KR102549112B1 - Fraud detection system and method for treasury using terminal devices - Google Patents

Abstract

The vault abnormal transaction detection system includes a collection module configured to receive one or more financial business data related to money management business from one or more devices associated with an institution; a detection module configured to extract abnormal transaction data corresponding to at least one of a transaction amount and a transaction type preset for the institution from the one or more financial business data, based on preset detection criterion information; and a notification module configured to transmit notification information corresponding to the abnormal transaction data to a terminal device of a user of the institution, based on preset notification rule information. Using the vault abnormal transaction detection system configured as described above, when an abnormal transaction outside the usual category, such as a large amount deposit and withdrawal transaction, occurs in the vault business of an institution such as an administrative agency, it is detected and notified to the administrator in real time, Internal control functions can be easily implemented.

Description

Vault abnormal transaction detection system and method using a terminal device {FRAUD DETECTION SYSTEM AND METHOD FOR TREASURY USING TERMINAL DEVICES}

Embodiments are directed to a vault abnormal transaction detection system and method. More specifically, the embodiments relate to a technology for strengthening institutional internal control over vault transactions by detecting an abnormal financial transaction related to vault business and notifying it to a user's terminal device, such as a pre-designated accountant of the institution.

There is a safe system as a system to handle fund management tasks such as withdrawal and withdrawal of cash or securities of the central and local governments, and tax collection. The safe is for the head of a local government to handle other fund management, operation, and/or procurement, such as disbursement and storage of cash under its jurisdiction and securities belonging to or in its custody, receipt of various revenues, payment of expenditures, etc. It refers to financial institutions such as banks designated in the form of an agreement, and financial institutions designated as safe banks handle and operate safe funds at the request of the government or local government and report the related status.

For example, as a prior art related to the vault system, Laid-Open Patent Publication No. 10-2015-0123079 discloses a local government system such as a standard cleaning system and financial system that is distributed and operated by accounting and/or departments, and the funds of the vault bank financial system. Initiate a local integrated financial management system linked with information.

However, recent cases of embezzlement of large and small public funds frequently occur in local governments, etc., and the scale of the accident is increasing to the extent that the embezzled public funds range from billions of won to hundreds of billions of won. In the case of embezzlement of public funds, criminals often spend a significant portion of the embezzlement in investments such as stocks, derivatives, and virtual currencies, or spend it in gambling, making it difficult to recover the amount of damage. Therefore, it is necessary to strengthen internal control to prevent misuse and misappropriation of public funds managed in the safes of administrative agencies and to improve the management and supervision system for public funds.

Patent Publication No. 10-2015-0123079

According to one aspect of the present invention, in the vault business of institutions such as local governments, if an abnormal transaction outside the usual category, such as a large amount deposit and withdrawal transaction, occurs, the vault abnormal transaction that can implement a monitoring function that notifies the manager in real time A detection system and a safe transaction detection method can be provided.

A vault abnormal transaction detection system according to an aspect of the present invention includes a collection module configured to receive one or more financial business data related to money management business from one or more devices related to an institution; a detection module configured to extract abnormal transaction data corresponding to at least one of a transaction amount and a transaction type preset for the institution from the one or more financial business data, based on preset detection criterion information; and a notification module, configured to transmit notification information corresponding to the abnormal transaction data to a terminal device of a user of the institution, based on preset notification rule information.

In an embodiment, the collection module is further configured to receive, from the one or more devices, evidence data related to the money management task, or generate the evidence data through communication with the one or more devices.

In one embodiment, the evidentiary data includes official information of the institution indicating that the financial business has been normally approved in advance by the institution.

In one embodiment, the official document information includes electronic payment information by the institution or an authorized member of the institution.

In one embodiment, the electronic payment information includes public authentication or joint authentication information as payment information of the institution or an authorized member of the institution for the official document.

In one embodiment, the detection module analyzes the official document information to detect forgery or falsification, thereby detecting or supporting the detection of an abnormal transaction related to the financial business data.

