JP7190072B1 - Judgment system, judgment method, and program - Google Patents

Abstract

A determination system, a determination method, a program, and an application program for accurately determining whether or not a credit card is used unintended by the owner are provided. SOLUTION: In a configuration for realizing an electronic payment service, a fraud detection server 300, which is a judgment system, relates to an interface screen provided when a user uses a credit card in electronic commerce from a terminal device. An acquisition unit 302 that acquires behavior information indicating the behavior of the user, and the behavior information acquired by the acquisition unit 302 is used to determine whether or not the use of the credit card is unintended by the owner of the credit card. and a determination unit 304 that [Selection drawing] Fig. 10

Description

The present invention relates to a determination system, determination method, program, and application program.

Conventionally, there has been disclosed a system that predicts a person's identity based on a user's action history and determines a financial transaction authority level based on the prediction result (see Patent Document 1).

JP 2021-105817 A

In Patent Document 1, face authentication in transaction behavior (payment at a store, Internet banking, use of an automatic teller machine, etc.), action history such as time period when action was performed, address where action was performed, balance inquiry etc. It is used, but does not consider behavior when registering a credit card. For this reason, there were cases where it was not possible to determine whether or not the credit card was being used unintentionally by the owner.

The present invention has been made in consideration of such circumstances, and a judgment system, judgment method, program, and application capable of accurately judging whether or not the credit card is being used unintended by the owner. One of the purposes is to provide a program.

According to one aspect of the present invention, an acquisition unit acquires, from a terminal device, behavior information indicating a user's behavior related to an interface screen provided when the user uses a credit card in electronic commerce; and a determination unit that determines whether or not the use of the credit card is unintended by the owner of the credit card, using the acquired behavior information.

ADVANTAGE OF THE INVENTION According to one aspect of the present invention, it is possible to provide a determination system, a determination method, a program, and an application program that can accurately determine whether or not the credit card is used unintended by the owner.

1 is a diagram showing an example of a configuration for realizing an electronic payment service; FIG. 1 is a diagram illustrating a general flow of electronic payment; FIG. 2 is a configuration diagram of a settlement server 100; FIG. 3 is a diagram showing an example of contents of user information 210. FIG. 3 is a diagram showing an example of contents of store information 220. FIG. FIG. 10 is a diagram showing an example of an interface screen IM1; FIG. 10 is a diagram showing an example of an interface screen IM2; FIG. 10 is a diagram showing an example of an interface screen IM3; FIG. 10 is a diagram showing an example of an interface screen IM4; 3 is a diagram illustrating an example of a functional configuration of a fraud detection server 300; FIG. FIG. 10 is a diagram for explaining details of fraud detection processing; 3 is a diagram showing an example of contents of first behavior information 242 and second behavior information 244. FIG. 3 is a diagram showing an example of condition information 312. FIG. 3 is a diagram showing an example of a functional configuration included in the user terminal device 10; FIG. 4 is a diagram showing an example of information acquired and generated by the settlement server 100; FIG. It is a figure which shows an example of the content of 312 A of condition information. FIG. 13 is a diagram showing an example of condition information 312B of modification 2; It is a figure which shows an example of 312 C of condition information. FIG. 11 is a diagram illustrating an example of processing of a trained model 214;

Hereinafter, embodiments of a determination system, a determination method, a program, and an application program of the present invention will be described with reference to the drawings.

The determination system of the present embodiment includes an acquisition unit that acquires behavior information indicating user behavior related to an interface screen provided when a user uses a credit card in electronic commerce from a terminal device; a determination unit that determines whether or not the use of the credit card is unintended by the owner of the credit card, using the behavior information acquired by;

"When a user uses a credit card in electronic commerce from a terminal device" means, for example, when a user uses a credit card in a network-based commercial transaction, and the credit card is used as a means of payment (settlement means). When using it, when registering as a means of payment, and so on. Registration as a means of payment includes registration as a means of charging electronic money.

The “behavior information indicating the user's behavior related to the interface screen” includes operation information such as operation information for displaying the interface screen and operation information for the interface screen. The operation information includes, for example, information in which information indicating the type of operation is associated with information indicating the timing at which the operation was performed. Further, the behavior information is the target time from the first timing indicating that the first operation is performed in the operation information to the second timing indicating that the second operation is performed in the operation information. It may be the information shown. Embodiments will be described below.

<Embodiment>
[Electronic payment service]
FIG. 1 is a diagram showing an example of a configuration for realizing an electronic payment service. The electronic payment service is realized mainly by the user terminal device 10 (payment application 20), the store terminal device 50, the payment server 100, and the fraud detection server 300. FIG. The settlement server 100 communicates with, for example, one or more user terminal devices 10 and one or more store terminal devices 50 via the network NW. The network NW includes, for example, the Internet, a LAN (Local Area Network), wireless base stations, provider devices, and the like. The settlement server 100 and the fraud detection server 300 communicate via the network NW. The fraud detection server 300 is an example of a "determination system". All or part of the functional configuration of fraud detection server 300 may be included in payment server 100 .

The user terminal device 10 is, for example, a portable terminal device such as a smart phone or a tablet terminal. The user terminal device 10 is a computer device having at least an optical reading function (such as a camera), a communication function, a display function, an input reception function, a program execution function, a position measuring device (GPS), and the like. In the following description, configurations for realizing these functions are respectively referred to as a camera, a communication device, a touch panel, a CPU (Central Processing Unit), and the like. In the user terminal device 10, the payment application 20 is executed by a processor such as a CPU, and operates in cooperation with the payment server 100 to provide electronic payment services to the user. The payment application 20 controls a camera, a communication device, a touch panel, and the like.

The store terminal device 50 is installed, for example, in a store. The store terminal device 50 is a computer device having at least a product price acquisition function, an optical reading function, a program execution function, and a communication function. The store terminal device 50 includes a so-called POS (Point of Sale) device, and the POS device may realize the product price acquisition function and the optical reading function. The store code image 60 is placed in a store and is a code image such as a QR code (registered trademark) printed on a medium such as paper or plastic. Note that the store code image 60 may be displayed on a display placed at the store.

