They should be using an issuing processor (a financial institution that works with Visa or MasterCard) to issue card numbers. Issuing processors can easily generate card numbers programmatically + on the fly.
Thanks for the info. I haven’t heard the term issuing processor before.