Comment by 1ncorrect

It’s randomised in a similar way to how iOS creates privacy MAC addresses for each WiFi SSID.

The merchant receives the same ‘random’ card number for transactions from the same device.