The payment server 100 implements electronic payment based on payment information received from the user terminal device 10 or the store terminal device 50 . The settlement server 100 performs electronic settlement by, for example, increasing or decreasing balance information managed in association with an account number (user identification information) (in other words, depositing or withdrawing electronic money). The electronic payment may include a method such as revolving payment or credit payment that enables purchase of a larger amount than the balance information at the time of purchase. The details of how the fraud detection server 300 determines whether a credit card is appropriate for registration and how to register a credit card used for credit payment or electronic money charging using a credit card will be described later.

FIG. 2 is a diagram illustrating a general flow of electronic payment. There may be two types of electronic payment: pattern 1 and pattern 2. In the case of pattern 1, first, the payment application 20 is activated on the user terminal device 10, and a code image (code information) such as a QR code or barcode is displayed. The user holds up (presents) the display surface of the user terminal device 10 to the shop terminal device 50 . The store terminal device 50 decodes the code image with an optical reading function and acquires information such as an account number. The shop terminal device 50 then generates payment information (payment request) including an electronic payment request, account number, payment amount, shop ID, etc., and transmits the payment information to the payment server 100 . The information on the payment amount is acquired in advance by reading a bar code, manually inputting it, or the like. The payment server 100 performs payment processing based on the received information.

In the case of pattern 2, the user terminal device 10 with the payment application 20 activated decodes the store code image 60 by the optical reading function. The store code image 60 includes information such as the store name. The user inputs the settlement amount into the user terminal device 10 on the screen on which the store name and the like are displayed. Then, the user terminal device 10 generates payment information (payment request) including an electronic payment request, account number, payment amount, shop ID, etc., and transmits the payment information to the payment server 100 . The payment server 100 performs payment processing based on the received information. It should be noted that electronic payment may be performed only in one of the above patterns.

When electronic payment is completed, a completion notification is sent from the payment server 100 to the user terminal device 10 . The user terminal device 10 displays a payment completion screen in response to the received notification of completion. The completion notification is, for example, in the form of a web page. The payment completion screen includes, for example, information on the store where the electronic payment was made, the amount of payment, information on points (an example of privilege) given to the user as a result of the electronic payment, and the like.

[Settlement server]
FIG. 3 is a configuration diagram of the settlement server 100. As shown in FIG. The payment server 100 includes, for example, a communication unit 110, a content providing unit 120, a payment processing unit 130, an information processing unit 140, and a storage unit 200. Content providing unit 120, payment processing unit 130, and information processing unit 140 are each implemented by a hardware processor such as a CPU executing a program (software). Some or all of these components are hardware (circuit part; circuitry) or by cooperation of software and hardware. The program may be stored in advance in a storage device (a storage device with a non-transitory storage medium) such as a HDD (Hard Disk Drive) or flash memory, or may be stored in a removable storage such as a DVD or CD-ROM. It may be stored in a medium (non-transitory storage medium) and installed in the storage device by loading the storage medium into the drive device.

The storage unit 200 is an HDD, flash memory, RAM (Random Access Memory), or the like. The storage unit 200 may be a NAS (Network Attached Storage) device that can be accessed by the settlement server 100 via a network. The storage unit 200 stores information such as user information 210, store information 220, content information 230, behavior information 240, and the like.

The communication unit 110 is a communication interface for connecting to the network NW. The communication unit 110 is, for example, a network card.

The content providing unit 120 has, for example, a function of a web server, and provides the user terminal device 10 with information (contents) for displaying various screens of the electronic payment service, including the above-described payment completion screen. The content providing unit 120 appropriately reads necessary content from the content information 230 and provides it to the user terminal device 10 . The user terminal device 10 accepts various inputs from the user while the content is being reproduced by the payment application 20 , and transmits the above-described payment information and the like to the payment server 100 .

The payment processing unit 130 performs payment processing based on the payment information transmitted from the user terminal device 10 or the shop terminal device 50 . The payment processing unit 130 performs payment processing while referring to the user information 210 .

FIG. 4 is a diagram showing an example of the contents of the user information 210. As shown in FIG. The user information 210 is, for example, an account number associated with information such as contact information, charge balance information, payment method information, and settlement history information. The contact information is the information entered by the user when subscribing to the electronic payment service.

The charge balance information is information indicating the balance of electronic money set by the user in advance by transferring money from a bank deposit or the like to an electronic settlement service or by transferring money using a credit card. Balance information may be added automatically by auto-charging associated with payment processing. Instead of (or in addition to) the charge balance, the user information 210 includes a deferred payment balance that allows the user to purchase goods or services without prepaying for the electronic payment service, and an amount that can be paid by credit card. may be associated with

A plurality of payment methods available to the user are, for example, payment by charge balance, payment by deferred payment, payment by credit card, and other payment methods. Other payment methods include, for example, revolving payments and installment payments provided by electronic payment service providers and stores.

The payment history information is information indicating details of payments made by the user (date and time, shop ID of the shop where the purchase was made, payment amount, etc.) for each electronic payment.

Information about stores is managed as store information 220 . FIG. 5 is a diagram showing an example of the contents of the shop information 220. As shown in FIG. The store information 220 is, for example, a store ID associated with information such as a store category, location, payment pattern, and the like. The store category may be one-level information, or may be information having a hierarchical structure of two or more levels. For example, information such as "Japanese food", "restaurant", and "restaurant" may be given as a superordinate concept of "sushi" shown in the figure. The location may be represented by hierarchical information. The payment pattern is information indicating which of pattern 1 and pattern 2 described above can be used for payment (whether both can be used for payment).

The information processing unit 140 acquires behavior information provided by the payment application 20 when the user uses a credit card. The information processing unit 140 processes the behavior information and transmits the processed information to the fraud detection server 300 (see FIGS. 11 and 12 described later for details).

