The first time I've seen the Luhn algorithm was on a compromised web server. The cracker has put several fake ebay login/registration pages, as well as a couple of Javascript files.

The pages were obviously intended to be used for phishing. However, what really made me go "wow" was the extra mile they went: one of the Javascript files contained methods that took the credit card number from the fake registration page and checked its validity w/ the Luhn algorithm before emailing it to a random email address. If the number was invalid, the user got an error and they forced him to re-enter.

I didn't know about the algorithm at the time (this was around 2005), so I was a bit baffled what the heck they are trying to do.