JP2012038130A - Fraud recording system, and control method and program for fraud recording system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To share the latest fraud occurrence pattern for accurately determining the presence or the absence of fraud, among a plurality of shops.SOLUTION: A fraud surveillance system SY comprises a plurality of fraud level calculation devices 16 and a fraud surveillance server 15 for controlling them. Each fraud level calculation device 16 includes: a fraud occurrence pattern storage part where a fraud occurrence pattern describing the numbers of basic points being respective weights with respect to one or more predictable fraud occurrence elements in shops is stored; a fraud occurrence detection part which detects the occurrence of one or more fraud occurrence elements; and a fraud level calculation part which calculates a fraud level by totalizing the numbers of basic points corresponding to a fraud occurrence element of which the occurrence has been detected. The fraud surveillance server 15 includes a fraud occurrence pattern updating part which, if the fraud occurrence pattern storage part of any of the plurality of fraud calculation devices 16 is updated, reflects the update contents on the other fraud level calculation devices 16.

Description

  The present invention relates to an unauthorized recording system, an unauthorized recording system control method, and a program for detecting an unauthorized act by a store clerk or a customer in a retail store such as a supermarket or a restaurant such as a family restaurant.

  Conventionally, Patent Document 1 has been proposed as a system for detecting fraud at the time of accounting processing by a store clerk in a retail store or a restaurant. The system described in Patent Document 1 includes a POS (Point Of Sales) terminal (POS terminal), a camera that captures an image around the POS terminal, a photo journal recorder, and a search terminal. The photo journal recorder records journal data (transaction history data), image data around the POS terminal captured by the camera, and operation history (operation history data) of the POS terminal by the store clerk in association with each other. . Then, the administrator designates predetermined search conditions such as time and POS terminal operation information using the search terminal, thereby displaying journal data and image data that match the search conditions on the display.

JP 2005-115504 A

  However, the system described in Patent Document 1 only displays a list of recorded data (accounting processing contents and captured images at that time) that match the search conditions specified by the administrator. In order to detect whether or not it has been received, the administrator must check the recorded data step by step. In addition, since it is necessary to check a large amount of recorded data, there is a problem in that an illegal act is not detected. As described above, the conventionally proposed system has a problem in that it cannot reliably detect an illegal act. Further, in recent years, the methods of fraudulent acts have become diversified and complicated, and it is impossible to accurately determine whether or not the fraudulent acts have been performed only with the captured images obtained by photographing the periphery of the POS terminal. For this reason, it is necessary to determine whether or not fraud has occurred based on the correlation among several fraud elements (the situation around the POS terminal, the behavior of the clerk, the contents of the accounting process, etc.). However, a system that takes into account the correlation of fraud elements has not been proposed yet.

  Even if a fraud pattern is established in consideration of the correlation between fraud elements, and preventive measures against the fraud pattern are taken, there are criminals who think about new tricks. For this reason, the same pattern is never valid, and a new fraud pattern must always be added and updated. However, such a fraud pattern update process is very time-consuming. In particular, in the case of a large-scale retail store having many stores, it is necessary to perform an update operation for each store, and the update operation is expected to be more complicated.

  In view of the above problems, the present invention provides a fraud recording system, a fraud recording system control method, and a program capable of sharing the latest fraud occurrence pattern for determining whether or not fraudulent acts are always highly accurate among a plurality of stores. The purpose is to provide.

  The fraud recording system of the present invention is a fraud recording system in which a plurality of fraud level calculation devices and a fraud management server that controls the plurality of fraud level calculation devices are connected via a network. The apparatus generates a fraud occurrence pattern storage unit that stores fraud occurrence patterns describing a basic score as a weight for each of one or more fraud occurrence elements assumed in the store and one or more fraud occurrence elements. / Fraud management that includes a fraud detection unit that detects non-occurrence and a fraud level calculation unit that calculates the fraud level by summing up the basic points corresponding to the fraud elements that have been detected by the fraud detection unit When the fraud occurrence pattern storage unit of one of the plurality of fraud level calculation devices is updated, the server calculates the other fraud level. Characterized by comprising a fraud pattern update unit to be reflected in the fraud pattern storage unit of the location.

  The control method for a fraud recording system of the present invention is a control method for a fraud recording system in which a plurality of fraud level calculating devices and a fraud management server that controls the plurality of fraud level calculating devices are connected via a network. Each fraud degree calculation device includes a fraud occurrence pattern storage unit that stores fraud occurrence patterns describing a basic score that is a weight for each of one or more fraud occurrence elements assumed in a store. A fraud occurrence detecting step for detecting occurrence / non-occurrence of each of the fraud occurrence elements described above, and a fraud degree calculation step for calculating the fraud level by summing up the basic points corresponding to the fraud occurrence elements for which occurrence has been detected. And the fraud management server updates the fraud occurrence pattern storage unit of one of the plurality of fraud degree calculation devices when the fraud occurrence pattern storage unit is updated. And executes the fraud pattern updating step to reflect the new content to the fraud pattern storage unit of other illegal calculation device.

According to these configurations, when the fraud occurrence pattern is updated in any one of the plurality of fraud level calculation devices connected to the network, the fraud management server updates the contents of the update. Therefore, the trouble of updating the fraud occurrence pattern by the system administrator or the like can be reduced. In addition, since the latest fraud occurrence pattern is shared among a plurality of fraud level calculation devices, it is possible to always determine the presence or absence of fraud in the store with high accuracy.
In addition, each fraud level calculation device calculates the fraud level (high possibility of fraud) by summing the basic points corresponding to one or more fraud elements that have been detected. (Such as an administrator) can grasp the possibility of fraud from the calculation result. As a result, it is possible to more accurately determine the presence or absence of a fraudulent act even for a complex act of fraud.
Note that fraudulent elements include predetermined key operations by the accounting processing unit, inconsistencies in receipts during exception processing and checkout processing, inconsistencies in target customers during exception processing and checkout processing, and predetermined voice keywords during exception processing. Non-detection, change in cash drawer open / close state, intrusion of store clerk, execution of accounting process in the situation where there is no person other than the clerk operating the accounting processing unit around the checkout counter, suspicious behavior of the clerk, It includes at least one element among changes in the biological signal.
In addition, each fraud level calculation device includes a fraud level output means (fault level output step) for outputting the calculation result of the fraud level calculation means (fault level calculation step) to a recording database, and a fraud level calculation means (fault level). It may further comprise fraud determination means (fraud determination step) for determining the presence or absence of fraud based on the calculation result of the calculation step.

  In the fraud recording system described above, the fraud occurrence pattern update unit, when a new fraud occurrence pattern is added to the fraud occurrence pattern storage unit of any fraud degree calculation device, It is preferable to add to the fraud occurrence pattern storage unit of the fraud degree calculation device.

  According to this configuration, a new fraud pattern can be added as updated fraud patterns.

  In the fraud recording system described above, the fraud management server further includes a device information storage unit that stores device information on one or more detection devices for realizing the fraud occurrence detection unit of each fraud degree calculation device, Each fraud occurrence element included in the fraud occurrence pattern is associated with one or more types of detection devices capable of detecting each fraud occurrence element, and the fraud occurrence pattern update unit has added a new fraud occurrence pattern. In the case, the fraud occurrence pattern storage unit refers to the device information storage unit and the fraud occurrence pattern storage unit includes a new fraudulent degree calculation device including a detection device that can detect all fraud occurrence elements included in the new fraud occurrence pattern. It is preferable to add a generation pattern.

  According to this configuration, the fraud occurrence pattern is added to the fraud degree calculation device including a detection device that can detect all fraud occurrence elements included in the added new fraud occurrence pattern. In other words, even if a new fraud pattern is added, it is not subject to update for fraud level calculation devices in stores that do not have a detection device to detect it. Addition can be prevented.

  In the fraud recording system described above, the fraud management server may be a case where a new fraud occurrence pattern is added to the fraud occurrence pattern storage unit of one of the fraud degree calculation devices. If it is determined from the reference result of the device information storage unit that there is a fraud calculation device that does not include a detection device that can detect all fraud occurrence elements included in the new fraud occurrence pattern, the fraud calculation device On the other hand, it is preferable to further include a device introduction notification unit that performs a notification prompting the introduction of the corresponding detection device.

  According to this configuration, a new fraud pattern can be detected by introducing the corresponding detection device (introducing the fraud level calculation device of a store where a detection device for detecting a new fraud pattern has not been introduced. Notification for urging the introduction of the detection device) is reduced, so that the trouble of notification by the system administrator or the like can be reduced.

  In the fraud recording system described above, each fraud level calculation device notifies the fraud management server of operational data indicating the operational status of one or more detection devices for realizing the fraud occurrence detection unit. It is preferable that the fraud management server further includes a device information update unit that updates the device information stored in the device information storage unit based on the operation data acquired from each fraud degree calculation device.

  According to this configuration, in order to update the device information stored in the device information storage unit based on the acquired operation data, for example, a detection device that cannot be operated due to a failure or the like is treated as not being introduced. Can do. As a result, it is possible to solve a problem such that a new fraud pattern that requires the detection device is erroneously added even though the detection device is not operating.