In an embodiment, the notification module is further configured to send the evidence data to the terminal device.

In one embodiment, the notification module, when the pre-approval information corresponding to the transaction request data is received, requests the unit task server to execute the transaction corresponding to the transaction request data in response to receiving the pre-approval information. and to transmit post-approval request data of the transaction request data to a terminal of an authorized user of the institution before the financial transaction is completed when the financial transaction proceeds without the pre-approval information.

In one embodiment, the detection module may include financial business data having a transaction amount greater than or equal to a preset amount, financial business data including a change to a transaction account or notification target, financial business data including a change in service subscription, and It is further configured to detect, as the abnormal transaction data, financial business data received from a server other than the set unit business server or repeated transactions of a preset transaction type.

A method for detecting abnormal transaction transactions in a vault according to an aspect of the present invention includes storing, in a system for detecting abnormal transaction transactions in a vault, preset detection criteria information and notification rule information corresponding to an institution; receiving, by the vault abnormal transaction detection system, one or more financial business data related to money management business from one or more devices associated with an institution; extracting, by the vault abnormal transaction detection system, abnormal transaction data corresponding to at least one of a transaction amount and a transaction type preset for the institution based on the detection reference information; and transmitting, by the safe and abnormal transaction detection system, notification information corresponding to the abnormal transaction data to a terminal device of a user of the institution, based on the notification rule information.

In the vault abnormal transaction detection method according to an embodiment, the vault abnormal transaction detection system receives evidence data related to the money management task from the one or more devices or transmits the evidence data through communication with the one or more devices. It further includes the step of generating.

In one embodiment, the evidentiary data includes official information of the institution indicating that the financial business has been normally approved in advance by the institution. At this time, the step of extracting the abnormal transaction data includes the step of allowing the vault abnormal transaction detection system to analyze the official document information to detect forgery or falsification, thereby detecting or supporting the detection of an abnormal transaction related to the financial business data. .

The safe depository abnormal transaction detection method according to an embodiment further includes transmitting, by the safe deposit box abnormal transaction detection system, the evidence data to the terminal device.

In the vault abnormal transaction detection method according to an embodiment, when the vault abnormal transaction detection system receives pre-approval information corresponding to transaction request data, the transaction is sent to the unit business server in response to the pre-approval information being received. requesting execution of a transaction corresponding to the requested data; and transmitting, by the vault abnormal transaction detection system, post-approval request data of the transaction request data to a terminal of an authorized user of the institution before the financial transaction is completed, when the financial transaction proceeds without the pre-approval information. do.

In one embodiment, in the step of extracting the abnormal transaction data, the vault abnormal transaction detection system includes financial business data having a transaction amount greater than a preset amount, financial business data including a change to a transaction account or notification target, and extracting financial business data including a change in service subscription, financial business data received from a server other than a preset unit business server, or repeated transactions of a preset transaction type as the abnormal transaction data.

According to the vault abnormal transaction detection system and method according to one aspect of the present invention, it is possible to detect abnormal transactions outside the usual category, such as large deposit and withdrawal transactions, in handling vault business of institutions such as local governments, and to detect abnormal transactions. If detected, it is notified to the terminal device of the user, such as the accountant of the institution, so that the institution's strong internal control over financial transactions related to the safe account can be realized.

In addition, since the vault abnormal transaction detection system according to one aspect of the present invention may be implemented in the system of the vault financial institution or implemented to communicate with the vault financial institution system, even if the institution does not build a separate system of its own, the existing vault bank It has the advantage of being able to quickly and efficiently implement and operate internal control functions through the infrastructure.

