It was a weird symbol counting scheme that was easily twarted. It was also completely client side validated so it was very possible to just intercept the checksum and force a match.