After consuming the value on cards 0001 and 0002, Mallory guesses the algorithm used for generating these serial numbers is a simple sequence and predicts that 0003 is a valid serial number, enters 0003 when prompted, and gets additional phone service.
When Alice tries to use her card she discovers the value has been stolen from it and it is now worthless.
Internally, the issuing organization creates a (pseudo-)random nonce as a salt for generating the serial numbers, and keeps it secret.
The issuer increments their internal serial number and appends it to the salt, and the computed message digest is used to create the actual serial number.
The issuer does have to take care to prevent collisions between existing values so as not to wrongly issue two identical serial numbers.