There was an algorithm in a certain "Hacker Journal" to generate said numbers. Combine that with some valid prefixes (the first 4 digits, which indicate the issuer) and you'd pass most tests at the time.