JP7388043B2 - Output device, output method and output program - Google Patents

Description

Embodiments of the present invention relate to an output device, an output method, and an output program.

2. Description of the Related Art Conventionally, techniques are known for performing various payment processing using terminal devices such as smartphones, tablet terminals, wearable devices, and the like. As an example of such technology, when a terminal device is used to read a two-dimensional code such as a QR code (registered trademark) (Quick Response Code) for a store, payment information is sent to the store corresponding to the read two-dimensional code. A technique for receiving information via a terminal device is known.

Here, if the 2D code for the 2nd store is mistakenly provided to the 1st store, or if an incorrect 2D code is attached to the 2D code of the 1st store printed on paper, etc. , the payment to the first store will not be made properly. Therefore, there is a technology to authenticate an imaged two-dimensional code by determining whether or not the position where the two-dimensional code imaged by the terminal device matches the position where the two-dimensional code is imaged by the terminal device. Are known.

Japanese Patent Application Publication No. 2015-046052

However, the above-described technology may impair the convenience of payment using two-dimensional codes.

For example, with the above-described technology, when making a payment at a mobile store or the like, it takes time and effort to register the place where the payment is to be made in advance. Furthermore, with the above-described technology, if a combination of the location of the first store and an incorrect two-dimensional code is registered, there is a risk that the authentication will be successful and an incorrect payment will be made.

The present application was made in view of the above, and aims to prevent fraudulent payments without sacrificing convenience.

The output device according to the present application includes an acquisition unit that acquires payment information indicating a payment between a user of a terminal device that has read a code and a counterparty corresponding to the code, and an acquisition unit that acquires payment information indicating a payment between a user of a terminal device that has read a code and a counterparty corresponding to the code, and a an identification unit that identifies an abnormality in the payment between the user and the corresponding person based on a trend; and if the abnormality identified by the identification unit satisfies a predetermined condition, the payment regarding the corresponding person; and an output unit that outputs fraud information indicating that fraud exists in the above.

According to one aspect of the embodiment, it is possible to prevent fraudulent payments without sacrificing convenience.

FIG. 1 is a diagram showing an example of payment using a two-dimensional code. FIG. 2 is a diagram illustrating an example of output processing according to the embodiment. FIG. 3 is a diagram illustrating a configuration example of an information providing system according to an embodiment. FIG. 4 is a diagram illustrating a configuration example of an information providing apparatus according to an embodiment. FIG. 5 is a diagram illustrating an example of a payment database according to the embodiment. FIG. 6 is a diagram illustrating an example of a payment database according to the embodiment. FIG. 7 is a diagram illustrating an example of a store database according to the embodiment. FIG. 8 is a flowchart illustrating an example of an output processing procedure according to the embodiment. FIG. 9 is a hardware configuration diagram showing an example of a computer that implements the functions of the information providing device.

EMBODIMENT OF THE INVENTION Below, the output device, the output method, and the form for implementing an output program (hereinafter referred to as "embodiment") according to the present application will be described with reference to the drawings. Note that this embodiment does not limit the output device, output method, and output program according to the present application. Furthermore, in the following embodiments, the same parts are denoted by the same reference numerals, and redundant explanations will be omitted.

[1. Embodiment]
As a premise of the output processing according to the present embodiment, fraud performed in payment using a two-dimensional code (hereinafter sometimes referred to as "code payment") will be explained using FIG. 1. FIG. 1 is a diagram showing an example of payment using a two-dimensional code.

It is assumed that the terminal device 100 shown in FIG. 1 is an information processing device (smartphone) used by the user U. It is also assumed that the store terminal 201 shown in FIG. 1 is an information processing device (smartphone) used by a manager (seller) S of a store R1, which is a physical store. Further, the store terminal 202 shown in FIG. 1 is an information processing device used by the administrator (fraudulent person) F, who is the administrator of store R2, which is a physical store, and who attempts to fraudulently receive payments from users. (smartphone).

It is also assumed that the payment server 300 shown in FIG. 1 is an information processing device that controls code payment processing. In the example of FIG. 1, the payment server 300 collects code information indicating a two-dimensional code read by the terminal device 100 at a store (actual store) and the total amount (purchase amount) of the transaction object that the user U purchases at the store. By receiving the information shown from the terminal device 100, payment processing (transfer) of the purchase amount is performed to the manager of the store corresponding to the code information. In the example of FIG. 1, it is assumed that the two-dimensional code QR1 corresponding to the seller S has already been distributed to the store terminal 201, and the two-dimensional code QR2 corresponding to the fraudster F has already been distributed to the store terminal 202. .

First, the fraudulent person F superimposes the two-dimensional code of the fraudulent person F on the two-dimensional code of the seller S (step S1). For example, in the example of FIG. 1, the fraudster F overlays the two-dimensional code QR2 on the two-dimensional code QR1 printed on a predetermined medium (for example, printing paper) and installed at the cash register of the store R1.

Here, in the example of FIG. 1, it is assumed that the user U visits the store R1 and wishes to settle the purchase amount at the store R1 by code payment. In this case, the terminal device 100 reads the two-dimensional code installed at the cash register of the store R1, that is, the two-dimensional code QR2 of the fraudster F (step S2). Subsequently, the terminal device 100 notifies (sends) the two-dimensional code QR2 of the fraudster F and the purchase amount of the user U at the store R1 to the payment server 300 (step S3). For example, in the example of FIG. 1, the terminal device 100 sends a payment request to the payment server 300 including code information indicating the two-dimensional code QR2 read in step S2 and the purchase amount input by the user U into the terminal device 100. Notice.

Subsequently, the payment server 300 transfers the purchase amount notified from the terminal device 100 to the fraudster F (step S4). In other words, the payment server 300 transfers the purchase amount input by the user U to the fraudster F corresponding to the two-dimensional code QR2 indicated by the code information notified from the terminal device 100 in step S3. On the other hand, the payment server 300 does not transfer money to the seller S who actually sold the transaction object to the user U.

