Aren't card PINs only 4 numbers long? That's almost 10k possible combinations I believe, pretty trivial to put together.
Checking which corresponds to what card is the hard step because you need access to an acquirer to my knowledge, and you'll lose that access quiet quickly if you attempt too many incorrect combinations.