Don't forget the last digit is a checksum digit too. Which I still can't give you an attack, but I also agree that I definitely can't say I'm sure there isn't one.
That does reduce the number of possibilities greatly, which might matter for some attack scenarios, but usually not IMHO as rate limits should thwart any online brute force.
I'd be interested to know how greatly, if someone has the equation for that.
I'd be interested to know how greatly, if someone has the equation for that.