  In the fraud recording system described above, each fraud level calculation device uses a loss corresponding to the difference between the planned sales amount for the inventory and the actual sales based on the results of the inventory management database and the sales management database. A loss amount calculating unit for calculating the amount of money, and a loss amount notifying unit for notifying the fraud management server of the calculated loss amount, and the fraud management server stores in the fraud occurrence pattern storage unit of the plurality of fraud level calculating devices. A server-side fraud occurrence pattern storage unit that stores all the fraud occurrence patterns stored therein, and each fraud occurrence pattern stored in the server-side fraud occurrence pattern storage unit When a loss amount exceeding a predetermined amount is notified from the device ID storage unit that stores the device ID and an arbitrary fraud calculation device, the arbitrary fraud calculation An unaccepted pattern that is read from the server-side fraud occurrence pattern storage unit and is notified of an unaccepted pattern that is identified by referring to the device ID storage unit and that is not stored in the fraud degree calculation device. And a notification unit.

According to this configuration, in order to notify the fraud calculation device having a large loss amount to the unaccepted pattern that is a fraud occurrence pattern that is not stored in the fraud level calculation device, each store verifies the unadopted pattern. Thus, it can be determined whether or not to employ. In addition, by adopting unemployed patterns positively, a reduction in loss money can be expected.
In addition, since adoption of a non-adopted pattern requires introduction of a detection device, it is preferable that the non-adopted pattern notification unit notifies the detection device for detecting this along with the non-adopted pattern.
Further, in each store where the fraud level calculation device is installed, it is not determined whether or not the notified non-employment pattern is adopted, but the fraud management server is not forced to each fraud level calculation device. You may adopt the adoption pattern. That is, each fraud degree calculation device may store the fraud occurrence pattern as it is in the case where a fraud pattern is notified from the fraud management server.

  In the fraud recording system described above, it is preferable that each fraud level calculation device further includes a warning unit that issues a warning when a fraud level exceeding a predetermined value is calculated by the fraud level calculation unit.

  According to this configuration, when there is a high possibility that fraud has been performed, a warning is issued in the fraud calculation device provided in each store, so that the store clerk and store manager (manager, store manager, etc.) are informed of that. be able to.

  In the fraud recording system described above, each fraud level calculating device further includes a fraud level calculation result notifying unit for notifying the fraud management server of the calculation result of the fraud level calculating unit that is the target of the warning. Refers to the device information storage unit, and the fraud level calculation result storage unit that stores the reported fraud level calculation result in association with one or more detection devices included in the fraud level calculation device that has notified the fraud level calculation result. The fraud level calculation result of any fraud occurrence pattern stored in the fraud level calculation result storage unit is aggregated for each corresponding detection device. As a result, if the corresponding detection device is biased, the fraud level is high. Or a recommended device identifying unit that identifies a detected device close to the average value as a recommended device of an arbitrary fraud occurrence pattern, and a fraud degree calculation device that stores the arbitrary fraud occurrence pattern, and To fraud calculating device without the recommend equipment, the recommended device notifying unit for notifying the recommended equipment preferably further comprises a.

  Since each fraud element is associated with one or more types of detection devices, depending on the type of detection device installed in each store, the same fraud (fault detected by the same fraud pattern) However, there is a possibility that the calculated fraud level is biased. For this reason, a detection device with a high degree of fraud or close to the average value is identified as a recommended device for any fraud occurrence pattern, and this is notified to the fraud calculation device that has not been installed by the recommended device. Can be promoted, and as a result, the detection accuracy of fraudulent acts in the store can be improved.

  In the fraud recording system described above, each fraud level calculation device further includes an exception processing detection unit that detects that an exception processing corresponding to a part of the accounting processing has occurred by the accounting processing unit, The calculation unit preferably functions on the condition that the exception processing is detected by the exception processing detection unit.

In general, fraudulent acts are often executed along with exception processing. According to this configuration, since the fraud level is calculated only when exception processing occurs in each fraud level calculation device, it is possible to efficiently detect fraud.
Exception processing means “cancellation processing”, “cancellation processing”, “return processing”, “discount processing”, “discount processing”, “exchange processing”, “inspection processing”, “withdrawal / refund processing”. , "Reissue process".

  In the fraud recording system described above, the exception processing detection unit detects the type of exception processing, and the fraud occurrence pattern storage unit stores fraud occurrence patterns for each type of exception processing, and the fraud degree calculation unit Preferably, the fraud occurrence pattern corresponding to the type of exception processing detected by the exception processing detection unit is extracted from the fraud occurrence pattern storage unit, and the fraud level is calculated.

  According to this configuration, since the fraud pattern is stored for each type of exception processing, each fraud level calculation device further uses the fraud pattern suitable for the type of exception processing to further detect fraud. Can be improved.

  A program according to the present invention causes a computer to execute each step in the control method for an unauthorized recording system described above.

  By executing this program, it is possible to realize a method for controlling an unauthorized recording system that can share the latest fraud occurrence pattern for constantly determining the presence or absence of fraudulent activity among a plurality of stores.

It is a system configuration figure of a fraud monitoring system concerning one embodiment of the present invention. It is a block diagram which shows the hardware constitutions of a fraud degree calculation apparatus. It is a functional block diagram of a fraud degree calculation apparatus. It is a figure which shows the list of fraud patterns. It is a figure which shows the recording content of the database for recording. It is a figure which shows the structure of a fraud element. It is a figure which shows the specific example of a fraud element. It is a figure which shows the example of generation | occurrence | production order definition of fraud pattern A1. It is a figure which shows an example of the detection result with respect to fraud pattern A1. It is a flowchart which shows the fraud degree recording process of a fraud degree calculation apparatus. It is a functional block diagram of a fraud management server. It is a figure which shows the list of apparatus ID. It is a figure which shows the list of apparatus information. It is a figure which shows an example of a fraud degree calculation result. It is a flowchart which shows the fraud occurrence pattern update process of a fraud management server.

  Hereinafter, an unauthorized recording system, an unauthorized recording system control method, and a program according to the present invention will be described with reference to the accompanying drawings. In the following embodiments, the case where the fraud recording system of the present invention is applied to a fraud monitoring system in a store will be exemplified. The fraud monitoring system is constructed to detect fraudulent acts by store clerk and customers in a retail store such as a supermarket.

  FIG. 1 is a system configuration diagram of the fraud monitoring system SY. As shown in the figure, the fraud monitoring system SY includes a plurality of fraud degree calculation devices 16 (in the figure, three of 16a, 16b and 16c are shown), one fraud management server 15, and these. And a network NT to be connected. The fraud level calculation device 16 is arranged in each store one by one, and calculates “degree of fraud” indicating the degree of fraud of the clerk and / or customer action that occurred in each store. That is, it is determined that the higher the degree of fraud, the higher the possibility that fraud has been performed.

  On the other hand, the fraud management server 15 is connected to a plurality of fraud degree calculation devices 16 via a network NT such as the Internet, and manages them in an integrated manner. The fraud management server 15 includes various databases such as a fraud occurrence database 91, a device information database 92, and a fraud degree calculation result database 93. The fraud occurrence database 91 stores a large number of fraud occurrence patterns defining fraudulent acts. The device information database 92 stores information related to a detected device installed in each store in order to detect fraud. The fraud level calculation result database 93 stores the fraud level calculation results calculated by the fraud level calculation devices 16. By providing these databases, the fraud management server 15 provides fraud occurrence patterns to each fraud level calculation device 16, obtains fraud level calculation results from the respective fraud level calculation devices 16, and handles each fraud level calculation device 16. Information notification, etc. Details will be described later with reference to FIG.

  Next, the hardware configuration of the injustice degree calculating device 16 will be described with reference to FIG. The fraud degree calculation device 16 includes a POS terminal 1 that performs accounting processing, a receipt printer 2 that issues a receipt (not shown), a handy scanner 3 that reads a barcode attached to or printed on a product, and a register counter 10. , A cashier card reader 4 that performs non-contact reading of the clerk card C, a clerk wristband 5 that is worn on the wrist of the clerk (operator), a customer display 6 that displays product information, and a clerk's head. A headset 7, a receipt scanner 8 for reading receipts, a cash register monitoring camera 9 for monitoring the vicinity of a cash register counter, a store monitoring camera 11 for monitoring the inside of the store, and non-contact reading of the clerk card C at any location in the store. From the in-store card reader 14 to be performed and the store server 12 that supervises the fraud calculation device 16 That. The POS terminal 1, the receipt printer 2 and the handy scanner 3, the receipt printer 2 and the registration card reader 4, the clerk wristband 5, the customer display 6, the headset 7, and the receipt scanner 8 are each connected to a serial interface (for example, USB (Universal Serial Bus) interface) or wireless LAN. The POS terminal 1, the receipt printer 2, the cash register monitoring camera 9, the in-store monitoring camera 11, the in-store card reader 14 and the store server 12 are connected by an in-store LAN 13 (wired LAN or wireless LAN).

