> I'm not following. If things have gotten this far, the victim has already been duped into buying the card and intends to send it to the scammers anyway... ?

Yes, the mark has essentially fallen for the scam, but not yet arrived for the goods... which don't actually exist.

> But also, how could the card possibly work that way? What are the other digits even for; and wouldn't they quickly run out of valid "last few digit" combinations for issued cards?

Exactly why I hate that Ebay uses their insipid coding schema. I'm not explaining why they do it, because I can't.