This is actually a really interesting problem.
So, you look at the card number and think “16 digits is shit loads, how can they be running out?”
So, the first 2 digits are assigned to the card network (3x Amex, 4x Visa, 5x Mastercard,… ) the next 4 digits they give out to issuers like us.
For example we own 535522 (our BIN or IIN) for UK Debit cards.
The last digit is a checksum. You can use it to verify if a card number is legal (read about Luhn Algorithm).
That means we now have 9 digits left (1 billion numbers per issuer). Additionally issuers will usually split these into different products. Amex uses their first 2 digits for the country they are issuing the card to and the next two digits for the type of card (Platinum/Gold, etc…)
In addition, issuers won’t use all card numbers within that range, because otherwise attackers can easily guess card numbers. So if Amex UK Gold cards have 10,000,000 numbers, they will only actually allow issuing a small percentage of it (randomly, NOT incrementally).
And then there are card replacements, expiries, MDES tokens and virtual cards, which will consume card numbers really quickly.
So in short, you can go through 16 digits pretty quickly