[Description of displayed interface screen]
Here, an interface screen displayed on the display unit of the user terminal device 10 by the payment application 20 described above will be described. FIG. 6 is a diagram showing an example of the interface screen IM1. The interface screen IM1 displays, for example, a bar code C1, a QR code, information indicating a payment method (payment from the charge balance), and buttons related to various services on the display unit. The bar code and QR code are information for the store terminal device 50 to read in payment processing. The information indicating the payment method is the payment method used in payment processing. The various services include, for example, a coupon application service, a shopping service, a flea market service, a taxi dispatch service, and the like.

The interface screen IM1 includes a display button B1A for enlarging and displaying the code image on a screen different from the interface screen IM1. When this button B1A is operated, the code image is enlarged and displayed on another screen.

When the user performs a predetermined operation (for example, taps an area corresponding to the displayed balance after performing an operation on the button B1A), the interface screen IM2 of FIG. 7 is displayed on the display unit. FIG. 7 is a diagram showing an example of the interface screen IM2. The interface screen IM2 displays, for example, setting buttons for setting the charge balance, payment method, and charge method.

The setting buttons include, for example, a button B2A for setting deferred payment, a button B2B for adding (registering) a credit card to be used for charging (an example of a "first operation button"), and charging. It includes a button B2C for adding (registering) a current bank account and a button B2D for setting automatic charging.

For example, when the button B2B is operated, the payment application 20 activates the camera of the user terminal device 10 and displays the interface screen IM3 of FIG. 8 on the display unit. FIG. 8 is a diagram showing an example of the interface screen IM3.

An area AR1 of the interface screen IM3 is an area in which an image captured by the activated camera is displayed. When the user moves the user terminal device 10 or the credit card so that the credit card to be registered fits within the frame set in the area AR and operates the image capture button, the payment application 20 captures the image captured by the camera. Read the information written on the credit card from As a result, the payment application 20 acquires the credit card number, expiration date, and the like.

When the user desires to manually enter a credit card number, when the button B3 (an example of a "second operation button") is operated, an interface screen IM4 (an example of a "screen for entering a credit card number") is displayed. is displayed on the display. FIG. 9 is a diagram showing an example of the interface screen IM4. The interface screen IM4 includes an area AR2A for entering the credit card number, an area AR2B for entering the credit card expiration date, an area AR2C for entering the credit card security code, and an area AR2C for entering the credit card security code. Includes button B4.

When the user operates the keyboard displayed on the interface screen IM4 to input information in each area and then operates the button B4, the payment application 20 transmits the input information to the payment server 100. Note that when the payment application 20 reads the information written on the credit card from the image captured by the camera, the read information is automatically input to the area corresponding to the information.

As described above, the user can request credit card registration using the interface screen provided by the payment application 20 and the payment server 100 . In response to this request, the fraud detection server 300 determines whether or not to accept credit card registration.

[Fraud detection server]
FIG. 10 is a diagram showing an example of the functional configuration of the fraud detection server 300. As shown in FIG. The fraud detection server 300 includes an acquisition unit 302, a determination unit 304, and a storage unit 310, for example. Acquisition unit 302 and determination unit 304 are each implemented by a hardware processor such as a CPU executing a program (software). Some or all of these components may be realized by hardware (including circuitry) such as LSI, ASIC, FPGA, GPU, etc., or by cooperation of software and hardware. good too. The program may be stored in advance in a storage device such as an HDD or flash memory (a storage device with a non-transitory storage medium), or may be stored in a removable storage medium such as a DVD or CD-ROM (non-transitory storage medium). physical storage medium), and may be installed in the storage device by mounting the storage medium in the drive device.

The storage unit 310 is an HDD, flash memory, RAM (Random Access Memory), or the like. The storage unit 310 may be a NAS (Network Attached Storage) device that can be accessed by the payment server 100 via a network. The storage unit 310 stores, for example, condition information 312 (described later).

The acquisition unit 302 acquires behavior information indicating user behavior related to an interface screen provided when the user uses a credit card in electronic commerce from the user terminal device 10 (payment application 20).

The determination unit 304 uses the behavior information to determine (detect) whether or not the use of the credit card is unintended by the owner of the credit card.

[Details of fraud detection processing]
FIG. 11 is a diagram for explaining details of fraud detection processing. First, the payment application 20 transmits the account number, credit card number, and behavior information (type of operation, time when the operation was performed) to the payment server 100 (S1). In S1, the first behavior information 242 (details will be described later) is transmitted.

Next, the settlement server 100 acquires the information transmitted in S1 above, and generates second behavior information 244 based on the first behavior information 242 included in the acquired information (S2). Next, the settlement server 100 transmits the account number, credit card number, and second behavior information 244 to the fraud detection server 300 (S3).

Next, the fraud detection server 300 determines whether or not the credit card is appropriate as a credit card to be used based on the information transmitted in S3 (S4). The fraud detection server 300, for example, refers to the condition information 312 to determine whether the credit card is being used in ways that are not intended by the credit card owner (details will be described later). The fraud detection server 300 determines, for example, whether or not a credit card is used fraudulently.

Next, the fraud detection server 300 transmits the determination result and countermeasures to the settlement server 100 (S5). For example, the fraud detection server 300 provides information indicating that the credit card that the user is about to use is fraudulently used (account number of the fraudulent user) and countermeasures to be taken against the user. It is transmitted to the fraud detection server 300 (S5). Next, the payment server 100 transmits a countermeasure to the payment application 20 (step S6).

Countermeasures include suspending the use of a user's account and blocking the use of a payment application by a user who is trying to make unauthorized use (a device that suspends the provision of services). Further, the countermeasure is a measure to forcibly log out the user when the user has logged in to use the service. A different compatible device may be used for each credit card issuer or type. Further, the countermeasure may be determined by the settlement server 100 .

As described above, the fraud detection server 300 can use the behavior information 240 to suppress unintended use of credit cards. Specific examples of the behavior information 240 and fraud detection using the behavior information 240 will be described below.

