It looks incompetent, not fraudulent. They’re using credit card numbers as a primary anti-fraud mechanism, and virtual cards bypass that.