A virtual card is just as legitimate as a physical card. The numbers are just account ids basically. In my business, I setup virtual cards for many vendors.
Sounds like you're trying to detect fraud. There are fraud detection platforms particularly designed for checkout fraud. Instead of re-inventing the wheel with a theory you have, I would look into some of those solutions that are fairly robust taking into account many different factors and often data from across merchants.
Typically the ones who cares about virtual vs. physical cards are the questionable vendors trying to push shady, automated, hard-to-cancel subscription services or alikes to customers.
Virtual cards are designed just for this purpose - to let consumers gain upper hand in shady business practices.
Virtual cards are also nice for setting up rules and alerts. I can setup a virtual card for a single merchant, then tell it to alert or block charges over a certain threshold.
Sounds like you're trying to detect fraud. There are fraud detection platforms particularly designed for checkout fraud. Instead of re-inventing the wheel with a theory you have, I would look into some of those solutions that are fairly robust taking into account many different factors and often data from across merchants.