>That doesn't eliminate the possibility of CAPTCHA farmers but couple it with reverse IP lookup to make sure it's not India or China and they could be pretty sure the user is legit. Then it's up to the CC company to authorize or not; dunno if there's any ability to feed the CC company the source IP or other geo data to help with that.

I'm not sure this would be a good idea. Perhaps verifying it against a known blacklist of IP numbers, but I wouldn't go by country. The CC company's best customers may travel there and then have their card blocked on suspicion of stolen identity. They'd get not just very frustrated, but literally penniless in a foreign country.