1 is a conceptual diagram illustrating a work environment in which a safe and abnormal transaction detection system operates according to an embodiment.
2 is a block diagram showing the hardware configuration of a safe and abnormal transaction detection system according to an embodiment.
3 is a schematic block diagram of a safe and abnormal transaction detection system according to an embodiment.
4A and 4B are flowcharts illustrating each step of a method for detecting an abnormal transaction in a vault according to embodiments.
5A and 5B are flowcharts illustrating each step of a method for detecting an abnormal transaction in a safe according to other embodiments.
6 is a flowchart illustrating a process of managing detection and notification rules in a method for detecting abnormal transaction in a vault according to an embodiment.
7 is a flowchart illustrating a process of transmitting audit information on an abnormal transaction to an institution in a safe depository abnormal transaction detection method according to an embodiment.

Hereinafter, with reference to the drawings, look at the embodiments of the present invention in detail.

1 is a conceptual diagram illustrating a work environment in which a safe and abnormal transaction detection system operates according to an embodiment.

Referring to FIG. 1, a person in charge of an institution 500 who wants to use the vault abnormal transaction detection service may subscribe himself or his/her institution to the abnormal transaction detection service provided by the vault abnormal transaction detection system 2 as a member. there is. For example, the person in charge of the institution 500 may subscribe to the vault abnormal transaction detection service through the branch office 400 of the financial institution corresponding to the vault bank of the institution. One subscription information may be transmitted to the vault abnormal transaction detection system 2 .

In this specification, an institution means an administrative institution or other type of institution that uses a vault system. At this time, administrative agencies refer to the government or local governments and their sub-organizations or public corporations, and educational administrative agencies are also intended to be included therein. For example, educational administrative agencies such as national metropolitan organizations or basic organizations, local public corporations, metropolitan and provincial offices of education, local offices of education, and their direct institutions or schools may correspond to the administrative agencies in this specification. In addition, the organization of this specification may be other different types of organizations such as corporations, associations, and organizations other than administrative agencies.

In addition, in this specification, the vault financial institution refers to a vault bank selected as a designated financial institution that manages the institution's funds in the form of a vault, and the branch 400 is an online or offline business operated and managed by the vault financial institution. means window.

The vault abnormal transaction detection system 2 according to embodiments may receive financial business data related to money management of an institution subscribed to the vault abnormal transaction detection service from one or more devices associated with the institution. In the example shown in FIG. 1 , the vault abnormal transaction detection system 2 may receive financial business data from one or more unit business servers 1 of a vault financial institution. At this time, the unit business server 1 is a device that supports electronic processing of the vault business of the vault financial institution, and may mean, for example, a bank's business server. The unit business server 1 may include components required for business processing in a conventional vault bank, such as an application execution server and database (database) of a safe financial institution, and a forgery prevention and payment system.

In the embodiments, the vault abnormal transaction detection system 2 stores information on the terminal device 3 of the person in charge of the institution 500 who has joined as a member, and among the financial business data received from the unit business server 1, in advance When a set abnormal transaction is detected, it is configured to notify the terminal device 3 of information about it. For example, the terminal device 3 is a device used by an accountant of an institution, etc., and may be a mobile communication terminal such as a smartphone, but is not limited thereto. The accountant can check the occurrence and details of an abnormal transaction by using notification information received in the form of a text message (SMS, MMS, etc.) and/or a push notification through an application to the terminal device 3 .

For the above operation, in one embodiment, the vault abnormal transaction detection system 2 communicates with an application (or app) running on the terminal device 3 to enable the operation of the application service server (application service server) may be performed at least partially. Alternatively, the vault abnormal transaction detection system 2 may include one or more web servers and/or one or more web application servers that communicate with and operate applications running on the terminal device 3. there is.

However, this is just an example, and in another embodiment, notification of an abnormal transaction may be made using other communication means such as a text message rather than through a separate application.

In one embodiment, the vault abnormal transaction detection system 2 is configured to further communicate with the server 6 of the institution to which the person in charge 500 belongs. The institution server (6) refers to the institution's business processing system, which provides electronic information on administrative and financial affairs of national metropolitan organizations, local organizations, local public enterprises, metropolitan and provincial offices of education, and local offices of education and their direct subordinate institutions or schools. Indicates the device used for processing. For example, in the case of Korea, financial information system or tax information system (e-Hojo), local public enterprise budget accounting system (LOBAS), management accounting system of educational administrative institutions such as edufine, education administration information such as NEIS A device in which the system or the like is implemented may correspond to the institution server 6, but is not limited thereto.

