Presumably hackers have figured out how the MCs are coded or they're using brute force to check for valid numbers. Interestingly, one of my hacked MCs was actually registered by someone else. To do that, you normally need to know the CVV number. With brute force, that makes the task 1000 times as hard.