FIG. 12 is a diagram showing an example of the contents of the first behavior information 242 and the second behavior information 244. As shown in FIG. The first behavior information 242 is, for example, information in which the time of operation and the content of the operation on the payment application 20 are associated with each other. The first behavior information 242 includes, for example, information indicating that a button (B2B in FIG. 7) for registering (adding) a credit card has been operated at time T, and information indicating that a credit card number has been manually entered at time T+2. Information indicating that the button (B3 in FIG. 8) has been operated, information indicating that the number "1" has been input at time T+3, and the like.

The information processing unit 140 of the payment server 100 generates second behavior information 244 from the first behavior information 242 . For example, when a button for manually inputting a credit card number is operated in the first behavior information 242 and the number is input, the information processing unit 140 generates information (manual input flag) indicating manual input. do. The information processing section 140 calculates the time from time T (button operation for credit card registration) to time T+2 (button operation for manual input). The calculated time may be hereinafter referred to as "switching time".

The information processing section 140 also calculates the number input time and the time between predetermined operations. The number input time is, for example, the time required to input the credit card number. The information processing unit 140 transmits the second behavior information 244 to the fraud detection server 300 , and the acquisition unit 302 of the fraud detection server 300 acquires the second behavior information 244 . The fraud detection server 300 may generate the second behavior information 244 based on the first behavior information 242 , or the payment application 20 may generate the second behavior information 244 and send the second behavior information 244 via the payment server 100 . The behavior information 244 may be transmitted to the fraud detection server 300 .

[Specific examples of fraud detection]
Based on the second behavior information 244 and the condition information 312, the determination unit 304 determines whether or not the credit card is used unintentionally by the owner. FIG. 13 is a diagram showing an example of the condition information 312. As shown in FIG. The condition information 312 is, for example, a condition for determining whether or not the credit card is used unintentionally by the owner. If the conditions contained in the condition information 312 are satisfied, the credit card is determined to be used as intended by the owner, and if not satisfied, it is determined to be unintended use (illegal).

Condition information 312 includes, for example, conditions 1 to 5 and other conditions.
Condition 1 is that the switching time is equal to or greater than threshold Th1. For example, the switching time should not be too short.
Condition 2 is that the switching time is less than or equal to threshold Th2. For example, the switching time should not be too long.
Condition 3 is that the number input time is greater than or equal to threshold Th3. For example, the number input time should not be too short.
Condition 4 is that the number input time is less than or equal to threshold Th4. For example, the number input time should not be too long.
Condition 5 is that the credit card number cannot be registered. Credit card numbers that cannot be registered are stored in the storage unit 310, for example. A credit number that cannot be registered includes a credit card number provided by a credit card issuer, a predetermined organization, and a credit card number that the determination unit 304 has determined to be fraudulent in the past.

If the above conditions are met, the determination unit 304 determines that the credit card is used as intended by the owner (not fraudulent). For example, the threshold is a value that is set based on past trends in unauthorized use. For example, the switching time and number input time of an unauthorized user have different characteristics from the switching time and number input time of a normal user. For example, there are cases where the switching time or number input time is extremely short or long. Fraud is detected using this feature.

In the above example, it is determined whether or not each condition is satisfied. A function may be applied and scored, and a decision made based on the score. Also, determination may be made based on the branching result of the branching structure with the above conditions 1-5 and other conditions as branching conditions.

In the above example, an example in which determination is made using the switching time and the number input time has been described. Using the second timing at which the operation was performed, it may be determined whether or not the credit card is used unintentionally by the owner. For example, if the target time from the first timing to the second timing is outside the reference range, the determination unit 304 may determine that the credit card is used unintentionally by the owner.

The first timing is any one of (1) to (6), and the second timing is one of (1) to (6) different from the first timing.
(1) is the timing at which a button for displaying an interface screen (for example, IM3 in FIG. 8) is operated.
(2) is the timing at which an operation for manually inputting credit card information on the interface screen is performed (for example, the timing at which button B3 in FIG. 8 is operated).
(3) is the operation timing of inputting the credit card number after the operation for manually inputting the credit card information.
(4) is the operation timing of inputting the expiration date of the credit card after the operation for manually inputting the credit card information.
(5) is the operation timing of inputting the security code of the credit card after the operation for manually inputting the credit card information.
(6) is the timing at which the operation for manually inputting the credit card information is followed by the operation for registering the credit card (for example, the timing at which the button B4 in FIG. 9 is operated).

As described above, the judgment unit 304 judges that the credit card is used unintentionally by the owner of the credit card by using the predetermined time between operations that represents the characteristics of the behavior of the unauthorized user.

Moreover, the time during which no operation has been performed may also be taken into account in the determination. A state in which no operation is performed (a state in which the interface screen is simply displayed) is also an example of behavior information.

In the above example, the condition information 312 used when the credit card number is manually entered has been described. This condition information 312 (first determination condition) is different from, for example, the determination condition (second determination condition) applied when processing a credit card number obtained by recognition processing of an image captured by a camera. .

The acquisition unit 302 obtains first procedure information indicating the manually entered credit card number and intention to use the credit card (for example, the keyboard in FIG. 9 is operated to enter the credit card number in the area AR2A, and the credit card button B4 for adding is operated, information corresponding to these operations), and second procedure information indicating the credit card number and intention to use the credit card obtained by image recognition (for example, The credit card number is automatically entered in the area AR2A in FIG. 9 based on the image captured on the interface screen IM3, and the button B4 for adding a credit card in FIG. 9 is operated. information) and The first procedure information is, for example, a credit card number, information indicating that the credit card number has been manually entered, and information indicating the intention to use the credit card. , information indicating that the credit card number has been obtained by image recognition, and information indicating the intention to use the credit card. The determination unit 304 determines whether or not the credit card owner is using the credit card unintended based on the condition information 312 (first determination condition) and the behavior information when performing determination on the first procedure information, Whether the use of the credit card is unintended by the owner or not is determined based on the determination condition (second determination condition) different from the condition information 312 and the behavior information when determining the second procedure information.