As mentioned above, when a store uses 2D code for payment, if another store's 2D code is pasted over its own store's 2D code, it may not be able to properly accept payments from users. Can not. Therefore, there is a need for a technology that prevents fraudulent payments caused by overlapping two-dimensional codes. Here, as a technology related to payment using a two-dimensional code, conventionally, it is determined whether the position where the two-dimensional code imaged by the terminal device matches the position where the two-dimensional code is imaged by the terminal device. There is a known technique for authenticating an imaged two-dimensional code. However, in the conventional technology, when making a payment at a mobile store or the like, there is a problem in that it takes time and effort to register the place where the payment is to be made in advance, and it is not very convenient.

Based on the above premises and problems, the output processing realized by the output device and the like according to the present application will be described below using FIG. 2. FIG. 2 is a diagram illustrating an example of output processing according to the embodiment. Note that in FIG. 2, it is assumed that the output processing and the like according to the embodiment are realized by the information providing device 10, which is an example of an output device according to the present application.

Prior to the description of FIG. 2, the information providing system 1 according to the embodiment will be described using FIG. 3. FIG. 3 is a diagram illustrating a configuration example of an information providing system according to an embodiment. As shown in FIG. 3, the information providing system 1 according to the embodiment includes an information providing device 10, a terminal device 100, a store terminal 200, a payment server 300, and a log server 400. The information providing device 10, the terminal device 100, the store terminal 200, the payment server 300, and the log server 400 are connected via a network N to be able to communicate with each other by wire or wirelessly. The network N is, for example, a WAN (Wide Area Network) such as the Internet. The information providing system 1 shown in FIG. 3 includes multiple information providing devices 10, multiple terminal devices 100, multiple store terminals 200, multiple payment servers 300, and multiple log servers 400. May be included.

The information providing device 10 is an information processing device that outputs fraud information indicating that there is fraud in the payment regarding the manager, based on the abnormality of the payment between the user and the manager of the store. For example, the information providing device 10 manages payment information regarding payments between users and store managers. The information providing device 10 also manages user information including various logs of users in various contents and various information estimated based on the logs. The information providing device 10 also manages store information including information such as the location of each store, the average purchase amount of users at the store (average purchase amount), and the categories of purchase items handled at the store.

The terminal device 100 is an information processing device used by a user. The terminal device 100 is realized by, for example, a smartphone, a tablet terminal, a notebook PC (Personal Computer), a desktop PC, a mobile phone, a PDA (Personal Digital Assistant), or the like. Note that in the example shown in FIG. 2, the terminal device 100 is a smart device such as a smartphone or a tablet used by a user. Further, the terminal device 100 displays information related to code payment (for example, information displayed on the screen of the terminal device 100 when making a code payment) distributed by the payment server 300 or the like using a web browser or an application. When a user who visits a store (physical store) wishes to make a code payment, the terminal device 100 provides code information indicating a two-dimensional code installed at the store, and the purchase amount of the user at the store. A payment request including the following is sent to the payment server 300. Further, the terminal device 100 displays information regarding various contents distributed by the log server 400 and the like using a web browser or an application.

The store terminal 200 is an information processing device used by the manager of each store. That is, in the following, the manager of each store can also be read as the store terminal 200. The store terminal 200 is realized by, for example, a POS (Point of Sales system) terminal, a smartphone, a tablet terminal, a notebook PC, a desktop PC, a mobile phone, a PDA, or the like. Additionally, the store terminal 200 receives from the payment server 300 or the like a two-dimensional code that corresponds to the user (administrator) of the store terminal 200 and is read by the terminal device 100 when making a code payment. .

The payment server 300 is an information processing device that controls code payment processing. For example, the payment server 300 receives a payment request from the terminal device 100 and performs payment processing (transfer) to the manager of the store corresponding to the payment request. Further, the payment server 300 manages payment information corresponding to payment requests received from the terminal device 100. For example, the payment server 300 may store date and time information indicating the date and time when the code payment was made, the payment source (user) of the payment using the code payment, the store managed by the administrator corresponding to the code information (the payment ), manages payment information including information such as purchase amount paid by code payment.

The log server 400 is a server device that distributes various contents to the terminal device 100 and manages various logs of users in the distributed contents. Note that the content distributed by the log server 400 includes, for example, a portal site, a news site, an auction site, a weather forecast site, a shopping (electronic commerce) site, a finance (stock price) site, a route search site, a map providing site, a travel site, The content may be related to restaurant introduction sites, facility reservation sites, SNS (Social Networking Service) sites, web blogs, and the like. Further, the content distributed by the log server 400 may be, for example, content related to various applications (hereinafter sometimes referred to as "apps") installed on the terminal device 100. Specifically, portal apps, news apps, auction sites, weather forecast apps, shopping apps, finance (stock prices) apps, route search apps, map providing apps, travel apps, restaurant introduction apps, facility reservation apps, SNS apps, The content may be related to a blog viewing application or the like.

Hereinafter, the output processing performed by the information providing apparatus 10 will be explained using FIG. 2. Note that in the following description, it is assumed that the terminal device 100 is used by the user U. That is, below, the user U can also be read as the terminal device 100. In addition, in the following explanation, the two-dimensional code corresponding to the administrator of each store is notified from the payment server 300 etc. to the store terminal 200, and each store using the code payment is provided with a predetermined medium on which the two-dimensional code is printed. It is assumed that it has been installed. In the following description, it is assumed that the information providing device 10 has already acquired store information from the store terminal 200 of each store.

First, the information providing device 10 acquires payment information from the payment server 300 (step S11). For example, in the example of FIG. 2, the information providing device 10 acquires payment information stored in the payment server 300 every predetermined period (for example, one day, one week).

Subsequently, the log server 400 acquires various logs of the user U regarding the content distributed to the terminal device 100 (step S12). For example, in the example of FIG. 2, the log server 400 acquires information such as user U's purchase history, location history, posting history, etc. of various contents distributed to the terminal device 100 as a log.

Subsequently, the information providing device 10 acquires various logs of the user U from the log server 400 (step S13). For example, in the example of FIG. 2, the information providing apparatus 10 acquires logs accumulated in the log server 400 every predetermined period (for example, one day, one week).

