@uastronomer Interesting question. I guess it’s more than a (bad) hash of a sequence number and a secret. If you don’t want to check against a full database of all cards at least a part of the code needs to point into the direction of the expected content that was hashed.
And the cards are activated at POS, so they are worthless if stolen from the store - at least in my area.