It is probably just a barcode checksum/error code, otherwise they wouldn't have to rely on the values of the first 8 digits. Instead they should generate 4 random digits and store them in the database along with other information, then it basically works like a pin number (and xor it with a proper checksum).
Edit: If it is really a checksum, it is a crappy one.
A lot of symbologies support some kind of modulo check digit. It's mostly there to detect erasure and substitution errors, because those are relatively common errors in decode. A modulo sum is better than nothing, considering that each additional digit increases the length of the barcode. If you're length-constrained, then adding more check-data is a difficult trade-off between stronger protection and smaller module size, meaning that you could add so much data that the barcode becomes too dense to print or read.
Edit: If it is really a checksum, it is a crappy one.