We have an elderly customer who appears to be the victim of a scam. He was contacted by someone claiming to be from Yahoo (possibly) stating that his computer had a virus. He gave this person his debit card number and says they remoted into his computer to fix it. Of course immediately there are fraudulent transaction attempts out of India. The initial transaction got through our fraud prevention rules because the merchant "masked" the country of origin (apparently it was blank?) although when I review the transaction I can see the country code as India, but apparently the initial authorization came through with no country code. Of course this transaction is coded as a verified by visa so no chargeback rights. We’re not talking about a huge amount as all the subsequent charges were declined, so we’re going to eat the $150 transaction that was approved. But just curious as to this “masking” of the country code (our processor was the one that told me this), is this allowed under Visa rules? Would it have any impact on our chargeback rights? I don’t know anything about the qualifications for a merchant to become a verified by visa merchant, but seems like masking the country code to get the authorization isn’t quite on the up and up. Any Visa rules experts have any thoughts?

As you correctly point out, you cannot file a fraud related chargeback for Verified by VISA transactions. However, depending on the circumstances of the approval, you may have a chargeback right for code 72 "No Authorization."

From VISA International Operating Rules

Chargeback Conditions - Reason Code 72 (Updated)
1. The Transaction exceeded the Floor Limit and Authorization was not obtained on the Transaction Date.
2. Authorization was obtained using invalid or incorrect data, or the Merchant Category Code used in the Authorization Request does not match the Merchant Category Code in the Clearing Record of the first Presentment for the same Transaction.

For Chargeback Condition 2, all of the following:
a. The Chargeback applies for the entire Transaction amount
b. The Chargeback applies when the Authorization Request and Clearing Record are processed by either the same or different Acquirers
c. The Authorization is invalid if the Merchant used invalid or incorrect Transaction data, as
specified in the applicable VisaNet Manuals, such as:
i. Incorrect Transaction Date
ii. Incorrect Merchant Category Code
iii. Incorrect indicator for the Merchant or Transaction type
iv. Incorrect country code/state or special condition indicator

The invalid country code is not an automatic chargeback win. The institution must provide additional documentation to substantiate why the incorrect country code led to your institution taking a loss.

Effective for Chargebacks processed on or after 20 April 2013,
in lieu of documentation, for Transactions not involving Issuers or Acquirers in Visa Europe, Issuer certification that the Authorization Request would have been declined if valid data had been provided and an explanation of why the inclusion of valid data would have caused the Authorization Request to be declined.

I hope this info helps. I also invite you to check out my upcoming webinar comparing VISA rules and Reg E. Reg E vs. VISA: Debit Card Dispute Resolution

Thank you Brian! This is exactly what I needed. I think I may have a shot at a chargeback. The customer had fraud previously, out of India, on a different card, not knowing for sure if the customer had been a victim of a scam or just that their card had been compromised somewhere we created a rule to restrict based on the India country code. So a new card is issued and a few weeks later, this happens. Thanks again!