It is probably just a barcode checksum/error code, otherwise they wouldn't have to rely on the values of the first 8 digits. Instead they should generate 4 random digits and store them in the database along with other information, then it basically works like a pin number (and xor it with a proper checksum).

Edit: If it is really a checksum, it is a crappy one.

A lot of symbologies support some kind of modulo check digit. It's mostly there to detect erasure and substitution errors, because those are relatively common errors in decode. A modulo sum is better than nothing, considering that each additional digit increases the length of the barcode. If you're length-constrained, then adding more check-data is a difficult trade-off between stronger protection and smaller module size, meaning that you could add so much data that the barcode becomes too dense to print or read.

A secret larger than 10,000 is not useful -- since the multiplication is mod 10,000, the first digit of the secret could be ignored anyway (54321 = 5 * 10000 + 4321 === 4321 mod 10000).