which charges real shoppers a made-up rate.