They should be using an issuing processor (a financial institution that works with Visa or MasterCard) to issue card numbers. Issuing processors can easily generate card numbers programmatically + on the fly.