Although this requirement is often stated by card issuers, I can confirm that I have often used a VPN with virtual cards and that it worked. I think it really depends on which VPN you use. As for Tor, that's a completely different story and it's not worth playing with.