In one embodiment, the vault abnormal transaction detection system 2 collects abnormal transaction data detected from the financial business data received from the unit business server 1 at regular time intervals, and provides audit information therefor to the institution server 6. can transmit In addition, in one embodiment, the vault abnormal transaction detection system 2 includes detection criterion information set for each institution to detect abnormal transaction, user information indicating the organization, rank, authority, and personal information of users belonging to each institution, and /or it may be configured to further communicate with the institution server 6 to receive notification rule information defining users to be notified of when an abnormal transaction is detected.

For the above series of operations, the vault abnormal transaction detection system 2 connects the unit task server 1 of the vault financial institution, the terminal device 3 of the institution manager 500 and/or the institution server 6 through the communication network. It can be configured to communicate with. In this specification, a communication network refers to a wired and/or wireless network corresponding to a general communication network, and may be implemented using any communication method capable of networking between objects and objects, and includes wired communication, wireless communication, 3G, It is not limited to 4G or other methods.

In one embodiment, the vault abnormal transaction detection system 2 may be at least partially communicably connected to a closed network (eg, an administrative network such as an administrative network for education) for communication between institutions for communication with the institution server 6. there is. In addition, in one embodiment, the safe and abnormal transaction detection system 2 is configured to transmit information about the terminal device 3 and receive information from the terminal device 3 by using one or a plurality of servers, for example, an external platform (not shown). ) or a payment system (not shown) and the like may be further configured to communicate.

The devices described herein may be entirely hardware, or may have aspects that are part hardware and part software. For example, the vault abnormal transaction detection system 2 according to the embodiments and each system, device, server, and unit included in the system communicating therewith exchange data of a specific format and content in an electronic communication method. Devices and software related thereto may be collectively referred to. In this specification, terms such as "unit", "module", "server", "system", "platform", "device" or "terminal" refer to a combination of hardware and software driven by the hardware. it is intended to For example, the hardware herein may be a data processing device including a CPU or other processor. Also, software driven by hardware may refer to a running process, an object, an executable file, a thread of execution, a program, and the like.

2 is a block diagram showing the hardware configuration of a safe and abnormal transaction detection system according to an embodiment.

Referring to FIGS. 1 and 2 , the hardware 200 constituting the safe and abnormal transaction detection system according to the embodiments may be implemented as a computing device including one or more hardware components. At this time, the hardware 200 may include a memory 210 , a processor 220 and a communication module 230 . In one embodiment, the hardware 200 may further include an input/output unit 240 .

The memory 210 is a non-temporary computer-readable recording medium, and is a non-perishable large-capacity memory such as RAM (random access memory), ROM (read only memory), disk drive, SSD (solid state drive), flash memory, and the like. A permanent mass storage device may be included. Here, a non-perishable mass storage device such as a ROM, SSD, flash memory, disk drive, etc. may be included in the above-described device or server as a separate permanent storage device distinct from the memory 210 .

In addition, the memory 210 may store an operating system and at least one program code (for example, a code for executing an application installed and driven on a server or a user device). These software components may be loaded from a computer-readable recording medium separate from the memory 210 . The separate computer-readable recording medium may include a computer-readable recording medium such as a floppy drive, a disk, a tape, a DVD/CD-ROM drive, and a memory card.

In another embodiment, software components may be loaded into the memory 210 through the communication module 230 rather than a computer-readable recording medium. For example, the at least one program is memory based on a computer program installed by files provided by developers or a file distribution system (for example, a commercial application store service server) that distributes installation files of applications through a network. (210).