The judgment condition (second judgment condition) is set so that the tendency to judge that the usage is intended by the owner is higher than the condition information 312 (first judgment condition). For example, when a determination is made using a score, and if the score is equal to or greater than the threshold, it is determined to be fraudulent, the threshold for the score for processing using image recognition is set higher than the threshold for the score for manual input. ing. The score is, for example, a score obtained by applying a predetermined parameter (switching time, number input time, etc.) to a preset algorithm or function. Also, in the determination information (second determination condition), part or all of the determination condition based on the time between operations may be omitted.

Also, in the above example, the user's behavior related to the interface screen is subject to determination, but instead (or in addition) of this, the timing of the operation on the payment application 20 may be subject to determination. . The operation on the payment application 20 includes, for example, an operation to activate the payment application 20, an operation to operate a predetermined button of the payment application 20 (for example, an operation to go through when registering a credit card), and the like. The time from these operations to predetermined operations (for example, various operations performed when registering a credit card) may represent the characteristics of the unauthorized user's operations. For example, the determination unit 304 determines the amount of credit based on the time from the operation of activating the payment application 20 to the operation of manually inputting the credit card number or the operation of completing the input of the credit card number, and the set conditions. It may be determined whether or not the use is unintended by the card owner.

As described above, the determination unit 304 can accurately determine whether or not the credit card is used unintentionally by the owner. Further, the determination unit 304 can easily perform the above determination.

<Modification 1>
In the above example, the second behavior information 244 is information related to the operation of the payment application 20. In addition (instead of), the second behavior information 244 includes feature information other than the operation of the payment application 20. may contain. The feature information other than the operation of the payment application 20 may be any information acquired by the user terminal device 10. For example, the orientation of the user terminal device 10, the hand operating the user terminal device 10 ( right hand or left hand). These pieces of information are information acquired by a UA (user agent), which is an application program of the user terminal device 10 .

As shown in FIG. 14, the UA 14 of the user terminal device 10 acquires the detection results of the various sensors 12 (information indicating the tilt of the user terminal device 10). The UA 14 acquires feature information based on the acquired detection result, and provides the acquired feature information to the payment application 20 . The UA 14 is, for example, an application program for detecting a hand operating the user terminal device 10 or an application program for detecting the orientation of the user terminal device 10 . The operating hand is identified based on a known technique. The payment application 20 transmits the characteristic information and the information on the operation of the payment application 20 to the payment server 100 .

FIG. 15 is a diagram showing an example of information acquired and generated by the settlement server 100. As shown in FIG. As shown in FIG. 15 , the payment server 100 acquires first behavior information 242 and feature information 243 . The characteristic information 243 is information in which the time, the orientation of the user terminal device 10, and information on the hand with which the user terminal device 10 is operated are associated with each other.

The information processing unit 140 generates second behavior information 244A. The second behavior information 244A includes, for example, the orientation of the user terminal device 10 (for example, the main orientation) and information on the hand operating the user terminal device 10 . The information processing unit 140 transmits the generated second behavior information 244A to the fraud detection server 300 .

The determination unit 304 determines whether or not the credit card is used unintentionally by the owner, based on the second behavior information 244A and the condition information 312A. In addition to the conditions included in the condition information 312, the condition information 312A includes, for example, conditions for feature information (eg, conditions 6 and 7). FIG. 16 is a diagram showing an example of the contents of the condition information 312A. Condition 6 is, for example, that the tilt of the user terminal device 10 in the feature information 243 is within the range of the reference tilt. Condition 7, for example, is that the hand operating the user terminal device 10 of the feature information 243 is the reference hand.

The reference tilt and reference hand (reference information) are the tilt and hand when the credit card owner operates the user terminal device 10 . These pieces of information are information provided by other server devices, for example, and are stored in the storage unit 310 . For example, the reference information is information obtained when using a service different from the service provided by the payment application 20 (for example, a service within a group company). For example, when an authorized credit user registers the credit through an interface screen of the other service in order to use the other service, the application or server device of the other service acquires the reference information.

Also, the determination unit 304 may perform determination using personal information (name, address, telephone number) registered in another service. For example, if the personal information corresponding to the credit card number in the other service is different from the personal information registered for use of the payment application 20, it may be determined as unauthorized use.

As described above, the determination unit 304 can accurately determine whether or not the credit card owner does not intend to use the credit card by using the feature information.

<Modification 2>
In the above example, the type of card company was not considered, but the type of card company may be considered. The determination unit 304 may determine the credit card using the condition information corresponding to the card company.

The determination unit 304 identifies the credit card issuer based on the behavior information, and determines whether the use of the credit card is the intention of the credit card owner based on the determination criteria corresponding to the identified issuer and the behavior information. It is determined whether or not it is a non-use. For example, the acquisition unit 302 may obtain first procedure information indicating the manually input credit card number and intention to use the credit card, and second procedure information indicating the credit card number and intention to use the credit card obtained by image recognition. 2 obtain procedural information; The judgment condition when the number of first procedure information corresponds to a credit card issuing company that is larger than the number of second procedure information by a threshold value or more and the credit card number is manually entered is the first procedure information It corresponds to the credit card issuing company whose number is not more than the threshold compared to the number of the second procedure information, and is the usage intended by the owner rather than the judgment condition when the credit card number is manually entered It is set so that the tendency to be determined as For example, if a credit card issued by a certain credit card company tends to have its credit card number entered manually, it is less likely to be fraudulent than if the credit card number of another card company's credit card is entered manually. Conditions are set so that judgment is made on

FIG. 17 is a diagram showing an example of the condition information 312B of Modification 2. As shown in FIG. The condition information 312B is associated with, for example, condition information for each card company (issuer). The determination unit 304 identifies the card company, for example, based on the issuer identification number included in the credit card number (for example, the number indicated by the first six digits).

