I mean just generating the random numbers, not writing a generator. At the time I only had access to Windows machines, there were no linux boxes on site and nob

I mean just generating the random numbers, not writing a generator. At the time I only had access to Windows machines, there were no linux boxes on site and nobody in the company (including me - at the time) knew enough about hack it yourself linux boxes to know what to do, I'd never even heard of /dev/random. The functions available from microsoft were only PRNG and not Cryptographically Secure (as far as I can remember). Even if they were 'Cryptographically Secure' not having a background in randomness theory makes it pretty hard to work out what is actually needed. So faced with uncertainty over using VB6 to produce random numbers and finding a product that claims to produce truly random numbers I chose to mitigate the risk by transferring it. If there had been a problem down the line related to the nature of the randomness of the numbers then I would have had recourse to the third party vendor that owned the risk. So in the same way you suggest no-one should write a CSPRNG, I decided that given my level of knowledge, the documentation available to me and the uncertainty that created we shouldn't trust ourselves to produce random numbers for a particular purpose. What if they weren't random enough? What if someone worked out a way to predict the numbers of cards that had been loaded with value but were still sat in a warehouse? Massive risk, mitigated for £150. Now that's value.