I can confirm that my online-issued railcard has no mag stip on the back.
The back contains a place for you to sign and a barcode with a serial number underneath.
I can think of a few ways in which railcards could be checked for tickets bought online.
1) Put a barcode or mag stripe on every future railcard, and upgrade TVMs to be able to read these. This would be quite expensive imo.
2) Allow customers to link their debit/credit cards to their railcards. Whilst this wouldn't prevent someone with a railcard from buying a ticket for a non-railcard holder, it would make it that little bit harder. How it could work, is customer makes a one-off visit to any manned station and hands over their railcard and debit/credit card. These are then linked in a central database (that only stores a hash of the payment card number, not the full number in case of a security breach). When the customer buys a ticket online using the same payment card, then the website knows they are a railcard holder. This association could even be done automatically when initially buying the railcards.
The main problems with above are people who have multiple cards which would all need registering, and also the hassle of having to register a railcard you already have from before the rule was introduced. Perhaps allowing people to collect discounted ToD tickets from the booking office if their payment card isnt registered could get around this (and their card could be associated at the same time!)