For example, the conditions of card company A's condition information are set to be more likely to be determined to be the usage intended by the owner than the conditions of card company B's condition information. For example, if the score is equal to or greater than the threshold value, the score threshold for card company A is set higher than the score threshold for card company B. In addition, the threshold for card company A's parameters (such as switching time, which is an element to be determined) is set to be more likely to be determined as intended use than the threshold for card company B's parameters.

For example, credit cards of card company A tend to have more information entered manually than credit cards of card company B, and information on credit cards of card company A is entered manually at a higher rate than a predetermined rate. This is because it may tend to be For example, in the above case, it is presumed that manual input is used because it is difficult to recognize a credit card number or the like in image recognition processing using an image captured by a camera. When it is presumed that there is a reason for using manual input in this way, the condition may be adjusted so that it is difficult to determine that the condition is illegal.

For example, the condition of card company C's condition information may be set so as to have a higher tendency to be judged as not being used as intended by the owner than the condition of card company D's condition information. For example, if the rate of unintended use of the credit card of card company C is equal to or higher than the threshold, or if the rate of unintended use of the credit card of card company D is higher than that of the credit card of card company D, The condition of the card company C may be adjusted so that it tends to be determined to be fraudulent.

For example, in the above case, it is presumed that a large number of credit card numbers obtained via the phishing site of the credit card company C may be illegally used. If the possibility of unauthorized use is estimated in this way, the conditions may be adjusted to be stricter.

As described above, the determination unit 304 can more accurately determine whether or not the credit card owner does not intend to use the credit card by using the conditions for each card company.

<Modification 3>
The determination unit 304 may change the condition information based on whether the credit card is a numberless card. The determination unit 304 identifies whether the credit card is a numberless card, for example, based on the behavior information. If the credit card is a numberless card, the determination unit 304 determines whether or not the credit card is used unintentionally by the owner based on the third determination condition and the behavior information. If the credit card is not a numberless card, the determination unit 304 determines whether or not the credit card is used unintentionally by the owner based on the behavior information and a fourth determination condition different from the third determination condition. The third determination condition is set so as to increase the tendency to determine that the usage is intended by the owner, compared to the fourth determination condition.

FIG. 18 is a diagram showing an example of condition information 312C. The condition information 312C includes condition information E corresponding to numberless cards and condition information F corresponding to credit cards that are not numberless cards (credit cards with credit card numbers). For example, the condition of condition information E corresponding to a numberless card tends to be determined to be the use intended by the owner rather than the condition of condition information F of a credit card in which the credit card number is written. For example, numberless cards inevitably require manual entry of information.

Any numberless card determination method may be employed. For example, the determination unit 304 identifies whether or not the card is a numberless card based on a predetermined rule and the credit card number. The determination unit 304 identifies a numberless card from the credit card number by referring to a predetermined rule. The predetermined rule is, for example, that the number in the 0th digit is △. This rule may be derived by the fraud detection server 300 or an administrator managing the fraud detection server 300 by analyzing the credit card numbers of a plurality of numberless cards. Further, the fraud detection server 300 may acquire, for example, information on rules and credit card numbers of numberless cards from affiliated card companies.

Further, in the case of a numberless card, the determination unit 304 may include in the condition information that a predetermined application program has been used within a predetermined time period before the credit card number is entered. The predetermined application program is an application program that provides card information (credit card number, expiration date, security code, etc.) of the numberless card.

For example, the settlement application 20 acquires usage information indicating that a predetermined application program has been used from a predetermined application program, and transmits the acquired information to the fraud detection server 300 via the settlement server 100 . If the fraud detection server 300 does not acquire the usage information, it may determine that the credit card is not used as intended by the owner, and the threshold such as the score is adjusted so that it is determined that the use is not intended. You may

Also, the contents of Modification 2 and Modification 3 may be integrated. A condition may be set for each combination of the type of card company and the presence or absence of a numberless card.

As described above, the determining unit 304 can more accurately determine whether or not the credit card is used unintentionally by the owner by using conditions for each type of card.

<Modification 4>
The determination unit 304 may determine whether or not the use of the credit card is the intended use using the output result of the learned model. FIG. 19 is a diagram showing an example of processing of the trained model 214. As shown in FIG. The learned model 214 is a model that outputs an index indicating that the user is intended by the owner or an index that indicates that the user is not intended by the owner when information regarding the operation of the payment application 20 is input. be. The information about the operation is, for example, the time between operations such as switching time and number input time. The learned model 214 may be input with, for example, information indicating the user's attributes (sex, age, etc.) and details of operations performed on the payment application 20 .

A trained model 214 is a model in which the training data has been trained. The learning data includes the determination result (correct data) determined by the determining unit 304 that the credit card is used unintendedly using the above-described condition information without using the trained model 214, and input target information (for example, information in which the switching time and the number input time are associated with each other). The correct answer data may be the result of determination that the credit card is intended to be used. Also, the learning data may be information to be input when the credit card is actually fraudulently used.

The learned model 214 outputs an index indicating unintended use when the switching time and the number input time corresponding to the determination result of unintended use are input, and the intended use is This model is learned to output an index indicating intended use when a switching time corresponding to a determination result determined to be present and a number input time are input.

As described above, by using the learned model 214, the determination unit 304 can easily and accurately determine whether or not the credit card owner did not intend to use the credit card.

<Summary>
For example, assume that an unauthorized user creates a web page that resembles a web page of a credit card company (creates a phishing site) and obtains the credit card number entered on this web page. In this case, an unauthorized user may create an account for a payment service and try to associate the account with the credit card number of the credit card obtained illegally.

In the above case, the unauthorized user attempts to manually enter the credit card number when registering the credit card because the user does not have the credit card itself. Thus, the behavior of an unauthorized user when manually entering a credit card number may differ from the behavior of a legitimate user when manually entering a credit card number. In addition, the fraud detection server 300 holds information on credit card numbers that cannot be used, but this information is information from a predetermined time ago and is different from information on credit card numbers illegally obtained in real time. For this reason, it may be difficult to identify an illegally acquired credit card.

