So that if you phone your bank with a card that's since been replaced they have some way of identifying you and can still track the card number through a discernible pattern.
The first 6 digits (the BIN number) are usually the same with people's cards so that they identify who has issued the card.
e.g. 4929 is usually a Barclaycard visa card (5301 I think is their mastercard). 4775 capital one, 6759 natwest.
That leaves 10 digits to play with (I know I've only quoted 4 of the 6) and for each card issuer that's billions of combinations. There's also the expiry dates, issue numbers and CVV numbers thrown into the equation so just guessing someone's card number alone won't lead to fraud (even if you can predict what your replacement card number will be)