Does re-transmission really reduce security?
Your colleague is wrong; assuming that the GCM nonces are generated correctly (that is, never repeats for the same key), there is no risk to GCM in repeating the VCC.

GCM has the property that, as long as you never repeat the nonce for the same key, GCM guarantees both the privacy and integrity of the encrypted plaintext (assuming that AES is a strong block cipher and that the AES key cannot be guessed).  This remains true even if you repeat the same region (such as the VCC) for multiple plaintexts.  Actually, the guarantee is even stronger; you could let the attacker choose the plaintexts for you to encrypt, and he still cannot learn either the AES key, or the plaintext for an encrypted message that he did not choose.