  Although not particularly illustrated, the store server 12 sends an e-mail (warning document for notifying the occurrence of fraud) to a manager's mobile phone possessed by an administrator (manager, store manager, etc.) having a predetermined authority in the store. Etc.) can be sent. The store server 12 has a microphone so that a server administrator and a store clerk wearing the headset 7 can talk to each other. 2 shows the case where there is one POS terminal 1, but when a plurality of cash register counters 10 are installed in the store, the POS terminal 1 and the like are provided for each cash counter 10.

  The POS terminal 1 is installed in the cashier counter 10 and performs accounting processing, a data hook driver 42 that outputs an operation result of the POS terminal 1 to the receipt printer 2, a cash drawer 43 that stores cash, have. In addition, although not specifically shown, it has a general register configuration. The handy scanner 3 reads a product barcode on which a product code or the like is recorded, and outputs the read result to the POS terminal 1.

  The cashier card reader 4 and the in-store card reader 14 read the store clerk ID from the store clerk card C in which a wireless IC (RFID: Radio Frequency Identification or the like) is incorporated. The store clerk who is working is required to possess the store clerk card C. The store clerk wristband 5 incorporates a sweat sensor 45 that measures the amount of sweat of the wearer and a pulse sensor 46 that measures the pulse rate of the wearer. A store clerk (operator) who operates the POS terminal 1 in the cashier counter 10 is required to wear the store clerk wristband 5.

  The customer display 6 has a function of acquiring a customer's voice by a customer microphone 6a in addition to a general function as a customer display for displaying a product name and a product price to a customer. The customer microphone 6 a is a small sound collecting microphone, and is provided on the peripheral portion of the customer display 6 toward the customer side. The headset 7 is also called an income, and includes a clerk microphone 7a and headphones (not shown). A store clerk operating the POS terminal 1 is also required to wear the headset 7. The receipt scanner 8 reads a receipt for the purpose of determining receipt authenticity.

  The receipt printer 2 has a function of measuring the temperature in the register counter 10 by a thermometer 44 in addition to a function of issuing a receipt based on the accounting information output from the POS terminal 1. Further, the receipt printer 2 inputs various information from serially connected peripheral devices and outputs them to the store server 12. In this way, by inputting / outputting various information with the receipt printer 2 as the main (the receipt printer 2 filters the acquired various information and outputs necessary information), the POS backbone network (POS terminal 1) Network) is not affected. Further, when applying the present invention to an existing POS system, it is not necessary to change the POS backbone network itself.

  The cashier monitoring camera 9 is provided on the ceiling of the cashier counter 10 and the like, inside the cashier counter 10 (such as around the store clerk and the POS terminal 1), on the cashier counter 10 (products subject to accounting processing, cash exchange, etc.) An image is taken in front of the cashier counter 10 (such as a customer). The in-store monitoring cameras 11 are provided at a plurality of locations in the store and monitor the entrance / exit of the store clerk to / from a predetermined area or a predetermined room. As the cash register monitoring camera 9 and the store monitoring camera 11, a CCD camera or a PTZ (Pan Tilt Zoom) camera can be used.

  The store server 12 includes a facial feature database 21 that stores the facial features of the clerk as a database, a keyword database 22 that stores the keywords of the clerk and the customer that are spoken during the accounting process, and fraud of the clerk and the customer. And a recording database 23 for recording the degree. The store server 12 calculates the degree of fraud of the store clerk and the customer based on the in-store status data detected by each of the above devices and the reference results of the face feature amount database 21 and the keyword database 22. The fraud level is recorded in the recording database 23. When the calculated fraud degree exceeds a predetermined value, a warning is given to the operator and the administrator, and the fraud degree calculation result is notified to the fraud management server 15.

  Next, the functional configuration of the injustice degree calculating device 16 will be described with reference to FIG. The POS terminal 1 has an accounting processing unit 51 as a main functional configuration. The accounting processing unit 51 has the POS application 41 as a main part, and executes accounting processing including settlement processing and exception processing. The processing results are output to the receipt printer 2 as transaction information.

  In the present embodiment, exception processing refers to predetermined processing that is likely to be related to fraud. Specifically, “return processing” for returning a product, “misregistration processing (cancellation processing)” for canceling the accounting processing after accounting processing, “discount processing” for discounting the product, “Discount process” for discounting the product, “Cancel process” for canceling the input data during the accounting process, “Exchange process” for exchanging money, and cash and sales in the cash drawer 43 It refers to “inspection processing” for collation, “withdrawal / refund processing” for withdrawal or refund, and “reissue processing” for reissuing a receipt. Each of these processes is distinguished as an exception process type.

  The cashier card reader 4 has a cashier ID reading unit 52 as a main functional configuration. The cash register ID reading unit 52 performs short-range wireless communication with the clerk card C, and reads the clerk ID from the clerk card C existing around the cash register counter 10. The store clerk wristband 5 includes a sweating amount measurement unit 53 and a pulse rate measurement unit 54 as main functional configurations. The sweating amount measuring unit 53 is realized by the sweating sensor 45, and the pulse rate measuring unit 54 is realized by the pulse sensor 46.

  The customer microphone 6a provided on the customer display 6 has a customer voice acquisition unit 55 as a main functional configuration. The customer voice acquisition unit 55 acquires a customer voice signal and outputs it to the receipt printer 2. The clerk microphone 7a provided in the headset 7 has a clerk voice acquisition unit 56 as a main functional configuration. The clerk voice acquisition unit 56 acquires the clerk's voice signal and outputs it to the receipt printer 2.

  The receipt scanner 8 has a receipt reading unit 57 as a main functional configuration. The receipt reading unit 57 reads the receipt and obtains product information (transaction number, receipt issue date, product name, quantity, product unit price, total price, etc.) printed on the receipt. The cashier monitoring camera 9 includes a cashier imaging unit 58 as a main functional configuration. The cash register imaging unit 58 captures an image around the cash register counter 10 and outputs the imaging result to the store server 12. The in-store monitoring camera 11 has an in-store imaging unit 59 as a main functional configuration. The in-store imaging unit 59 captures an in-store video including the behavior (movement) of the store clerk and the customer in the store, and outputs the imaging result to the store server 12. The in-store card reader 14 has an in-store ID reading unit 60 as a main functional configuration. The store ID reading unit 60 performs short-range wireless communication with the store clerk card C, and reads the store clerk ID from the store clerk card C of the store clerk who enters / exits an arbitrary place (for example, a changing room) in the store.

  The receipt printer 2 includes a transaction information acquisition unit 61, an exception processing detection unit 62, a clerk ID detection unit 63, a biological signal detection unit 64, a voice recognition unit 65, a reading result acquisition unit 66, a printing unit 67, and a main functional configuration. An operator warning unit 68 is provided. The transaction information acquisition unit 61 acquires the transaction information output from the POS terminal 1 (accounting processing unit 51).

  Based on the transaction information acquired by the transaction information acquisition unit 61 or the detection result of the data hook driver 42, the exception processing detection unit 62 detects that the exception processing has occurred in the transaction processing unit 51 and its type. It should be noted that an illegality calculation unit 73, an illegality recording unit 74, an operator warning unit 68, an administrator warning unit 75, and an illegality calculation result notification unit 76, which will be described later, have detected exception processing by the exception processing detection unit 62. Function as a condition.

  The store clerk ID detection unit 63 detects the store clerk ID from the reading result of the cash register ID reading unit 52, and outputs the detection result to the fraud occurrence detection unit 72 (described later). The number of salesclerks present around the cashier counter 10 is specified by the detected number of salesclerk IDs, and the salesclerk operating the POS terminal 1 can be specified by the detected salesclerk ID. The clerk ID detection unit 63 may be realized by a plurality of register card readers 4 having directivity. According to this configuration, it is possible to clearly distinguish and detect the clerk performing the accounting operation and the other clerk.

  The biological signal detection unit 64 detects a biological signal that is a measurement result of the sweating amount measurement unit 53 and the pulse rate measurement unit 54, and outputs the detection result to the fraud occurrence detection unit 72. The voice recognition unit 65 acquires voice data from the customer voice acquisition unit 55 and the store clerk voice acquisition unit 56 and performs voice recognition. The voice recognition unit 65 has two dedicated recognition units for independently recognizing customer voices and store clerk voices. Each dedicated recognition unit includes an acoustic analysis unit, an acoustic model, and a language. A model, a word dictionary, and a text conversion unit are included (all not shown). Each dedicated recognition unit uses these to convert the acquired speech signal into text information. The text information is output to the fraud occurrence detection unit 72.

  The reading result acquisition unit 66 detects product information that is the reading result of the receipt reading unit 57 and outputs the detection result to the fraud occurrence detection unit 72. The printing unit 67 prints the transaction information acquired by the transaction information acquisition unit 61 on receipt paper and issues a receipt. The operator warning unit 68 notifies the operator that there is a high possibility that an illegal act has been performed when a fraud level exceeding a predetermined value is calculated by the fraud level calculation unit 73 (described later). Examples of the notification method include display on an operator display (not shown), sound generation, LED lighting / flashing, vibration by a vibrator, and the like.

