eh…Not entirely. Lets start with a simple thing- whoever is stalking a specific person likely purchased a dossier with enough information to get a credit card check (or full on background check too). they likely know companies whose cards you have.

Credit card numbers follow a formatting guidelines (linked above). the first number is most likely going to be a 4, 5, or 6, and possibly a 3. (representing Visa, MC, Disc, and amex, respectively.) the next three digits are the bank identification number- so lets say you have a bank-issued visa check card.

The remaining digits except the last are your account information- the last digit is a check number. Most banks will use a process for numbers as well, identifying the type of account that the card goes to, etc, refining the number of possibilities even further.

All that said, though, chances are bad actors won’t be brute forcing anything at all- they’ll just buy the information. At worst, they try two or three numbers and convince the system they’re you.