Subsequently, the information providing device 10 estimates the context regarding the purchase of the user U (step S14). For example, in the example shown in FIG. 2, the information providing device 10 estimates trends in the context related to user U's purchases based on user U's payment information and various logs. Specifically, the information providing device 10 determines the area where the user U mainly makes purchases (for example, the number of store visits) based on the user U's location history (for example, place of residence, place of work, place of work, etc.). Estimates the main purchasing area (area where physical stores are located where is greater than or equal to a predetermined threshold). The information providing device 10 also analyzes the transaction object categories that the user U mainly purchases (for example, the number of purchases of the corresponding transaction object among the transaction object categories) based on the user U's payment information and purchase history. The main purchase object indicating the category (category in which the transaction object is greater than or equal to a predetermined threshold value) and the main purchase amount indicating the average total amount when the user U purchases the transaction object are estimated. Further, the information providing device 10 estimates the status of the user U (for example, the user's behavior status) at each date and time based on the user U's position history and posting history.

In the example of FIG. 2, the information providing device 10 provides the context related to the purchase of the user U as the main purchasing area "Region #1", the main purchasing target "Category #1", the main purchasing amount "1000 yen", and the date and time. Assume that the status “sightseeing” in #1 is estimated.

Subsequently, the information providing device 10 classifies payment information related to purchasing behavior that does not match the estimated context from among the payment information of the user U as payment information with abnormality (hereinafter referred to as "abnormal payment"). (step S15). For example, in the example of FIG. 2, the information providing device 10 is located in region #2, which is different from the user U's main purchasing region "region #1", in the payment information of the user U. Payment information #1 regarding a payment to store R2 that handles a transaction object belonging to a category #2 different from the object "category #1" is identified as an abnormal payment. Note that, among the payment information of the user U, the information providing device 10 determines that payment information related to a payment in which the difference between the purchase amount paid to the manager of the store and the average purchase amount of the store is equal to or more than a predetermined threshold is abnormal. It may also be specified as a payment.

Here, in the example of FIG. 2, it is assumed that the information providing apparatus 10 performs the processes from step S12 to step S15 for each user who uses code payment.

Subsequently, the information providing device 10 determines whether the accumulation of abnormalities in the store satisfies a predetermined condition (step S16). For example, in the example of FIG. 2, the information providing device 10 totals the number of abnormal payments made for each store, and calculates the number of abnormal payments made within a predetermined period (for example, one week, one month). It is determined whether the accumulation has exceeded a predetermined threshold. Here, in the example of FIG. 2, it is assumed that the cumulative number of abnormal payments made to store R2 within period #1 is equal to or greater than a predetermined threshold. In this case, the information providing device 10 treats the manager of the store R2 as a fraudster who is fraudulently receiving payments from users, in other words, the information providing device 10 identifies the manager of the store R2 as a fraudster who is fraudulently receiving payments from users. It is determined that the person is an unauthorized person who has pasted multiple dimensional codes.

Next, the information providing device 10 identifies the target store of fraud (in other words, the two-dimensional code installed at the store) based on the context of the user who made the abnormal payment and the decrease in sales. The target store on which the two-dimensional code corresponding to the fraudster has been pasted is determined (step S17). Here, in the example of FIG. 2, assume that user U made an abnormal payment to store R2 within period #1. In this case, the information providing device 10 identifies stores R1 and R3, which are located in the user U's main purchasing area "area #1" and use code payment, as candidates for stores subject to fraud (candidate stores). .

Then, the information providing device 10 calculates the amount of decrease in sales of the candidate store in period #1 (for example, period #1 Calculate the amount of decrease in sales due to code payments in period #1 when compared with the average value of sales due to code payments in the corresponding period. Further, the information providing device 10 calculates the amount of increase in sales of store R2 in period #1 (for example, period #1 Calculate the amount of increase in sales due to code payments in period #1 when compared with the average value of sales due to code payments in the corresponding period. Then, the information providing device 10 determines, among the candidate stores, a candidate store in which the difference between the sales decrease amount and the sales increase amount of store R2 is within a predetermined threshold value as a fraudulent target store.

Subsequently, the information providing device 10 outputs fraudulent information to the payment server 300 (step S18). Here, in the example of FIG. 2, it is assumed that store R1 is determined to be a store subject to fraud. In this case, the information providing device 10 outputs fraud information to the payment server 300 indicating that there is fraud by the manager of the store R2 against the manager of the store R1.

As described above, the information providing device 10 according to the embodiment identifies payment information that does not match the context of the user's purchase as an abnormal payment. Then, the information providing device 10 according to the embodiment identifies the fraudster who is fraudulently receiving payments from the user and also identifies the target store of fraud, depending on the accumulation of abnormal payments. In other words, the information providing device 10 according to the embodiment does not require prior information registration and can identify fraud associated with overlapping two-dimensional codes based on the user's purchase context, without sacrificing convenience. can prevent fraudulent payments.

[2. Configuration of information providing device]
Next, the configuration of the information providing device 10 will be described using FIG. 4. FIG. 4 is a diagram illustrating a configuration example of an information providing apparatus according to an embodiment. As shown in FIG. 4, the information providing device 10 includes a communication section 20, a storage section 30, and a control section 40.

(About the communication department 20)
The communication unit 20 is realized by, for example, a NIC (Network Interface Card). The communication unit 20 is connected to the network N by wire or wirelessly, and transmits and receives information between the terminal device 100, the store terminal 200, the payment server 300, the log server 400, and the like.

(About the storage unit 30)
The storage unit 30 is realized by, for example, a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk. As shown in FIG. 3, the storage unit 30 includes a payment database 31, a user database 32, and a store database 33.

(About payment database 31)
The payment database 31 stores payment information regarding payments between users and store managers. Here, an example of payment information stored in the payment database 31 will be explained using FIG. 5. FIG. 5 is a diagram illustrating an example of a payment database according to the embodiment. In the example of FIG. 5, the payment database 31 has items such as "payment ID", "date and time information", "payment source", "payee", and "purchase amount".

"Payment ID" indicates identification information for identifying a payment. "Date and time information" indicates the date and time when the payment was made. “Payment source” indicates the payment source (user) by payment. “Payee” indicates the payee (store manager) for payment. “Purchase amount” indicates the amount paid by settlement.