  The store server 12 includes a fraud occurrence pattern storage unit 71, a fraud occurrence detection unit 72, a fraud level calculation unit 73, a fraud level recording unit 74, an administrator warning unit 75, a fraud level calculation result notification unit 76, as main functional configurations. A fraud occurrence pattern notification unit 77, an operation data notification unit 78, a loss amount calculation unit 79, and a loss amount notification unit 80 are provided. The fraud occurrence pattern storage unit 71 stores fraud occurrence patterns in which one or more fraud occurrence elements assumed in the store are defined. Here, the “fraud element” refers to a predetermined key operation by the accounting processing unit 51, a mismatch of receipt reading results (product information) at the time of exception processing and payment processing, a target customer at the time of exception processing and payment processing Discrepancy, non-detection of predetermined voice keyword during exception processing, change in cash drawer 43 open / close state, intrusion of store clerk into a predetermined area (changing room, etc.), no other store clerk or customer around register counter 10 Refers to the execution of accounting processing in the situation, suspicious behavior of store clerk (looking around), change of store clerk's biological signal, etc.

  As shown in FIG. 4, fraud patterns are classified and stored for each exception processing type. In the list of fraud occurrence patterns shown in FIG. 4, “fraud technique” indicates a technique of fraudulent behavior assumed when the corresponding exception processing type is executed. In the same figure, “exception processing type” and “illegal trick” have a 1: 1 relationship, but N: 1 (where N is an integer of 2 or more) or 1: N. It may be a relationship. In addition, as shown in the column “illegal occurrence pattern”, a plurality of fraud occurrence patterns are associated with each exception processing type.

  The fraud occurrence detection unit 72 detects occurrence / non-occurrence of fraud occurrence elements defined in the fraud occurrence pattern. In addition, for the fraud element that has detected the occurrence, the precision is detected as necessary. The matching rate refers to an intermediate value (a value greater than 0% and less than 100%) where “occurrence” is 100% and non-occurrence is 0%. The fraud level calculation unit 73 extracts a fraud occurrence pattern corresponding to the type of exception processing detected by the exception processing detection unit 62 from the fraud occurrence pattern storage unit 71, refers to the fraud occurrence pattern, and determines the fraud level. calculate. Specifically, out of the fraud occurrence elements described in the fraud occurrence pattern, the basic score (= abnormal value) corresponding to the fraud occurrence elements detected by the fraud occurrence detection unit 72 is summed up to calculate the fraud level. Is calculated. Note that for fraud occurrence elements whose relevance rate is detected by the fraud occurrence detection unit 72, the corresponding base score is multiplied by the relevance rate, and the multiplication result is used as an abnormal value. Details will be described later. The injustice degree recording unit 74 records the calculation result of the injustice degree calculating unit 73 in the recording database 23 (see FIG. 5).

  As shown in FIG. 5, in the recording database 23, various types of information are recorded for each accounting process (accounting process number). Specifically, fraud occurrence date and time, transaction data, target cash register ID (POS terminal 1 ID), cashier person ID (clerk ID), exception processing type, detection result of each fraud element (situation data), customer Information and fraud levels are recorded. The customer information includes a customer ID specified by using a membership card, a credit card, electronic money, and the like, a facial feature amount obtained from an imaging result of the cashier monitoring camera 9, and a voice acquisition result of the customer microphone 6a. Refers to biological information such as voiceprints obtained from Further, the type of exception processing indicates the detection result of the exception processing detection unit 62, and the degree of fraud indicates the calculation result of the fraud level calculation unit 73.

  The administrator warning unit 75 issues a warning to the administrator when the fraud level calculation unit 73 calculates a fraud level exceeding a predetermined value. In the present embodiment, a warning document is transmitted by e-mail to a manager's mobile phone possessed by the manager. The e-mail includes items recorded in the recording database 23 described above. In addition, it is preferable that the administrator can extract and confirm imaging data at the time of fraud that is captured by the cashier monitoring camera 9 or the in-store monitoring camera 11 using the information included in the warning document as a search key. Further, as a warning method for the administrator, a portable information terminal connected to a Web application or a store LAN may be used instead of an e-mail. As described above, by using an electronic mail or a Web application, it is possible to reliably notify the warning content regardless of the location of the administrator.

  The injustice degree calculation result notifying unit 76 notifies the injustice management server 15 of the calculation result of the injustice degree calculating unit 73 that is a warning target by the operator warning unit 68 or the administrator warning unit 75. The notification contents include each item recorded in the recording database 23 described above.

  When the fraud occurrence pattern storage unit 71 is updated, the fraud occurrence pattern notification unit 77 notifies the fraud management server 15 of the updated contents. The update contents may include addition of a new fraud pattern, correction of a fraud pattern, deletion of a fraud pattern, and the like. The fraud pattern is treated as “correction” when there is no change in the configuration of the detection device included therein, and is treated as “new addition” when there is a change in the configuration of the detection device.

  The operational data notification unit 78 provides operational data (power ON / OFF, presence / absence of information output to the store server 12, etc.) indicating the operational status of one or more detection devices for realizing the fraud detection unit 72. The fraud management server 15 is notified. The operation data is used to update the device information database 92 (see FIG. 1) of the fraud management server 15.

  The loss amount calculation unit 79 refers to an inventory management database (not shown) in which the number of products in stock is recorded and a sales management database (not shown) in which sales obtained from the processing result of the accounting processing unit 51 are recorded. Based on the above, a loss amount corresponding to the difference between the planned sales amount for the inventory and the actual sales is calculated. The amount of loss is calculated for each predetermined period (day, week, month, etc.) and used to estimate the frequency of fraudulent activity. That is, if the amount of loss is large, it is determined that measures to prevent fraud should be strengthened. The loss amount notification unit 80 notifies the fraud management server 15 of the loss amount calculated by the loss amount calculation unit 79.

  Next, the structure of the fraud element will be described with reference to FIG. As described above, the fraud occurrence element is defined in the fraud occurrence pattern, but the user can define the details by using an operation unit (not shown) provided in the receipt printer 2, the store server 12, or the like. it can. In addition, with this definition, the receipt printer 2 or the store server 12 can create and correct fraud patterns using a predetermined wizard incorporated in advance.

  As shown in the figure, the fraud elements include information on “classification number”, “element number”, “detection device”, “determination content”, and “weighting”. The “classification number” is group identification information when the fraud elements are classified into a plurality of groups, and specific examples include a to e in the figure. The user searches the fraud occurrence element to be incorporated into the fraud occurrence pattern using the classification number as an index. The “element number” is identification information uniquely assigned to each fraud element. The “detection device” is a device for detecting the fraud element, and specifically includes m1 to m9 shown in the figure. In addition, as will be described later with reference to FIG. 7, “determination content” refers to “determination item” and “determination condition”, and “weighting” refers to “basic score” assigned to the fraud element and conformity “Coefficient” for calculating the rate.

  A plurality of “detection devices” can be associated with fraud elements that can be detected by a plurality of detection devices. For example, if the fraudulent element is a content that restricts the number of salesclerks around the cashier counter 10, the number of salesclerks can be detected by the cashier card reader 4 (m1) and the cashier monitoring camera 9 (m6). Two detection devices may be associated with each other. In addition, if the fraudulent element is entry into the changing room of the store clerk (operator), it can be detected by the in-store monitoring camera 11 (m7) and the in-store card reader 14 (m8) installed outside the changing room, The two detection devices may be associated with each other. Also, the “determination content” and “weighting” can be arbitrarily set by the user.

  Here, a specific example of the fraud element will be described with reference to FIG. For example, the fraudulent element of “element number: E1” is detected by the data hook driver 42 (see FIG. 2) (m9) incorporated in the POS terminal 1, and the POS is detected by the operation information output from the data hook driver 42. If the pressing of the cancel key in the terminal 1 can be detected, “occurrence” is detected by the fraud occurrence detection unit 72 as “POS exception key pressed”. In this case, the store clerk ID of the operator is detected using the data hook driver 42 or the cashier card reader 4, and the store clerk ID is recorded in the recording database 23 as a detection result. Note that “the POS exception key has been pressed” does not use the data hook driver 42, but the accounting information output from the POS terminal 1, the print data for receipt printing, and the display for display on the customer display 6. You may detect based on data.

  The fraudulent occurrence element of “element number: E2” is detected by the cashier surveillance camera 9 (m6), and when the similarity is determined to be 60% or less by the same person determination, “buyer and exception applicant” “Occurrence” is detected by the fraud occurrence detection unit 72. Further, in the example of the figure, since the basic score is defined as “20” and the coefficient is defined as “1-image similarity”, when the image similarity is 20%, the relevance rate (the purchaser and the exception applicant) Is different = probability of becoming True) is 80%, and the abnormal value is the number of basic points × the matching rate = 16. Whether or not they are the same person is determined based on the facial feature amount of the customer recorded in the recording database 23 for each accounting process (see FIG. 5). That is, the facial feature amount of the target customer at the time of exception application (exception processing) (the facial feature amount calculated by analyzing the imaging result of the cashier monitoring camera 9 and normalizing the image of the facial part) And the facial feature quantity of the target customer at the time of product purchase (during the scanning process) specified from the receipt or the like presented at the time of exception application, and the degree of similarity is determined.