The processor 220 may be configured to process commands of a computer program by performing basic arithmetic, logic, and input/output operations. Instructions may be provided to processor 220 by memory 210 or communication module 230 . For example, processor 220 may be configured to execute received instructions according to program codes stored in a recording device such as memory 210 .

The communication module 230 may provide a function for the vault abnormal transaction detection system 2 to communicate with the unit task server 1, the terminal device 3, and/or the institution server 6 through a network. That is, the function of the communication module 230 is controlled by the processor 220 referring to the memory 210, thereby realizing the operation of each functional module to be described later with reference to FIG. 3.

The input/output unit 240 may be a means for interface with an external input/output device (not shown). For example, the external input device may include devices such as a keyboard, mouse, microphone, and camera, and the external output device may include devices such as a display, a speaker, and a haptic feedback device. As another example, the input/output unit 240 may be a means for interface with a device in which functions for input and output are integrated into one, such as a touch screen.

Also, in other embodiments, the hardware 200 may include more components than those shown in FIG. 2 depending on the nature of the device to which it is applied. For example, when the hardware 200 is applied to a user device, it is implemented to include at least some of the above-described input/output devices, or other devices such as transceivers, Global Positioning System (GPS) modules, cameras, various sensors, and databases. It may contain more components. As a more specific example, when the user device is a smartphone, various devices such as an acceleration sensor, a gyro sensor, a camera module, various physical buttons, buttons using a touch panel, input/output ports, and a vibrator for vibration are generally included in the smartphone. It may be implemented to include more components.

The safe deposit box abnormal transaction detection method described throughout this specification may be performed by the safe deposit box abnormal transaction detection system 2 implemented in the form of a computing device at least partially including the hardware 200 shown in FIG. 2 . In addition, the vault abnormal transaction detection service provided by the vault abnormal transaction detection system 2 is at least one of applications and other programs operated by the hardware 200 or based on a combination of the hardware 200 and software. It can be provided to the user based on. A user, such as an institutional administrator or accountant, may perform membership registration and registration of detection criteria for the vault abnormal transaction detection system 2, and the notification information transmitted by the vault abnormal transaction detection system 2 may be sent to the terminal device ( 3) can communicate with the vault abnormal transaction detection system 2 to receive.

FIG. 3 is a schematic block diagram of a vault abnormal transaction detection system according to an embodiment, which is implemented by the hardware 200 described above with reference to FIG. 2 or by a combination of the hardware 200 and software. represents one or more functional modules of the detection system 2 .

Referring to FIG. 3 , in one embodiment, the vault abnormal transaction detection system 2 includes a collection module 250 , a detection module 260 and a notification module 270 . In one embodiment, the safe and abnormal transaction detection system 2 may further include a database 280 for storing detection criteria information for detecting abnormal transaction and/or notification rule information for notification of abnormal transaction. Also, in one embodiment, the vault abnormal transaction detection system may further include an electronic payment module 290 for generating evidence data for transactions. Each of these modules 250, 260, 270, 280, 290 may be implemented at least in part using hardware 200 as described above with reference to FIG.

Each of the modules or DBs 250, 260, 270, 280, and 290 constituting the safe and abnormal transaction detection system 2 shown in FIG. 3 is not necessarily intended to refer to a physically separated and separate component. That is, in FIG. 3, each module or DB (250, 260, 270, 280, 290) constituting the vault abnormal transaction detection system 2 and detailed functional units (261-262) constituting them are distinguished from each other. Although shown as a separate block, it functionally divides the vault abnormal transaction detection system 2 by the operation executed by it. Depending on the embodiment, some or all of the above-described modules, DBs, or units may be integrated in the same device, or one or more modules, DBs, or units may be implemented as a separate device physically separated from other components. It could be. For example, each module, DB, or unit of the vault abnormal transaction detection system 2 may be components communicatively connected to each other under a distributed computing environment.

