It's coming from visa.com, somebody would have had to hijack their domain first to set up a phishing scam like this.