In other words, in FIG. 5, the payment identified by the payment ID "SID #1" is performed at the date and time information "2018/10/12/10:25:15", the payment source is "user U1", and the payment destination is "user U1". An example is shown in which "store R2 (manager #2)" and the purchase amount are "1000 yen." An example will be shown in which the provider provides an advertisement with the attribute "disaster prevention goods" and the advertisement information with "advertisement information #1."

(About the user database 32)
The user database 32 stores user information regarding users. Here, an example of user information stored in the user database 32 will be explained using FIG. 6. FIG. 6 is a diagram illustrating an example of a payment database according to the embodiment. In the example of FIG. 6, the user database 32 has items such as "user ID", "attribute information", "log data", and "estimated context".

"User ID" indicates identification information for identifying a user. "Attribute information" indicates information such as the user's place of residence, demographic attributes, psychographic attributes, etc. based on the user's payment information obtained from the payment server 300 and various logs obtained from the log server 400. . “Log data” indicates various logs acquired from the log server 400. “Estimated context” indicates a context related to the user's purchase estimated based on the user's payment information obtained from the payment server 300, various logs obtained from the log server 400, and the like.

Note that the user database 32 may store the user's context estimated for each date and time or predetermined period (for example, one day, one week, one month) in the "estimated context" item. Further, the user database 32 may store, for each manager of the store, the context of the purchasing behavior of each user who has made a payment with the manager in the "estimated context" item.

That is, in FIG. 6, the attribute information of the user identified by the user ID "U1" is "attribute information #1", the log data is "log #1", and the estimated context is "estimated context #1". shows.

(About store database 33)
The store database 33 stores store information regarding stores. Here, an example of store information stored in the store database 33 will be explained using FIG. 7. FIG. 7 is a diagram illustrating an example of a store database according to the embodiment. In the example of FIG. 7, the store database 33 has items such as "store ID", "location", "average purchase amount", and "category".

"Store ID" indicates identification information for identifying a store. “Location” indicates the location of the store. "Average purchase amount" indicates the average purchase amount of users who use the store. “Category” indicates the category of transactions handled by the store.

In other words, in FIG. 7, an example is shown in which the location of the store identified by the store ID "store R1" is "area #1", the average purchase amount is "1000 yen", and the category of transactions handled is "category #1". show.

(About the control unit 40)
The control unit 40 is a controller, and various programs stored in the storage device inside the information providing device 10 use the RAM as a work area by, for example, a CPU (Central Processing Unit) or an MPU (Micro Processing Unit). This is achieved by executing as . Further, the control unit 40 is a controller, and is realized by, for example, an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array). As shown in FIG. 4, the control unit 40 according to the embodiment includes an acquisition unit 41, an estimation unit 42, a specification unit 43, a determination unit 44, and an output unit 45, and performs information processing described below. To realize or carry out the functions and actions of

(About the acquisition unit 41)
The acquisition unit 41 acquires payment information indicating a payment between the user of the terminal device that read the code and the person corresponding to the code. For example, in the example of FIG. 2, the acquisition unit 41 acquires payment information from the payment server 300 and stores it in the payment database 31. In the example of FIG. 2, the acquisition unit 41 acquires various user logs from the log server 400 and stores them in the user database 32.

(About the estimation unit 42)
The estimating unit 42 estimates the context of the purchasing behavior of the user who made the payment with the corresponding person. For example, the estimating unit 42 estimates the trend of the context regarding the user's purchase based on the user's payment information and various logs, and stores it in the user database 32. Specifically, the estimating unit 42 calculates the main purchasing area indicating the area where the user performs purchasing activities, the main purchasing target indicating the category of the transaction object that the user mainly purchases, and the main purchasing area indicating the area where the user purchases the transaction object. The main purchase amount indicating the average total amount at the time of purchase, the user's status at the time of purchasing (for example, the user's behavior status), etc. are estimated.

Furthermore, the estimating unit 42 may estimate the tendency of the context of the user's purchasing behavior for each user who has made a payment with the corresponding person. For example, in the example of FIG. 2, the estimating unit 42 estimates the tendency of the context regarding purchase for each user who uses code payment.

Furthermore, the estimating unit 42 may estimate, for each user who has made a payment with the corresponding person, the context of the act in which the user purchases a transaction object from the corresponding person. For example, the estimating unit 42 estimates the context of the purchasing behavior of each user of the store managed by the corresponding person, based on the payment information of each user who has made a payment with the corresponding person and various logs.

Furthermore, the estimating unit 42 may estimate trends in the context of purchasing behavior of a group of users who have a predetermined relationship among the users who have made payments with the correspondent. For example, the estimating unit 42 may select a group of users who live in the same area, a group of users who have viewed the same or similar content, a group of users who have performed the same or similar searches, and a group of users who have made payments with the correspondent. Estimate trends in the context of purchasing behavior, such as a group of users who entered a query or a group of users with similar attributes.

(About the specific part 43)
The identifying unit 43 identifies abnormalities in payments between the user and the corresponding person based on trends in the context of the user's purchasing behavior. For example, in the example of FIG. 2, the specifying unit 43 specifies, among the payment information of the user U, payment information related to purchasing behavior that does not match the content of the estimated context as abnormal payment information.

In addition, if the tendency of the context of the user's purchasing behavior and the context of the user's behavior of purchasing a transaction object from the corresponding person do not match, the identifying unit 43 determines whether the user and the corresponding person are It may be determined that there is an abnormality in the payment. For example, in the example of FIG. 2, the specifying unit 43 specifies payment information #1 whose context does not match the main purchasing area and main purchasing object of the user U as an abnormal payment.

In addition, if the transaction object that the user is estimated to purchase from the correspondent and the transaction object indicated by the payment information and that the user actually purchased from the correspondent do not match, the identification unit 43 , it may be determined that there is an abnormality in the payment between the user and the correspondent. For example, the identification unit 43 estimates that the user will purchase from the correspondent based on various logs such as the browsing history in the e-commerce service and the history of input search queries, as well as the category of the transaction object handled by the correspondent. If the transaction object received by the user does not match the transaction object actually purchased by the user from the corresponding person, it is determined that there is an abnormality in the payment between the user and the corresponding person.