  Other generation elements are as shown in the figure. As a simple supplement, for “element number: E3”, “element number: E5”, and “element number: E6”, a moving area is detected from the imaging result of the cashier monitoring camera 9 (m6), and the moving area is detected. Therefore, the determination is made by repeating the steps of detecting the movement of the bill, the opening / closing of the human face, the hand and the drawer. For “element number: E5”, it is determined from the monitoring results of the cashier card reader 4 and the cashier monitoring camera 9 that the number of shop assistants around the cashier counter 10 is determined to be 1 and the number of customers is 0. It becomes a condition.

  For “element number: E4”, the in-store monitoring camera 11 arranged in the vicinity of the entrance of the changing room uses the facial feature amount of the operator (stored in the facial feature amount database 21 in association with the clerk ID). When a face feature amount similar to is detected, “occurrence” is detected. For “element number: E4”, the store clerk ID may be detected by reading the store clerk card C with the store card reader 14 installed near the entrance of the changing room.

  In FIG. 7, only six fraud elements E1 to E6 are illustrated, but the following elements can be added as fraud elements. For example, “the exception applicant is silent and in front of the cash register” may be detected from the voice acquired by the customer microphone 6a (m3). This is because a customer usually utters a phrase such as “The receipt is incorrect” at the time of an exception application, and it is considered that the possibility of fraud is high if the voice is silent. In this case, it is determined that “the exception applicant is silent and in front of the cash register” on the condition that a predetermined voice keyword (for example, “mistake”) cannot be recognized. The voice keyword can be defined by selecting one or more keywords from the keyword database 22 (see FIG. 2). Similarly, it may be detected from the sound acquired by the store clerk microphone 7a (m3) that the store clerk is performing a cash register operation silently.

  Note that the customer microphone 6a for collecting the customer's voice and the clerk microphone 7a for collecting the clerk's voice may not be provided independently, but may be collected by one microphone. In this case, a clerk voice print storage unit (not shown) for storing the clerk's voice print is provided in the receipt printer 2 or the store server 12. Then, the voice recognition unit 65 compares the acquired voice voice print with the voice print stored in the store clerk voice print storage unit, and discriminates between the store clerk's voice and the customer's voice according to whether or not they match. . According to this configuration, it is not necessary to provide the clerk and customer microphones independently. Thereby, the cost reduction of the injustice degree calculating device 16 can be achieved.

  Further, “a large difference between the original data of the occurrence of the exception and the processing data” may be detected from the reading result of the receipt scanner 8 (m5) as a fraud occurrence factor. This is to cope with a technique for performing a return processing using a forged receipt. In this case, “occurrence / non-occurrence” and “matching rate” are detected from the comparison result between the product information (receipt description item) read at the time of product purchase and the product information read at the time of exception application.

  Further, as a fraud occurrence factor, “there is only one clerk around the cashier counter” may be detected from the reading result of the cashier card reader 4 (m1). This is because fraudulent acts are usually performed when there are no other clerk around. In this case, “occurrence / non-occurrence” is detected according to whether or not the number of salesclerk IDs acquired by the cashier card reader 4 is 1 or less. Further, as a fraud occurrence factor, “there is no customer in front of the checkout counter” may be detected from the imaging result of the checkout monitoring camera 9 directed at the checkout. In this case, “occurrence / non-occurrence” is detected according to whether or not face detection has been performed from the imaging result of the cashier monitoring camera 9.

  Further, as a fraud occurrence factor, “the store clerk is sweating” may be detected from the measurement result of the sweat sensor 45 (m2). This is because when a cheating is performed, a change occurs in the clerk's biological signal. In this case, “occurrence / non-occurrence” is detected based on the increase in the amount of sweating before and after the exception processing. However, when the thermometer 44 detects that the temperature difference before and after the exception process is large (when it suddenly becomes hot), the precision is calculated in consideration of the temperature difference (coefficient based on the temperature difference). It is preferable. Moreover, you may detect from a measurement result of the pulse sensor 46 (m2) that a salesclerk's palpitation is intense as a fraud occurrence factor. In this case, “occurrence / non-occurrence” is detected based on the amount of increase in the pulse rate before and after the exception processing. However, when the movement amount of the operator before the exception process is large from the monitoring result of the cashier monitoring camera 9, it is preferable to obtain the matching rate in consideration of the movement amount (coefficient based on the movement amount).

  Next, the order of occurrence of fraud patterns will be described with reference to FIG. This figure shows a definition example of a fraud occurrence pattern (described as “pattern A1”). Pattern A1 corresponds to a technique in which the store clerk performs a cancellation process using a receipt that the customer did not receive, dresses cash equivalent to the sales amount of the receipt, and hides the dressed cash in the locker in the changing room It is. As shown in the figure, the fraud occurrence pattern can define “occurrence order” of each fraud occurrence element and “interval between each element”. Here, the “occurrence order” is defined by the described numbers, but it is not always necessary to define all fraud occurrence elements (the fraud occurrence elements regardless of the occurrence order may be included). In addition, the fraudulent occurrence element whose “occurrence order” is blank (hyphen display) means that it is not a detection target. Further, “interval with each element” means a time limit. For example, when “element number: E1” occurs (the POS exception key is pressed) within 10 seconds from the occurrence of “element number: E5” (the store clerk crawls) Assume that fraudulent elements occur in the specified order of occurrence.

  On the other hand, as shown in the lower part of the figure, each fraud occurrence pattern can be defined with a “matched addition value”. This “matched addition value” is a value added to the total value of abnormal values when the “occurrence order” defined in the fraud occurrence pattern matches the occurrence order detected by the fraud occurrence detection unit 72. It is. That is, the total value of the abnormal value total value and the coincidence addition value is calculated as the degree of fraud.

  Next, the detection result of the fraud occurrence pattern (pattern A1) and the calculation result of the fraud level based on the detection result will be described with reference to FIG. As described above, the fraud occurrence detection unit 72 detects occurrence / non-occurrence for each fraud occurrence element. For fraud elements with “coefficients” defined as “weighting” (see FIG. 7), the precision is detected. For fraud elements in which “occurrence” is detected and the relevance rate is not detected, the number of basic points is calculated as an abnormal value. Further, the fraud occurrence element in which “occurrence” is detected and the relevance rate is detected (in the example of the figure, “element number: E6”) is calculated as the number of basic points × the relevance rate = abnormal value. Further, although not present in the example of the figure, the abnormal value is set to “0” for the fraud element in which “non-occurrence” is detected. In addition, the example in the figure shows a case where the “occurrence order” defined in the fraud occurrence pattern matches the occurrence order detected by the fraud occurrence detection unit 72. Therefore, the degree of fraud is calculated by adding the coincidence addition value to the sum of the abnormal values of all fraud elements defined in the pattern A1. In the present embodiment, when the degree of fraud exceeds a predetermined value “60”, a warning is given by the operator warning unit 68 and the administrator warning unit 75. Therefore, in the example shown in the figure, since the degree of fraud exceeds the predetermined value “60”, a warning is issued.

  Next, the flow of the fraud level recording process of the fraud level calculation device 16 will be described with reference to the flowchart of FIG. When the fraud calculation device 16 starts accounting processing (S10), it determines whether or not exception processing has occurred (S11, exception processing detection unit 62), and determines that exception processing has occurred. (S11: Yes), a fraud occurrence pattern corresponding to the type of exception processing is extracted from a large number of fraud occurrence patterns stored in the fraud occurrence pattern storage unit 71 (S12, see FIG. 4). Further, the detection result of the fraud occurrence detection unit 72 is acquired (S13), the total value of the abnormal values is reset to “0” (S14), and the basic score × the precision = The abnormal value is added to the total value of the abnormal values (S15). Thereafter, it is determined whether or not calculation has been performed for all fraud elements in the same fraud pattern (S16). If there is an uncalculated fraud element (S16: No), the process returns to S15.

  On the other hand, when calculation is performed for all fraud elements (S16: Yes), the occurrence order is checked (S17). Here, when the occurrence order defined in the fraud occurrence pattern matches the occurrence order detected by the fraud occurrence detection unit 72 (S18: Yes), the coincidence addition value is added to the total value of the abnormal values. The fraud level is calculated (S19). If the occurrence order does not match (S18: No), the sum of abnormal values is calculated as the degree of fraud (S20). As described above, S12 to S20 are steps executed by the fraud degree calculation unit 73.

  Thereafter, the fraud level is recorded in the recording database 23 for the fraud occurrence pattern that is the target of fraud level calculation (S21, fraud level recording unit 74). Also, it is determined whether the patterns are matched (whether the occurrence order is matched) or whether the calculation has been completed for all fraud patterns that are associated with the same exception processing type (S22). If not (S22: No), the process returns to S14 to repeat the fraud degree calculation process. Further, in the case of S22: Yes, it is determined whether or not there is a fraud pattern that has a fraud degree exceeding a predetermined value (S23). If there is a fraud pattern that exceeds a predetermined value (S23: Yes), A warning is issued by the operator warning unit 68 and the administrator warning unit 75 (S24). Thereafter, the fraud level calculation result notification unit 76 notifies the fraud management server 15 of the fraud level calculation result (S25). On the other hand, when there is no fraud occurrence pattern exceeding the predetermined value (S23: No), and when exception processing has not occurred (S11: No, for example, during the settlement process), without warning and notification, The fraud level recording process is terminated.

