A virtual card is just as legitimate as a physical card. The numbers are just account ids basically. In my business, I setup virtual cards for many vendors.

Sounds like you're trying to detect fraud. There are fraud detection platforms particularly designed for checkout fraud. Instead of re-inventing the wheel with a theory you have, I would look into some of those solutions that are fairly robust taking into account many different factors and often data from across merchants.