So the thief is checking these numbers constantly to see if they have a balance on the bank websites? Seems like the banks could take a little initiative here, and if they get 20, 50, 100 or how ever many balance requests for inactive cards, that's the flag. They just don't allow those to ever be activated. At the point of purchase, the register could just refuse to activate the card.