The determination unit 304 determines whether or not the credit card is used as intended by the owner, using the behavior when the credit card is registered as in each of the above-described embodiments. As a result, it is possible to easily and accurately determine whether or not the credit card is used as intended by the owner.

As described above, the mode for carrying out the present invention has been described using the embodiments, but the present invention is not limited to such embodiments at all, and various modifications and replacements can be made without departing from the scope of the present invention. can be added.

10 User terminal device 20 Payment application 50 Store terminal device 60 Store code image 100 Settlement server 120 Content providing unit 130 Settlement processing unit 140 Information processing unit 200 Storage unit 210 User information 220 Store information 230 Content information 240 Behavior information 300 Fraud detection Server 302 Acquisition unit 304 Determination unit

Claims (17)

an acquisition unit that acquires behavior information indicating user behavior related to an interface screen provided when a user uses a credit card in electronic commerce from a terminal device;
a determination unit that determines whether the use of the credit card is unintended by the owner of the credit card, using the behavior information acquired by the acquisition unit;
The behavior information is operation information including one or both of operation information for the interface screen and operation information for displaying the interface screen,
The operation information includes information in which information indicating the type of the operation and information indicating the timing at which the operation is performed are associated with each other;
The obtaining unit includes first procedure information indicating the manually input credit card number and intention to use the credit card, and second procedure information indicating the credit card number and intention to use the credit card obtained by image recognition. get information and
The determination unit
When performing a determination on the first procedure information, from a first timing indicating that the first operation, which is the operation in the operation information, has been performed, to a second timing, which indicates that the second operation, which is the operation in the operation information, has been performed. If the target time until the timing is outside the reference range that is the first determination condition, it is determined that the credit card is used unintentionally by the owner,
The first determination condition is a condition different from the second determination condition used to determine whether or not the use of the credit card for the second procedure information is unintended by the owner of the credit card. be,
judgment system. The second determination condition is set so that the tendency to determine that the use is intended by the owner is higher than the first determination condition.
The determination system according to claim 1. Behavior information based on the user's operation related to the interface screen provided when the user uses a credit card in electronic commerce from the terminal device, and the credit card is credited after the button for registering the credit card is operated. Acquisition unit for acquiring behavior information including information indicating switching time until operation for manually inputting the credit card number and information indicating number input time required for inputting the credit card number When,
determining whether the switching time is outside the first reference range corresponding to the switching time and whether the number input time is outside the second reference range corresponding to the number input time;
If the switching time is not outside the first reference range corresponding to the switching time and the number input time is not outside the second reference range corresponding to the number input time, the credit card owner intends to determined to be used,
If the switching time is outside the first reference range corresponding to the switching time or the number input time is outside the second reference range corresponding to the number input time, the intention of the credit card owner a determination unit that determines that the usage is not
judgment system. If the target time from the third timing to the fourth timing is outside the reference range, the determination unit determines that the credit card is used unintentionally by the owner,
The third timing is any timing of (1) to (6),
The fourth timing is a timing different from the above third timing among (1) to (6),
(1) is the timing at which the button for displaying the interface screen is operated,
(2) is the timing at which an operation for manually inputting the credit card information on the interface screen is performed;
(3) is the operation timing of inputting the credit card number after the operation for manually inputting the credit card information,
(4) is the operation timing of inputting the expiration date of the credit card after the operation for manually inputting the credit card information,
(5) is the operation timing of inputting the credit card security code after the operation for manually inputting the credit card information ,
(6) is the timing when the operation for registering the credit card is performed after the operation for manually inputting the credit card information.
The determination system according to any one of claims 1 to 3. If the determination unit determines that the usage is unintended by the owner, perform any of the following (A) to (D),
(A) providing information indicating that the credit card cannot be registered on the terminal device;
(B) suspending the account of the user who attempted to register said credit card;
(C) restricting the user from using the e-commerce service;
(D) if the user is logged into the electronic commerce, forcibly log out;
The determination system according to any one of claims 1 to 4. The acquisition unit obtains one or both of the behavior information, information on the user's hand operating the terminal device, and information on the orientation of the terminal device when operating the terminal device. Get the feature information that is
The determination unit performs the determination using the feature information and reference information corresponding to the feature information in addition to the behavior information.
A determination system according to any one of claims 1 to 5. The determination unit is
Identifying the issuer of the credit card based on the behavior information including the information indicating the credit card number ,
Determining whether or not the use of the credit card is unintended by the owner of the credit card based on the determination criteria corresponding to the identified issuing company and the behavior information;
A determination system according to any one of claims 1 to 6. The obtaining unit includes first procedure information indicating the manually input credit card number and intention to use the credit card, and second procedure information indicating the credit card number and intention to use the credit card obtained by image recognition. get information and
The judgment condition when the number of the first procedure information corresponds to a credit card issuing company that is larger than the number of the second procedure information by a threshold value or more and the credit card number is manually input is the first It corresponds to the credit card issuer whose number of procedure information is not more than the threshold compared to the number of the second procedure information, and the intention of the owner rather than the judgment condition when the credit card number is manually entered It is set to increase the tendency to be judged as being used to
The determination system according to claim 7. The determination unit is
identifying whether the credit card is a numberless card based on the behavior information including information indicating the credit card number;
If the credit card is a numberless card, determine whether or not the credit card is used unintentionally by the owner based on the third determination condition and the behavior information;
If the credit card is not a numberless card, it is determined whether or not the credit card is used unintentionally by the owner based on a fourth determination condition different from the third determination condition and the behavior information.
A determination system according to any one of claims 1 to 8. The third determination condition is set so that the tendency to be determined to be the use intended by the owner is higher than the fourth determination condition,
A determination system according to claim 9 . Behavior information based on the user's operation related to the interface screen provided when the user uses a credit card in electronic commerce from the terminal device, and the credit card is credited after the button for registering the credit card is operated. Acquisition unit for acquiring behavior information including information indicating switching time until operation for manually inputting the credit card number and information indicating number input time required for inputting the credit card number When,
