How do websites ban prepaid cards?

The first six digits of a Visa or MasterCard card comprise the Bank Identification Number (BIN) and card type (Visa, M/C, etc), which identifies the issuer, the next 9 digits (when a Visa or M/C) are the issuer-assigned account number unique to the card, and the last digit is a checksum. Having the BIN makes it simple to know if the issuer is one that issues prepaid cards, hence they can be blocked. For example, if a BIN identifies as belonging to NetSpend (a major issuer of prepaid cards) then it's a good bet the card is prepaid and the merchant can refuse it. If a card makes it past the filters based on the BIN then it is only because the database used is missing that particular issuer's info, and that will happen from time to time like anything else. To understand more on how this works, go to the bin codes website.