In addition, if the regional trend of the store where the user purchases the transaction object and the area where the corresponding person is located do not match, the identification unit 43 determines that there is an abnormality in the payment between the user and the corresponding person. You may judge. For example, in the example of FIG. 2, the specifying unit 43 selects, among the payment information of the user U, the payment information # related to the payment to the store R2 located in the region #2, which is different from the main purchasing region "region #1" of the user U. 1 is identified as an abnormal payment.

Further, the identification unit 43 identifies the user and the corresponding person based on the consistency between the tendency of the context of the predetermined user's purchasing act and the context of the act of purchasing a transaction object by the user from the corresponding person. may identify any anomalies in settlements during the period. For example, the identification unit 43 identifies abnormal payments from each user's payment information based on the tendency of the context of each user's purchasing behavior.

Further, the identification unit 43 determines whether there is an abnormality in the payment between the user and the corresponding person based on the consistency of the context tendency and the context of the act of a predetermined user purchasing a transaction object from the corresponding person. may be specified. For example, the identification unit 43 identifies trends in the context of purchasing behavior of each user who has made a payment with a predetermined correspondent, and the context of an act in which a predetermined user purchases a transaction object from the predetermined correspondent. An abnormality in the payment between the predetermined user and the predetermined correspondent is identified based on the consistency with the predetermined user and the predetermined correspondent. For example, in the example of FIG. 2, the specifying unit 43 selects a payment method in which the difference between the purchase amount paid to the store manager and the average purchase amount of the store is equal to or more than a predetermined threshold value in the payment information of the user U. The payment information related to the payment is identified as an abnormal payment.

In addition, the identification unit 43 determines whether the purchase activity of a predetermined user group is consistent with the context of an activity in which a user belonging to the user group purchases a transaction object from a corresponding person. Anomalies in payments between users and responders may be identified. For example, assume that the estimating unit 42 estimates that the usage of store A corresponding to the content is a trend in the context of purchasing behavior of user group #1 who viewed a predetermined content. In this case, even if a user belonging to user group #1 has a main purchasing area that is different from the area where store A is located, the identification unit 43 will determine whether or not store A or Payments made to stores in the area where store A is located are not identified as abnormal payments. Furthermore, for example, the estimation unit 42 may estimate that the usage of store B in the area is a trend in the context of purchasing behavior of user group #2 who resides in the same area and has similar attributes. do. In this case, the identification unit 43 identifies a payment to a store different from store B (for example, a store in the same category as store B) among the payment information of users belonging to user group #2 as an abnormal payment.

(About the determination unit 44)
The determination unit 44 determines the seller who actually sold the transaction object to the user based on the context of the purchase behavior of the user who has an abnormality in payment with the corresponding person. For example, in the example shown in FIG. 2, the determination unit 44 determines that the manager of a store that is located in the main purchasing area "area #1" of user U and that uses code payment is the actual transaction target for the user. It is determined that the seller is the one who sold the.

(About the output section 45)
If the abnormality identified by the identifying unit 43 satisfies a predetermined condition, the output unit 45 outputs fraud information indicating that there is fraud in the payment regarding the corresponding person. For example, in the example of FIG. 2, if the abnormality of the store satisfies a predetermined condition, the output unit 45 outputs fraud information to the payment server 300 indicating that there is fraud by the manager of the store.

Further, the output unit 45 may output fraud information when the accumulation of abnormalities exceeds a predetermined threshold. For example, in the example shown in FIG. 2, when the accumulation of abnormalities at a store satisfies a predetermined condition, the output unit 45 outputs fraud information indicating that there is fraud by the manager of the store.

Further, the output unit 45 may output fraud information when the cumulative number of users whose payments with the counterparty are abnormal exceeds a predetermined threshold. For example, when the ratio of the cumulative number of users whose payments have an abnormality to the number of users who make payments with the corresponding person is equal to or higher than a predetermined threshold, the output unit 45 outputs the information to the corresponding person. Outputs fraud information indicating that there is fraud in the related payment.

Further, the output unit 45 may output fraud information when the cumulative amount of payments made with the corresponding party is over a predetermined threshold. For example, if the ratio of the payment amount due to the payment with the abnormality to the payment amount paid to the responder due to the settlement with the user is equal to or higher than a predetermined threshold, the output unit 45 outputs the information to the responder. Outputs fraud information indicating that there is fraud in the related payment.

In addition, if the time-series change in the payment with an abnormality among the payments with the corresponding person satisfies a predetermined condition, the output unit 45 outputs fraud information indicating that there is fraud in the payment regarding the corresponding person. may be output. For example, in the example of FIG. 2, the output unit 45 totals the number of abnormal payments made for each store, and stores stores where the cumulative number of abnormal payments made within a predetermined period is equal to or greater than a predetermined threshold. Outputs fraudulent information about the administrator.

The output unit 45 also outputs a value obtained by subtracting the number of payments with an abnormality among payments in the second period prior to the first period from the number of payments with an abnormality among the payments in the first period. If exceeds a predetermined threshold, fraud information indicating that there is fraud in the payment regarding the corresponding person may be output. For example, the output unit 45 totals the number of payments in which an abnormality exists for each predetermined period (for example, one week, one month), and calculates the number of payments in which an abnormality exists for each predetermined period (for example, one week, one month), and calculates the first Based on the number of payments with an abnormality among the payments in the period, the payment with an abnormality among the payments in the second period, which is the previous period before the current time and is the next closest period to the first period from the current time. If the value obtained by subtracting the number of times exceeds a predetermined threshold, fraud information is output.

The output unit 45 also outputs the number of payments with an abnormality among the payments made with the correspondent, and the number of payments with an abnormality among the payments with a similar person who is similar to the correspondent. If the difference exceeds a predetermined threshold, fraud information indicating that there is fraud in the payment regarding the corresponding person may be output. For example, the output unit 45 may display information about the number of payments with abnormalities among payments made with the corresponding person, and a manager (similar person) who manages a store located within a predetermined range from the store managed by the corresponding person. ), if the difference between the number of payments in which an abnormality exists and the number of payments in which an abnormality exists exceeds a predetermined threshold, fraud information indicating that fraud exists in the payment regarding the correspondent is output.

