The first six digits are the Bank Identification Number (BIN). The last four digits are commonly found on receipts, and are not required by US law to be kept secret. Assuming you know (or guess) the bank, and have the receipt with the last four digits, you know 10 of the 16 digits. The Luhn algorithm can be used to reconstruct any missing digit, not just the last digit. That means only 5 unknown digits remain.
Given all of the above information, if you are spinning through a hash algorithm trying to test "found" hashes, you would need to execute only 100,000 tests to brute force a card number. That doesn't even take a graphics card accelerator to accomplish in a second or less.
The CVV2 number printed on the reverse side of the card is derived from data not present on the card, and cannot be guessed or determined solely from the information on the card or the mag stripe.