  In S24, when the administrator warning unit 75 transmits an e-mail, the detection result of each fraud occurrence element and the calculated fraud level are notified for one or more fraud occurrence patterns whose fraud levels exceed a predetermined value. . Further, when there are a plurality of fraud patterns that have a fraud level exceeding a predetermined value, notification may be made only for the fraud pattern having the highest fraud level.

  Next, the functional configuration of the fraud management server 15 will be described with reference to FIG. The fraud management server 15 includes a server-side fraud occurrence pattern storage unit 101, a device ID storage unit 102, a device information storage unit 103, a device information update unit 104, a fraud degree calculation result storage unit 105, a fraud occurrence pattern as main functional configurations. An acquisition unit 106, a fraud occurrence pattern update unit 107, a device introduction notification unit 108, an unemployed pattern notification unit 109, a recommended device identification unit 110, and a recommended device notification unit 111 are provided.

  The server-side fraud occurrence pattern storage unit 101 stores all fraud occurrence patterns stored in the fraud occurrence pattern storage units 71 of the plurality of fraud degree calculation devices 16 connected to the fraud management server 15. Further, the device ID storage unit 102 stores the device ID of the fraud calculation device 16 that stores each fraud occurrence pattern stored in the server side fraud occurrence pattern storage unit 101. The server-side fraud occurrence pattern storage unit 101 and the device ID storage unit 102 have the fraud occurrence database 91 as a main part.

  FIG. 12 is a diagram illustrating a specific example of the device ID storage unit 102. As shown in the figure, the device ID storage unit 102 stores a fraud occurrence pattern in association with a fraud level calculation device 16 (device ID) that stores the fraud pattern. In the example of the figure, the fraud occurrence pattern “pattern A1” is stored (adopted) in three fraud degree calculation devices 16a (ID000A), 16b (ID000B), and 16c (ID000C), and the fraud occurrence pattern “pattern B1”. Indicates that they are stored in the two fraud degree calculation devices 16a and 1b.

  The device information storage unit 103 stores device information related to one or more detection devices provided (connected) in each fraud degree calculation device 16, and has a device information database 92 as a main part. FIG. 13 is a diagram illustrating a specific example of the device information storage unit 103. As shown in the figure, the device information storage unit 103 indicates the presence / absence of detection devices indicated by m1 to m9 for each fraud degree calculation device 16 by “◯” and “X”. In the example of the figure, for example, the in-store card reader 14 (m8) has not been introduced or cannot be used for the fraud level calculation device 16a (ID000A). For example, for the fraud level calculation device 16b (ID000B), the clerk wristband 5 ( m2) and the in-store monitoring camera 11 (m7) indicate that they are not installed or cannot be used.

  The device information update unit 104 updates the device information stored in the device information storage unit 103 based on the operation data notified from each fraud degree calculation device 16 (operation data notification unit 78). Specifically, if the operational data indicates “operating”, if the fraud management server 15 does not acquire this for a predetermined period, the state of the corresponding detection device is changed to “x”. . When the operation data indicates “not operating”, when the fraud management server 15 acquires this, the state of the corresponding detection device is changed to “x”. As described above, by acquiring the operation data from each fraud degree calculation device 16 and updating the device information update unit 104, it is possible to accurately determine a detection device that is currently available in each store.

  The injustice degree calculation result storage unit 105 stores the injustice degree calculation result notified from each injustice degree calculating device 16 (injustice degree calculation result notifying unit 76). The injustice degree calculation result database 93 is used as a main part. To do. When storing the fraud level calculation result, the fraud level calculation result storage unit 105 stores device information in association with the fraud level calculation result. In other words, referring to the device information storage unit 103, one or more detection devices (corresponding to the operating state) provided in the fraud level calculation device 16 that has notified the fraud level calculation result that has been notified are provided. Store it in association. For example, when the fraud degree calculation result is notified from the fraud degree calculation device 16a (ID000A), the device codes m1 to m7 and m9 are stored in association with each other (see FIG. 13). The fraud level calculation result storage unit 105 does not associate the device information with the fraud level calculation result, but adds the device information to the fraud level calculation result in each fraud level calculation device 16 and notifies the fraud management server 15 of the device information. Also good.

  FIG. 14 is a diagram illustrating a specific example of the degree of fraud calculation result storage unit 105. The fraud level calculation result storage unit 105 associates the fraud level calculation result acquisition date and time, fraud occurrence pattern, fraud level, the fraud level calculation device 16 serving as a transmission source, and the detection device provided in the fraud level calculation device 16. I remember. In the figure, for the sake of convenience, only the same pattern (“pattern A1”) is shown, but the fraud level calculation result storage unit 105 stores all the obtained fraud level calculation results.

  The fraud occurrence pattern acquisition unit 106 obtains the fraud occurrence pattern notified from each fraud degree calculation device 16 (fault occurrence pattern notification unit 77). Further, the fraud occurrence pattern update unit 107, when the fraud occurrence pattern storage unit 71 of any fraud degree calculation device 16 among the plurality of connected fraud degree calculation devices 16 has been updated, This is reflected in the fraud occurrence pattern storage unit 71 of the degree calculation device 16. Specifically, based on the fraud occurrence pattern acquired from the arbitrary fraud degree calculation device 16, the fraud occurrence pattern stored in the server side fraud occurrence pattern storage unit 101 is first added, replaced, or deleted. Further, a fraud occurrence pattern is transmitted (addition command), a replacement command, a deletion command, and the like to other fraud level calculation devices 16 other than the arbitrary fraud level calculation device 16. At this time, when a new fraud occurrence pattern is added to the arbitrary fraud degree calculation device 16, the fraud occurrence pattern update unit 107 refers to the device information storage unit 103 and performs all frauds included in the new fraud occurrence pattern. An addition command is issued only for the fraud calculation device 16 having a detection device that can detect the occurrence element. In other words, no additional command is given to the fraud level calculation device 16 that is not sufficiently equipped with a detection device for detecting a new fraud occurrence pattern.

  The device introduction notifying unit 108 is a case where a new fraud occurrence pattern is added to an arbitrary fraud level calculating device 16, and a plurality of connected fraud level calculating devices 16 are obtained from the device information of each fraud level calculating device. If it is determined that there is a fraud calculation device 16 that does not include a detection device that can detect all fraud occurrence elements included in the new fraud occurrence pattern, A notification is made to prompt the introduction of the corresponding detection device. For example, when the fraud occurrence pattern shown in FIG. 7 is added, the fraud level calculation device 16c (ID000C) does not include both the m7 and m8 detection devices (see FIG. 13). "Closed to the room" cannot be detected. Therefore, the message notification is performed so as to introduce the detection device of m7 or m8. The fraud level calculation device 16a (ID000A) and the fraud level calculation device 16b (ID000B) can detect all fraud occurrence elements included in the fraud occurrence pattern shown in FIG. An additional command is issued by 107.

  When the loss amount exceeding a predetermined amount is notified from an arbitrary fraud level calculation device 16 (loss amount notification portion 80), the unadopted pattern notification unit 109 notifies the arbitrary fraud level calculation device 16 of the fraud level. An unemployed pattern that is a fraud pattern not stored in the calculation device 16 is notified. For example, when the amount of loss exceeding a predetermined amount is notified from the fraud level calculation device 16b (ID000B) and the device ID storage unit 102 has the storage contents shown in FIG. “Pattern D1” and “Pattern E1” are notified as unadopted patterns. In addition, since it is necessary to introduce a detection device in order to employ an unaccepted pattern in each fraud degree calculation device 16 (each store), the unaccepted pattern notification unit 109 detects this together with the unaccepted pattern. It is preferable to notify the detection device for this.

  The recommended device specifying unit 110 aggregates the fraud level calculation results of arbitrary fraud occurrence patterns stored in the fraud level calculation result storage unit 105 for each corresponding detection device. As a result, the corresponding detection device is biased. If so, a detection device with a high degree of fraud is identified as a recommended device for any fraud occurrence pattern. For example, when the fraud level calculation result storage unit 105 has the storage contents illustrated in FIG. 14, for the same fraud occurrence pattern “pattern A1”, the fraud level associated with the detection device m7 (in-store monitoring camera 11) is the fraud level. There are two “68” and “61” of the calculation device 16a (ID000A), and the fraud degrees associated with the detection device m8 (in-store card reader 14) are “96” and “96” of the fraud degree calculation device 16b (ID000B). There are two "92". As described above, when the fraud level is biased by the associated detection devices, the detection device associated with the high fraud level is specified as the recommended device of the fraud occurrence pattern. That is, in this case, the detection device m8 is specified as a recommended device of “Pattern A1”. Note that the recommended device identification unit 110 may identify a detection device that is close to the average value from the result of counting the fraud levels, rather than a detection device with a high degree of fraud. Also, the recommended device is specified by the recommended device specifying unit 110 every predetermined period or every predetermined operation.

  The recommended device notification unit 111 is a fraud degree calculation device 16 that stores an arbitrary fraud occurrence pattern after identification by the recommended device identification unit 110 and does not include a recommended device (the recommended device is not in an operating state). ) Notify the degree of fraud calculation device 16 of the specified recommended device. Specifically, referring to the device ID storage unit 102 (see FIG. 12) and the device information storage unit 103 (see FIG. 13), the specified recommended device is introduced to the corresponding fraud degree calculation device 16. To notify the message.

