Not surprising that they discovered it, even if they weren’t aware of it - I’m guessing this is how it went: person tried to use his card number on some random website, but it kept telling him that his number is invalid. They scratch their head and double, triple check that number and then do a google search.

I'm fairly sure someone else suggested it as a possibility, because why the heck would a bank issued debit card number not work on say... Amazon.com?

If the code compiles sometimes the bug is pretty obvious!

The algorithms are not complicated.

It was even originally designed to be calculated mechanically

The Luhn algorithm is fairly common in software interviews, though I agree I would never think to check it if my card failed.

npm i card-validator

See also https://gchq.github.io/CyberChef/#recipe=Luhn_Checksum()