Yes, it was possible to change the last 4 digits, but Cmaster3 did it in a certain order. I can't remember exactly, but I think it jumped every 8 or 9 digits. So like the list would look something like:
5002
5010
5018
5026
5034
etc
These worked great for free calls with AT&T, because they only wanted the card number. I don't think their automated system even asked for the expiration date. Eventually their system started asking for the zip code on the billing address, which I was sometimes able to guess since there were only a few zip codes to choose from around here. There were a lot of dead/non-existent cards in the list - maybe 5 dead ones for every good one.
I kept printouts of these credit card lists, but in 1996 when I started learning how to make web pages, I started titling these lists "HTML Color Codes For Websites." and I'd add a #FF onto the beginning of each number. It worked pretty good because when the cops raided our room, they left that list behind while they confiscated everything else.
When I was ordering merchandise from catalogs, I would use AT&T on it first to make sure the card was working. The expiration date could just be made up and there was no CVV back then. I think companies had the ability to check my billing information against what should be on the card, but a lot of them didn't bother. I think probably half of the stuff we ordered didn't work because of the billing information not matching up.