In addition, if the abnormality of the payment with the correspondent located in a predetermined region satisfies a predetermined condition, the output unit 45 outputs fraud information indicating that there is fraud in the payment with respect to the correspondent located in the region. may be output. For example, in a predetermined region, if the cumulative number of users who have an abnormality in payments with stores located in the region exceeds a predetermined threshold, the output unit 45 outputs Outputs fraud information to the effect that fraud is being committed against a store that does so.

Further, the output unit 45 may output fraud information indicating the seller and the corresponding person. For example, in the example of FIG. 2, the output unit 45 outputs fraud information indicating that there is fraud by the manager of store R2 against the manager of store R1, which is the store targeted for fraud.

Further, the output unit 45 may output fraud information indicating that the code corresponding to the seller has been changed to the code of the correspondent. For example, in the example of FIG. 2, the output unit 45 outputs fraud information indicating that the two-dimensional code corresponding to the manager of store R1 has been changed to the two-dimensional code corresponding to the manager of store R2.

Note that the output unit 45 may output the fraudulent information to the store terminal 200. Further, the output unit 45 may output control information for causing the store terminal 200 to output fraudulent information to the payment server 300.

[3. Output processing flow]
Here, the output processing procedure of the information providing apparatus 10 according to the embodiment will be explained using FIG. 8. FIG. 8 is a flowchart illustrating an example of an output processing procedure according to the embodiment.

As shown in FIG. 8, the information providing device 10 determines whether it is a predetermined estimation timing for estimating the context regarding the user's purchase (step S101). Here, if it is determined that it is not the estimated timing (step S101; No), the information providing device 10 waits until the estimated timing comes. On the other hand, if it is determined that it is the estimated timing (step S101; Yes), the information providing device 10 acquires various logs of the user (step S102).

Subsequently, the information providing device 10 estimates the context regarding the user's purchase (step S103). Subsequently, the information providing device 10 determines whether or not it is a predetermined determination timing for determining the abnormality of the user's payment (step S104). Here, if it is determined that it is not the determination timing (step S104; No), the information providing apparatus 10 waits until the determination timing comes. On the other hand, if it is determined that it is the determination timing (step S104; Yes), the information providing device 10 acquires payment information regarding the payment between the store manager and the user (step S105).

Subsequently, the information providing device 10 identifies the abnormality of the payment based on the context (step S106). Next, the information providing device 10 identifies a store where fraud is occurring (a store managed by a manager who has an abnormality in payment) based on the accumulation of the identified abnormalities (step S107). Subsequently, the information providing device 10 outputs information indicating the specified store (step S108), and ends the process.

[4. Modified example]
The embodiments described above are merely examples, and various modifications and applications are possible.

[4-1. About the code]
In the above embodiment, an example was shown in which the code is a two-dimensional code (for example, a QR code (registered trademark), a barcode, etc.), but the code is not limited to such an example, and the code can be used on a terminal used by a user. Any information can be used as long as it can be read by the device. For example, the code may be a personal identification number, a character string (password), or the like.

[4-2. About context]
In the above-described embodiment, an example was given in which the estimating unit 42 estimates the context such as the area where the user mainly makes purchases and the category of transaction objects that the user mainly purchases. The function is not limited to this configuration, and any context may be inferred. For example, the estimating unit 42 calculates, based on various user logs, the names of transaction objects that the user purchases on a daily basis, the brand names of transaction objects that the user prefers, chain stores that the user prefers, etc. It is also possible to estimate a context such as

[4-3. Regarding extraction of code characteristic information]
The configuration of the control unit of the information providing device 10 is not limited to the configuration shown in FIG. 4, and furthermore, the configuration of the control unit of the information providing device 10 is not limited to the configuration shown in FIG. It may also have an extraction section. The determining unit 44 may further determine the appropriateness of the code read by the terminal device based on the feature information extracted by the extracting unit.

For example, the extraction unit collects a code (hereinafter sometimes referred to as an “abnormal code”) read by the terminal device 100 when the abnormal payment identified by the identification unit 43 is performed. Then, the extraction unit extracts information indicating the responder (fraudulent person) corresponding to each collected abnormality code, information indicating the payee (transfer destination) for payment using the abnormality code, feature quantity of the abnormality code (for example, Extracts and manages feature information, including feature quantities (extracted by analyzing the code using image recognition technology, etc.).

Then, the determination unit 44 acquires the code read by the terminal device 100 when the user makes a payment, and determines the appropriateness of the code based on the characteristic information extracted by the extraction unit. Specifically, the determination unit 44 determines if the difference between the feature amount of the code read using the terminal device 100 at the store visited by the user and the feature amount of any abnormal code is within a predetermined threshold value. , the code read by the terminal device 100 is determined to be an abnormal code. Then, the output unit 45 outputs information to the terminal device 100 indicating that the code installed at the store visited by the user is fraudulent.

Note that the identification unit 43 may identify the abnormal payment from the payment information acquired by the acquisition unit 41 based on the feature information extracted by the extraction unit.

[5. effect〕
As described above, the information providing device 10 according to the embodiment includes the acquisition section 41 , the estimation section 42 , the identification section 43 , the determination section 44 , and the output section 45 . The acquisition unit 41 acquires payment information indicating a payment between the user of the terminal device that read the code and the person corresponding to the code. The estimating unit 42 estimates the context of the purchasing behavior of the user who made the payment with the corresponding person. The identifying unit 43 identifies abnormalities in payments between the user and the corresponding person based on trends in the context of the user's purchasing behavior. The determining unit 44 determines the seller who actually sold the transaction object to the user based on the context of the purchasing behavior of the user who has an abnormality in payment with the corresponding person. If the abnormality identified by the identifying unit 43 satisfies a predetermined condition, the output unit 45 outputs fraud information indicating that there is fraud in the payment regarding the corresponding person. Furthermore, the output unit 45 outputs fraud information indicating the seller and the corresponding person. Further, the output unit 45 outputs fraud information indicating that the code corresponding to the seller has been changed to the code of the correspondent.