  Next, the fraud occurrence pattern update process of the fraud management server 15 will be described with reference to the flowchart of FIG. When the fraud management server 15 acquires the fraud occurrence pattern by the fraud occurrence pattern acquisition unit 106 (S31: Yes), the fraud occurrence pattern update unit 107 determines whether or not the fraud occurrence pattern is newly added. (S32). Whether or not it is newly added is determined based on whether or not the pattern ID of the fraud pattern has already been stored in the fraud database 91. Here, when it is determined that it is a newly added one (S32: Yes), the device information database 92 is referred to, and the fraud degree calculating device 16 to be added is selected (S33). That is, the information on the detected device included in the fraud pattern (see FIG. 7) and the device information database 92 are collated, and the fraud level calculation device 16 including all the detected devices included in the fraud pattern is selected.

  Thereafter, the new fraud occurrence pattern acquired in S31 is transmitted (transferred) to the selected addition target device (the fraud degree calculating device 16) (S34). In the flowchart of FIG. 5, S32 to S34 and S36 to S37 described later are steps by the fraud occurrence pattern update unit 107. Further, the device introduction notification unit 108 notifies the non-addition target device that is the fraud level calculation device 16 other than the addition target device among the plurality of connected fraud level calculation devices 16 ( S35), the process ends.

  On the other hand, when it is determined that the fraud occurrence pattern acquired in S31 is not newly added (S32: No), the fraud occurrence database 91 (device ID storage unit 102) is referred to and an update target device is selected. (S36). That is, the fraud degree calculating device 16 associated with the acquired fraud pattern ID is selected (see FIG. 12). Thereafter, the selected update target apparatus is notified of the corrected fraud pattern or the fraud pattern to be deleted (S37), and the process is terminated. Upon receiving the notification of the fraud occurrence pattern to be deleted, the fraud level calculation device 16 deletes the target fraud occurrence pattern from the fraud occurrence pattern storage unit 71 in accordance with the notification.

  As described above, according to the fraud monitoring system SY of the present embodiment, the fraud level calculation device 16 calculates the fraud level by summing the abnormal values corresponding to one or more fraud elements that have been detected. Since the calculation result is recorded, it is possible to grasp the possibility of fraud from the record. As a result, it is possible to accurately determine the presence or absence of a fraudulent act even for a complex act of fraud. In addition, since the degree of fraud is calculated by taking into account the accuracy rate of fraud elements and the order of occurrence of fraud elements, more accurate fraud levels can be calculated. Further, since a warning is issued when the degree of fraud exceeding a predetermined value is calculated, it is possible to notify the store clerk or manager.

  Further, since the fraud occurrence pattern is stored in the fraud occurrence pattern storage unit 71 for each exception processing type, a more realistic fraud level is calculated using the fraud occurrence pattern suitable for the exception processing type. be able to. In addition, since a plurality of fraud occurrence patterns can be stored for each exception processing type, it is possible to deal with a number of illegal acts. In general, fraudulent acts are often executed along with exception processing. Therefore, as in this embodiment, fraudulent activity is calculated and recorded only when exception processing occurs, so that fraud can be efficiently performed. Actions can be detected.

  In addition, when the fraud occurrence pattern is updated in any one of the plurality of fraud level calculation devices 16 connected to the fraud management server 15, the fraud management server 15 calculates the content of the update to another fraud level. Since it is reflected in the device 16, the burden of updating the fraud pattern by the system administrator or the like can be reduced. In addition, since the latest fraud occurrence pattern can be shared among the plurality of fraud level calculation devices 16, it is possible to always determine the presence or absence of fraud in the store with high accuracy.

  In addition, when a new fraud occurrence pattern is added, the fraud management server 15 uses the fraud degree calculation device 16 including detection devices that can detect all fraud occurrence elements included in the fraud occurrence pattern as an addition target device. Since fraud patterns are added, it is possible to prevent unnecessary fraud patterns from being added. In addition, for non-addition target devices other than the addition target device, the system administrator or the like makes a notification prompting the introduction of the corresponding detection device (detection device that can detect a new fraud pattern by installing it). You can reduce the trouble of notification.

  In addition, since the device information for determining the addition target device / non-addition target device is updated based on the operation data notified from the fraud degree calculation device 16, for example, for a detection device that cannot be operated due to a failure or the like, It can be treated as something that has not been introduced. As a result, it is possible to solve the problem of adding a new fraud occurrence pattern that requires the detection device in spite of the fact that the detection device is not operating.

  Further, when the loss amount notified from the fraud degree calculation device 16 is large, the fraud management server 15 notifies an unaccepted pattern that is a fraud occurrence pattern that is not stored in the fraud degree calculation device 16. It is possible to verify whether or not to adopt the unemployed pattern. Moreover, the loss can be expected to be reduced by actively adopting the unemployed pattern at each store.

  In addition, when the fraud level calculation result notified from each fraud level calculation device 16 by the recommended device specifying unit 110 is biased by the detected device (by the fraud level calculation device 16), the fraud level is high or average. In order to identify a detection device close to the value as a recommended device of an arbitrary fraud occurrence pattern and notify this to the fraud degree calculation device 16 in which the recommended device has not been introduced, the introduction of the recommended device is promoted, and consequently the store It is possible to improve the detection accuracy of fraudulent activity.

  In the above-described embodiment, the operator warning unit 68 and the administrator warning unit 75 indicate warning modes such as a warning destination and a warning method according to the calculated degree of fraud and the type of exception processing detected at that time. May be variable. “Variable warning destination” means increasing or decreasing the number of e-mail transmission destinations, switching whether or not there is a warning to the operator, and the like. “Variation of warning method” means that in the case of voice warning, the voice pattern, volume, number of warnings, warning interval, etc. are changed. In the case of a display warning, it means that the display content, display color, display frequency, display interval, and the like are variable. In the case of a notification warning (e-mail notification, etc.), it means that the notification content, notification method, number of notifications, etc. are changed. Furthermore, changing warning means such as voice, display, and notification is also included in changing the warning method. Note that the correspondence between the degree of fraud and the warning destination or warning method may be changed by the user using the operation unit provided in the receipt printer 2 or the store server 12. According to this configuration, it is possible to issue a warning in a warning mode (a warning destination and a warning method) suitable for the type of exception processing. In addition, by changing the warning mode according to the type of exception processing, the operator or the administrator can easily guess the method of fraud that has occurred from the warning mode.

  In the above embodiment, the fraud level is calculated, recorded, and notified only when exception processing occurs. However, the fraud level may be calculated, recorded, and notified during all accounting processes. According to this configuration, the recorded data can be used for store clerk operation education and customer trend analysis.

  In the above embodiment, the detection result and the reading result by the cashier card reader 4, the clerk wristband 5, the customer microphone 6a, the clerk microphone 7a, and the receipt scanner 8 are sent to the store server 12 via the receipt printer 2. Although it is configured to transmit, it may be configured to transmit directly to the store server 12 via the in-store LAN 13. That is, each unit other than the printing unit 67 and the operator warning unit 68 of the receipt printer 2 may be provided in the store server 12. Conversely, each part of the store server 12 may be provided in the receipt printer 2.

  In the above-described embodiment, the administrator warning unit 75 uses an e-mail or a Web application to issue a warning. However, as with the operator warning unit 68, display on the display, sound generation, and LED lighting. / Alternative warning may be performed using blinking, vibration by a vibrator, or the like.

  Further, in the above embodiment, as means for creating a new fraud occurrence pattern, the cashier monitoring camera 9 is triggered by the information transmitted from the loss amount notification unit 80 of the fraud degree calculation device 16 by the system provider. There are a method of creating fraud patterns and detection methods by analyzing the situation occurring in the store, such as the video of the above, and confirming the effect at the target store, and a method of creating fraud occurrence patterns independently on the store side. In the latter case, the fraud management server 15 may give an incentive (for example, giving money, points, etc.) to the fraud degree calculation device 16 that is the transmission source of the fraud occurrence pattern. According to this configuration, each store actively creates and adds (or updates) a fraud occurrence pattern, so that it is possible to reduce fraud in the fraud monitoring system SY as a whole.

  In the above embodiment, the recommended device specified by the recommended device specifying unit 110 is notified to each fraud degree calculation device 16 by the recommended device notifying unit 111. Therefore, the fraud occurrence pattern may be updated. For example, from the reference result of the fraud level calculation result storage unit 105, the in-store card reader 14 (m8) is used for an arbitrary fraud occurrence pattern as compared to the average fraud level when the in-store monitoring camera 11 (m7) is used. For example, when it is determined that the average value of the degree of fraud is extremely large, it is preferable to update the in-store monitoring camera 11 (m7) for the fraud occurrence pattern. In this case, since a change occurs in the detection device, the update content is a content in which an existing fraud pattern is deleted and a new fraud pattern is added. According to this configuration, the fraud management server 15 can rewrite an appropriate fraud occurrence pattern to increase the fraud detection accuracy.

