Hi,
If you look up who owns the domain name where the email was sent it reads:
Akira Kurabe
800 Metro center blvd
Foster City, CA 94404
US
Domain name: VISA-SECURITY.COM
Contact: spoof@visa.com
-------------------------------------------
Enough said!
It's a pity that Visa don't seem to have any way of reporting the scam, at their web site. Moreover I noticed www.visa-security.co.uk is up for sale as of today (so someone else could set up a new scam). Should Visa be purchasing domains to prevent fraudsters from setting up in the first place?