As a result, the information providing device 10 according to the embodiment can identify fraud associated with changing a two-dimensional code based on the user's purchase context without requiring prior information registration, without sacrificing convenience. can prevent fraudulent payments.

Further, in the information providing device 10 according to the embodiment, the output unit 45 outputs fraud information when the accumulation of abnormality exceeds a predetermined threshold. Further, the output unit 45 outputs fraud information when the cumulative number of users whose payments with the counterparty are abnormal exceeds a predetermined threshold. In addition, the output unit 45 outputs fraud information when the cumulative amount of payments made with the corresponding party in which an abnormality exists exceeds a predetermined threshold. In addition, if the time-series change in the payment with an abnormality among the payments with the corresponding person satisfies a predetermined condition, the output unit 45 outputs fraud information indicating that there is fraud in the payment regarding the corresponding person. Output. The output unit 45 also outputs a value obtained by subtracting the number of payments with an abnormality among payments in the second period prior to the first period from the number of payments with an abnormality among the payments in the first period. If exceeds a predetermined threshold, fraud information indicating that there is fraud in the payment regarding the correspondent is output. The output unit 45 also outputs the number of payments with an abnormality among the payments made with the correspondent, and the number of payments with an abnormality among the payments with a similar person who is similar to the correspondent. If the difference exceeds a predetermined threshold, fraud information indicating that there is fraud in the payment regarding the correspondent is output. In addition, if the abnormality of the payment with the correspondent located in a predetermined region satisfies a predetermined condition, the output unit 45 outputs a message indicating that there is fraud in the payment with respect to the correspondent located in the region. Output information.

Thereby, the information providing device 10 according to the embodiment can output fraudulent information according to various conditions, and thus can prevent fraudulent payments that occur in various states.

Further, in the information providing device 10 according to the embodiment, for example, if the tendency of the context of the user's purchasing behavior and the context of the user's behavior of purchasing a transaction object from the correspondent do not match, , it is determined that there is an abnormality in the payment between the user and the correspondent. In addition, if the transaction object that the user is estimated to purchase from the corresponding person and the transaction object indicated by the payment information and that the user actually purchased from the target person do not match, the identification unit 43 , it is determined that there is an abnormality in the payment between the user and the correspondent. In addition, if the regional trend of the store where the user purchases the transaction object and the area where the corresponding person is located do not match, the identification unit 43 determines that there is an abnormality in the payment between the user and the corresponding person. judge. Furthermore, the estimating unit 42 estimates the tendency of the context of the user's purchasing behavior for each user who has made a payment with the corresponding person. Then, the identification unit 43 identifies the user and the corresponding person based on the consistency between the tendency of the context of the predetermined user's purchasing act and the context of the act of purchasing a transaction object by the user from the corresponding person. Identify settlement anomalies between Furthermore, the estimating unit 42 estimates, for each user who has made a payment with the corresponding person, the context of the act in which the user purchases a transaction object from the corresponding person. Then, the identification unit 43 determines whether there is an abnormality in the payment between the user and the corresponding person, based on the consistency between the tendency of the context and the context of the act of a predetermined user purchasing a transaction object from the corresponding person. Identify. Furthermore, the estimating unit 42 estimates trends in the context of purchasing behavior of a group of users who have a predetermined relationship among the users who have made payments with the correspondent. Then, the identification unit 43 determines the relevant behavior based on the consistency between the tendency of the context of the purchasing behavior of a predetermined user group and the context of the behavior of the user belonging to the user group purchasing the transaction object from the corresponding person. Identify anomalies in payments between users and responders.

Thereby, the information providing apparatus 10 according to the embodiment can identify payments that have abnormalities in various states, and thus can prevent fraudulent payments.

[6. Hardware configuration]
Further, the information providing apparatus 10 according to each of the embodiments described above is realized by, for example, a computer 1000 having a configuration as shown in FIG. The information providing device 10 will be described below as an example. FIG. 9 is a hardware configuration diagram showing an example of a computer that implements the functions of the information providing device. Computer 1000 has CPU 1100, ROM 1200, RAM 1300, HDD 1400, communication interface (I/F) 1500, input/output interface (I/F) 1600, and media interface (I/F) 1700.

CPU 1100 operates based on a program stored in ROM 1200 or HDD 1400, and controls each part. The ROM 1200 stores a boot program executed by the CPU 1100 when the computer 1000 is started, programs depending on the hardware of the computer 1000, and the like.

The HDD 1400 stores programs executed by the CPU 1100, data used by the programs, and the like. Communication interface 1500 receives data from other devices via communication network 500 (corresponding to network N in the embodiment) and sends it to CPU 1100, and also sends data generated by CPU 1100 to other devices via communication network 500. Send to device.

The CPU 1100 controls output devices such as a display and a printer, and input devices such as a keyboard and mouse via an input/output interface 1600. CPU 1100 obtains data from an input device via input/output interface 1600. Further, CPU 1100 outputs the generated data to an output device via input/output interface 1600.

Media interface 1700 reads programs or data stored in recording medium 1800 and provides them to CPU 1100 via RAM 1300. CPU 1100 loads this program from recording medium 1800 onto RAM 1300 via media interface 1700, and executes the loaded program. The recording medium 1800 is, for example, an optical recording medium such as a DVD (Digital Versatile Disc) or a PD (Phase change rewritable disk), a magneto-optical recording medium such as an MO (Magneto-Optical disk), a tape medium, a magnetic recording medium, or a semiconductor memory. etc.

For example, when the computer 1000 functions as the information providing device 10, the CPU 1100 of the computer 1000 realizes the functions of the control unit 40 by executing a program loaded onto the RAM 1300. Further, each data in the storage device of the information providing device 10 is stored in the HDD 1400. The CPU 1100 of the computer 1000 reads these programs from the recording medium 1800 and executes them, but as another example, these programs may be acquired from another device via a predetermined communication network.

[7. others〕
Some of the embodiments of the present application have been described above in detail based on the drawings, but these are merely examples, and various modifications and variations may be made based on the knowledge of those skilled in the art, including the embodiments described in the disclosure section of the invention. It is possible to carry out the invention in other forms with modifications.

