It is probably just a barcode checksum/error code, otherwise they wouldn't have to rely on the values of the first 8 digits. Instead they should generate 4 random digits and store them in the database along with other information, then it basically works like a pin number (and xor it with a proper checksum).
Edit: If it is really a checksum, it is a crappy one.