When behavior information including switching time and number input time is input in the case of unintended use by the user of the credit card, an index indicating unintended use is output, and if the use is intended When the behavior information including the switching time and the number input time is input, whether the credit card user, which is the correct data, is using it unintentionally so as to output an index indicating that it is intended use Behavior information including the switching time and the number input time is input to a trained model trained with learning data in which information indicating whether or not the switching time is associated with the switching time and the number input time. a determination unit that determines whether or not the credit card is used unintentionally by the owner, based on the results output by the learned model;
judgment system. the computer
Acquiring behavior information indicating the user's behavior related to the interface screen provided when the user uses a credit card in electronic commerce from the terminal device,
using the acquired behavior information to determine whether the use of the credit card is unintended by the owner of the credit card;
The behavior information is operation information including one or both of operation information for the interface screen and operation information for displaying the interface screen,
The operation information includes information in which information indicating the type of the operation and information indicating the timing at which the operation is performed are associated with each other;
Acquisition of first procedure information indicating manually input credit card number and intention to use credit card, and second procedure information indicating credit card number obtained by image recognition and intention to use credit card ,
When performing a determination on the first procedure information, from a first timing indicating that the first operation, which is the operation in the operation information, has been performed, to a second timing, which indicates that the second operation, which is the operation in the operation information, has been performed. If the target time until the timing is outside the reference range that is the first determination condition, it is determined that the credit card is used unintentionally by the owner,
The first determination condition is a condition different from the second determination condition used to determine whether or not the use of the credit card for the second procedure information is unintended by the owner of the credit card. be,
judgment method. to the computer,
Acquiring from the terminal device behavior information indicating the user's behavior related to the interface screen provided when the user uses a credit card in electronic commerce,
Using the acquired behavior information, determine whether or not the use of the credit card is unintended by the owner of the credit card;
The behavior information is operation information including one or both of operation information for the interface screen and operation information for displaying the interface screen,
The operation information includes information in which information indicating the type of the operation and information indicating the timing at which the operation is performed are associated with each other;
Acquisition of first procedure information indicating the manually input credit card number and intention to use the credit card, and second procedure information indicating the credit card number obtained by image recognition and intention to use the credit card ,
When performing a determination on the first procedure information, from a first timing indicating that the first operation, which is the operation in the operation information, has been performed, to a second timing, which indicates that the second operation, which is the operation in the operation information, has been performed. If the target time until the timing is outside the reference range that is the first determination condition, determine that the credit card is used unintentionally by the owner,
The first determination condition is a condition different from the second determination condition used to determine whether or not the use of the credit card for the second procedure information is unintended by the owner of the credit card. be,
program. the computer
Behavior information based on the user's operation related to the interface screen provided when the user uses a credit card in electronic commerce from the terminal device, and the credit card is credited after the button for registering the credit card is operated. Acquiring behavior information including information indicating the switching time until an operation for manually entering the credit card number and information indicating the number input time required to enter the credit card number ,
determining whether the switching time is outside the first reference range corresponding to the switching time and whether the number input time is outside the second reference range corresponding to the number input time;
If the switching time is not outside the first reference range corresponding to the switching time and the number input time is not outside the second reference range corresponding to the number input time, the credit card owner intends to determined to be used,
If the switching time is outside the first reference range corresponding to the switching time or the number input time is outside the second reference range corresponding to the number input time, the intention of the credit card owner determine that it is not used,
judgment method. to the computer,
Behavior information based on the user's operation related to the interface screen provided when the user uses a credit card in electronic commerce from the terminal device, and the credit card is credited after the button for registering the credit card is operated. obtaining behavior information including information indicating the switching time until the operation for manually inputting the credit card number and information indicating the number input time required to input the credit card number ;
determining whether the switching time is outside a first reference range corresponding to the switching time and whether the number input time is outside a second reference range corresponding to the number input time;
If the switching time is not outside the first reference range corresponding to the switching time and the number input time is not outside the second reference range corresponding to the number input time, the credit card owner intends to Let it be determined that it is used,
If the switching time is outside the first reference range corresponding to the switching time or the number input time is outside the second reference range corresponding to the number input time, the intention of the credit card owner to determine that it is a use that does not
program. the computer
Behavior information based on the user's operation related to the interface screen provided when the user uses a credit card in electronic commerce from the terminal device, and the credit card is credited after the button for registering the credit card is operated. Acquiring behavior information including information indicating the switching time until an operation for manually entering the credit card number and information indicating the number input time required to enter the credit card number ,
When behavior information including switching time and number input time is input in the case of unintended use by the user of the credit card, an index indicating unintended use is output, and if the use is intended When the behavior information including the switching time and the number input time is input, whether the credit card user, which is the correct data, is using it unintentionally so as to output an index indicating that it is intended use Behavior information including the switching time and the number input time is input to a trained model trained with learning data in which information indicating whether or not the switching time is associated with the switching time and the number input time. , based on the results output by the learned model, determine whether the credit card is used unintentionally by the owner;
judgment method. to the computer,
Behavior information based on the user's operation related to the interface screen provided when the user uses a credit card in electronic commerce from the terminal device, and the credit card is credited after the button for registering the credit card is operated. obtaining behavior information including information indicating the switching time until the operation for manually inputting the credit card number and information indicating the number input time required to input the credit card number ;
When behavior information including switching time and number input time is input in the case of unintended use by the user of the credit card, an index indicating unintended use is output, and if the use is intended When the behavior information including the switching time and the number input time is input, whether the credit card user, which is the correct data, is using it unintentionally so as to output an index indicating that it is intended use Behavior information including the switching time and the number input time is input to a trained model trained with learning data in which information indicating whether or not the switching time is associated with the switching time and the number input time. , based on the results output by the trained model, determine whether or not the credit card is used unintentionally by the owner;
program.

Images