The fact is his card is VbV. He claims not to have received any OTP message, while it was obviously sent.
There is nothing obvious about that.
As far as I know Verified-by-Visa isn't mandated by the card alone, it also has to be supported by the Merchant where the card is used for payments.
When the Merchant doesn't support VbV then none of the extra authentication steps that VbV supports are taken and only the basic card details (Card Holder Name - Card Number - CVC) will be used to process the payment.
It stands to reason that a criminal with stolen credit card details would prefer such a Merchant to buy their bitcoin and then obviously no SMS message with an OTP would have been sent to your friend.
Merchants not supporting VbV run a greater risks of charge backs and not receiving their payment when the charges are disputed by the card holder, which will be the case when your friend disputes this charge with his card issuer.
Also the online documentation suggest that even when a merchant does support Verified by Visa you won't be prompted for the additional verification with every transaction, but only occasionally.