Further, the configuration of the information providing apparatus 10 described above can be changed flexibly, such as implementing some functions by calling an external platform or the like using an API (Application Programming Interface), network computing, or the like.

Further, the "unit" described in the claims can be read as "means", "circuit", etc. For example, the acquisition unit can be read as an acquisition means or an acquisition circuit.

10 information providing device 20 communication unit 30 storage unit 31 payment database 32 user database 33 store database 40 control unit 41 acquisition unit 42 estimation unit 43 identification unit 44 determination unit 45 output unit 100 terminal device 200 store terminal 300 payment server 400 log server

Claims (20)

an acquisition unit that acquires payment information indicating a payment between the user of the terminal device that read the code and the person corresponding to the code;
an identification unit that identifies an abnormality in the payment between the user and the corresponding person based on a trend in the context of the user's purchasing behavior;
An output device comprising: an output section that outputs fraud information indicating that fraud exists in the payment regarding the correspondent when the abnormality identified by the identification section satisfies a predetermined condition. The output section is
The output device according to claim 1, wherein the fraud information is output when the accumulation of abnormalities exceeds a predetermined threshold. The output section is
The output device according to claim 2, wherein the fraudulent information is output when the cumulative number of users whose payments with the correspondent have an abnormality exceeds a predetermined threshold. The output section is
4. The fraudulent information is output when the accumulated amount of payments due to abnormal payments among the payments with the correspondent exceeds a predetermined threshold. Output device. The output section is
If a time-series change in a payment with an abnormality among payments with the corresponding party satisfies a predetermined condition, fraud information indicating that there is fraud in the payment regarding the corresponding party is output. The output device according to any one of claims 1 to 4. The output section is
The value obtained by subtracting the number of payments with an abnormality among the payments in the second period prior to the first period from the number of payments with an abnormality among the payments in the first period exceeds a predetermined threshold. 6. The output device according to claim 5, wherein, if the payment is fraudulent, the output device outputs fraud information indicating that there is fraud in the payment regarding the correspondent. The output section is
The predetermined value is calculated by subtracting the number of payments with an abnormality between the corresponding person and a similar person from the number of payments with an abnormality among the payments with the corresponding person. The output device according to claim 5 or 6, wherein when the threshold value is exceeded, fraud information indicating that fraud exists in the payment regarding the correspondent is outputted. The output section is
If an abnormality in a payment with the correspondent located in a predetermined region satisfies predetermined conditions, fraudulent information indicating that there is fraud in the payment with respect to the correspondent located in the region is output. The output device according to any one of claims 1 to 7, characterized in that: The specific part is
If the trend of the context of the user's purchasing behavior does not match the context of the user's purchase of the transaction object from the corresponding party, there is an abnormality in the payment between the user and the corresponding party. The output device according to any one of claims 1 to 8, characterized in that it is determined that the output device exists. The specific part is
If the transaction object that the user is presumed to purchase from the corresponding person and the transaction object indicated by the payment information that the user actually purchased from the corresponding person do not match, The output device according to claim 9, wherein the output device determines that there is an abnormality in the payment between the user and the correspondent. The specific part is
If the trend of the area of the store where the user purchases the transaction object and the area where the corresponding person is located, it is determined that there is an abnormality in the payment between the user and the corresponding person. The output device according to claim 9 or 10. The output device according to any one of claims 1 to 11, further comprising: an estimating unit that estimates the context of a purchasing action of a user who has made a payment with the corresponding person. The estimation unit is
For each user who has made a payment with the corresponding person, the identifying unit estimates a trend in the context of the user's purchasing behavior;
Based on the consistency of the context of a given user's purchasing behavior and the context of the user's purchase of a transaction object from the corresponding party, settlement of payments between the user and the corresponding party is determined. The output device according to claim 12, wherein the output device specifies abnormality. The estimation unit is
For each user who has made a payment with the correspondent, the identification unit estimates the context of the act in which the user purchases a transaction object from the correspondent;
Identifying an abnormality in the payment between the user and the corresponding person based on the consistency between the tendency of the context and the context of the act of the predetermined user purchasing a transaction object from the corresponding person. The output device according to claim 12 or 13, characterized in that: The estimation unit is
Estimating trends in the context of purchasing behavior of a group of users who have a predetermined relationship among the users who have made payments with the corresponding person,
The specific part is
Based on the consistency between the tendency of the context of purchasing behavior of a predetermined user group and the context of the behavior of a user belonging to the user group to purchase a transaction object from the corresponding person, the user and the corresponding person The output device according to any one of claims 12 to 14, wherein the output device identifies an abnormality in a payment between the two parties. further comprising a determination unit that determines the seller who actually sold the transaction object to the user based on the context of the purchase behavior of the user who has an abnormality in payment with the corresponding person;
The output section is
The output device according to any one of claims 1 to 15, wherein the output device outputs fraudulent information indicating the seller and the corresponding person. The output section is
17. The output device according to claim 16, wherein the output device outputs fraudulent information indicating that a code corresponding to the seller has been changed to a code of the correspondent. further comprising an extraction unit that extracts characteristic information indicating characteristics related to the code read by the terminal device when making a payment with an abnormality,
The determination unit includes:
The output device according to claim 16 or 17, further comprising determining the appropriateness of the code read by the terminal device based on the feature information extracted by the extraction unit. An output method performed by an output device, the output method comprising:
an acquisition step of acquiring payment information indicating a payment between the user of the terminal device that read the code and the person corresponding to the code;
an identification step of identifying an abnormality in the payment between the user and the corresponding person based on a trend in the context of the user's purchasing behavior;
If the abnormality identified in the identification step satisfies a predetermined condition, an outputting step of outputting fraud information indicating that fraud exists in the payment regarding the corresponding person. an acquisition procedure for acquiring payment information indicating a payment between the user of the terminal device that read the code and the person corresponding to the code;
an identification procedure for identifying an abnormality in a payment between the user and the corresponding person based on trends in the context of the user's purchasing behavior;
an output procedure for outputting fraud information indicating that fraud exists in the payment regarding the correspondent when the abnormality identified by the identification procedure satisfies a predetermined condition; and an output program for causing a computer to execute the following steps.

Images