  In addition, when there are a plurality of detection devices to be notified, the recommended device notification unit 111 preferably notifies the recommended devices with priorities. This priority order is preferably given in descending order of the average degree of fraud based on the reference result of the fraud degree calculation result storage unit 105. Similarly, when a plurality of detected devices are associated with one fraud element, the device introduction notification unit 108 is also prioritized (one or more fraud elements in the fraud pattern). It is preferable to notify the name of the device to be introduced, assuming that the detection device and its priority are defined in advance).

  Further, it is possible to provide each process of the fraud level calculation device 16 and the fraud management server 15 shown in the above embodiment as a program. Further, the program can be provided by being stored in various recording media (CD-ROM, flash memory, etc.). That is, a program for causing a computer to function as each component of the fraud level calculation device 16 and the fraud management server 15 and a recording medium on which the program is recorded are also included in the scope of rights of the present invention.

  In each of the above embodiments, the fraud recording system of the present invention is used for preventing fraud in a store. However, the fraud recording system of the present invention may be applied to a system for other purposes (nurturing and managing store clerks). . Moreover, you may implement | achieve each part of the shop server 12 and the fraud management server 15 with a POS system or a WWW server. In addition, the system configuration and processing steps of the fraud monitoring system SY can be appropriately changed without departing from the gist of the present invention, regardless of the above-described embodiments.

  DESCRIPTION OF SYMBOLS 1 ... POS terminal 2 ... Receipt printer 3 ... Handy scanner 4 ... Registration card reader 5 ... Sales clerk wristband 6 ... Customer display 7 ... Headset 8 ... Receipt scanner 9 ... Checkout monitor camera 10 ... Checkout counter 11 ... In-store monitoring camera 12 ... store server 13 ... in-store LAN 14 ... in-store card reader 15 ... fraud management server 16 ... fraud degree calculation device 23 ... recording database 62 ... exception processing detection section 68 ... operator warning section 71 ... fraud occurrence pattern storage section 72 ... Fraud occurrence detection unit 73 ... Fraud degree calculation unit 74 ... Fraud degree recording unit 75 ... Administrator warning unit 76 ... Fraud degree calculation result notification unit 77 ... Fraud occurrence pattern notification unit 78 ... Operation data notification unit 79 ... Loss amount calculation unit 80 ... Loss notification section 91 ... Fraud occurrence date 92 ... Device information database 93 ... Fraud degree calculation result database 101 ... Server side fraud occurrence pattern storage unit 102 ... Device ID storage unit 103 ... Device information storage unit 104 ... Device information update unit 105 ... Fraud degree calculation result storage unit DESCRIPTION OF SYMBOLS 106 ... Fraud occurrence pattern acquisition part 107 ... Fraud occurrence pattern update part 108 ... Equipment introduction notification part 109 ... Un-employed pattern notification part 110 ... Recommended equipment specific part C ... Clerk card NT ... Network SY ... Fraud monitoring system

Claims (12)

A fraud recording system in which a plurality of fraud level calculating devices and a fraud management server that controls the plurality of fraud level calculating devices are connected via a network,
Each fraud degree calculation device
A fraud occurrence pattern storage unit that stores fraud occurrence patterns describing a basic score that is a weight for each of one or more fraud occurrence elements assumed in the store;
A fraud occurrence detecting unit for detecting occurrence / non-occurrence of each of the one or more fraud occurrence elements;
A fraud level calculating unit that calculates the degree of fraud by summing the basic points corresponding to fraud elements that have been detected by the fraud occurrence detecting unit,
The fraud management server
When the fraud occurrence pattern storage unit of one of the plurality of fraud degree calculation devices is updated, the fraud that reflects the updated contents in the fraud occurrence pattern storage unit of another fraud degree calculation device An unauthorized recording system comprising an occurrence pattern update unit.   The fraud occurrence pattern updating unit, when a new fraud occurrence pattern is added to the fraud occurrence pattern storage unit of any fraud level calculation device, The unauthorized recording system according to claim 1, wherein the unauthorized recording system is added to the generation pattern storage unit. The fraud management server
A device information storage unit that stores device information related to one or more detection devices for realizing the fraud occurrence detection unit of each fraud level calculation device;
Each fraud occurrence element included in the new fraud occurrence pattern is associated with one or more types of detection devices capable of detecting each fraud occurrence element,
The fraud occurrence pattern update unit refers to the device information storage unit when the new fraud occurrence pattern is added, and detects detection devices that can detect all fraud occurrence elements included in the new fraud occurrence pattern. The fraud recording system according to claim 2, wherein the fraud occurrence pattern is added to the fraud occurrence pattern storage unit for a fraud level calculation device provided. The fraud management server
In the case where a new fraud occurrence pattern is added to the fraud occurrence pattern storage unit of any of the plurality of fraud degree calculation devices, from the reference result of the device information storage unit, If it is determined that there is a fraud calculation device that does not have a detection device that can detect all fraud elements included in the new fraud pattern, the corresponding detection device is introduced to the fraud calculation device. The unauthorized recording system according to claim 3, further comprising a device introduction notification unit that performs a prompting notification. Each fraud degree calculation device
An operation data notification unit for notifying the fraud management server of operation data indicating an operation status of one or more detection devices for realizing the fraud occurrence detection unit,
The fraud management server
The apparatus information update part which updates the apparatus information memorize | stored in the said apparatus information memory | storage part based on the said operation data acquired from each fraud degree calculation apparatus is further provided. Illegal recording system. Each fraud degree calculation device
Based on the results of the inventory management database and the sales management database reference, a loss calculation unit that calculates a loss corresponding to the difference between the planned sales amount for the inventory and the actual sales,
A loss amount notification unit for notifying the fraud management server of the calculated loss amount,
The fraud management server
A server-side fraud occurrence pattern storage unit that stores all the fraud occurrence patterns stored in the fraud occurrence pattern storage unit of the plurality of fraud levels calculating devices;
For each fraud occurrence pattern stored in the server side fraud occurrence pattern storage unit, a device ID storage unit that stores the device ID of the fraud degree calculation device that stores the fraud pattern,
When the loss amount exceeding a predetermined amount is notified from an arbitrary fraud level calculation device, the arbitrary fraud level calculation device is stored in the fraud level calculation device specified with reference to the device ID storage unit. 6. An unemployed pattern notifying unit that reads out and notifies an unaccepted pattern that is an unauthorized occurrence pattern from the server-side fraud occurrence pattern storage unit. The illegal recording system described in the section. Each fraud degree calculation device
The fraud recording system according to any one of claims 3 to 6, further comprising a warning unit that issues a warning when a fraud level exceeding a predetermined value is calculated by the fraud level calculation unit. Each fraud degree calculation device
A fraud level calculation result notifying unit for notifying the fraud management server of the calculation result of the fraud level calculation unit that is the target of the warning;
The fraud management server
A fraud calculation result storage unit that refers to the device information storage unit and stores the notified fraud level calculation result in association with one or more detection devices provided in the fraud level calculation apparatus that has notified the fraud level calculation result; ,
When the fraud level calculation result of any fraud occurrence pattern stored in the fraud level calculation result storage unit is aggregated for each corresponding detection device, and the deviation is caused by the corresponding detection device, the fraud level is A recommended device identifying unit that identifies a detection device that is high or close to an average value as a recommended device of the arbitrary fraud occurrence pattern;
A fraud level calculation device that stores the arbitrary fraud occurrence pattern and further includes a recommended device notification unit that notifies the fraud level calculation device that does not include the recommended device of the recommended device. The unauthorized recording system according to claim 7, wherein: Each fraud degree calculation device
The accounting processing unit further includes an exception processing detection unit that detects that exception processing corresponding to part of the accounting processing has occurred,
The fraud recording system according to any one of claims 1 to 8, wherein the fraud degree calculation unit functions on condition that an exception processing is detected by the exception processing detection unit. The exception processing detection unit detects a type of exception processing,
The fraud occurrence pattern storage unit stores the fraud occurrence pattern for each exception processing type,
The fraud level calculation unit extracts the fraud occurrence pattern corresponding to the type of exception processing detected by the exception processing detection unit from the fraud occurrence pattern storage unit, and calculates the fraud level. The unauthorized recording system according to claim 9. A method of controlling a fraud recording system in which a plurality of fraud level calculating devices and a fraud management server that controls the plurality of fraud level calculating devices are connected via a network,
Each fraud degree calculation device
A fraud occurrence pattern storage unit that stores fraud occurrence patterns describing the basic points as weights for each of one or more fraud occurrence elements assumed in the store,
A fraud occurrence detecting step for detecting occurrence / non-occurrence of each of the one or more fraud occurrence elements;
A fraud level calculation step of calculating a fraud level by summing up the basic points corresponding to the fraud elements in which the occurrence is detected,
The fraud management server
When the fraud occurrence pattern storage unit of one of the plurality of fraud degree calculation devices is updated, the fraud that reflects the updated contents in the fraud occurrence pattern storage unit of another fraud degree calculation device A control method for an unauthorized recording system, wherein an occurrence pattern update step is executed.   The program for making a computer perform each step in the control method of the unauthorized recording system of Claim 11.

Images