1 and 3, the collection module 250 of the vault abnormal transaction detection system 2 collects financial business data from one or more device related to the institution, for example, one or more unit business servers 1 of the vault financial institution. configured to receive In this case, the financial business data refers to transaction data related to the fund management business of the institution. In this specification, financial business or transaction is not necessarily limited to including the withdrawal or transfer of cash, and for example, in addition to account deposit and withdrawal transactions, opening of new accounts or closing of existing accounts, Change or deletion, subscription to an institution's financial services (eg, corporate internet, mobile banking, transfer service, etc.), change of transfer limit, cancellation, etc. may all fall under the financial business or transaction of this specification.

The detection module 260 serves to extract abnormal transaction data from financial business data according to preset detection criterion information 281 . In this case, the detection criteria information 281 is for identifying a transaction of a specific type and/or a transaction involving a specific transaction amount as an abnormal transaction according to a pre-set standard. The detection criterion information may be set in advance for each institution and stored in the DB 280 of the safe and abnormal transaction detection system 2 . For example, financial business data detected as an abnormal transaction includes financial business data having a transaction amount greater than a preset amount, financial business data including a change in a transaction account or notification target, and financial business data including a change in service subscription. It may be business data, financial business data received from a server other than the preset unit business server, or repeated transactions of a preset transaction type, which will be described in detail later.

In one embodiment, the detection module 260 may include a data extraction unit 261 for extracting abnormal transaction data by applying the detection criteria information 281 to financial business data.

In one embodiment, the collection module 250 transmits evidence data corresponding to financial business data (eg, a scanned image of an official document of an institution) to one or more devices related to the institution, such as the unit business server 1 and the institution server. (6) Alternatively, it can be further received from a terminal device of an organization user. Alternatively, the collection module 250 may generate evidence data by writing an official document through communication with a device related to an institution. In the process of generating evidence data, the electronic payment module 290 may receive authentication information of an authorized user of an institution to be combined with an official document. In this case, the detection module 260 may further include an image processing unit 262 configured to process evidence data corresponding to the financial business data detected as an abnormal transaction, classify the evidence data, or extract information therefrom.

The notification module 270 may transmit notification information corresponding to the abnormal transaction data detected by the detection module 260 to the terminal device 3 of the institution manager 500 based on notification rule information preset for the institution. . In one embodiment, user information 282 of users belonging to the institution is stored in the DB 280 of the vault abnormal transaction detection system 2, and based on this user information 282, abnormal transactions related to the vault business of the institution are detected. Notification rule information may be defined to set users to be notified. For example, the user information 282 may include organization information related to one or more users of an organization, department information, work authority information, and/or identification information capable of identifying a terminal device of each user.

In one embodiment, when evidence data corresponding to financial business data is received by the vault abnormal transaction detection system 2 or generated through the vault abnormal transaction detection system 2, the notification module 270 transmits such evidence data. It may be further transmitted to the terminal device 3 of the person in charge of the institution 500 . At this time, the notification module 270 may transmit evidence data for a transaction detected as an abnormal transaction among financial transactions executed after the financial transaction has already been executed to the terminal device 3 ex post facto, or the financial transaction is not yet executed. Evidence data for the financial transaction request detected as the previous abnormal transaction may be transmitted to the terminal device 3 to obtain prior approval for the financial transaction from the institution manager 500 . This will be described later in detail with reference to FIGS. 3 and 4 .

In one embodiment, the DB 280 of the vault abnormal transaction detection system 2 may further store transaction history information 283 including vault-related financial business data executed in the past. At this time, the transaction detail information 283 includes the type of transaction executed in the past, the transaction amount, identification information for identifying the person in charge of the institution 500 who was notified of or approved the transaction, and identification of the branch 400 requesting the transaction. Identification information for processing, supporting data received for the transaction, and the like may be included.

In this embodiment, the image processing unit 262 of the detection module 260 may perform abnormal transaction detection by comparing proof data received with respect to financial business data with past transaction history information 283 . The abnormality detection method using the evidence image may be used in parallel with this for the purpose of assisting the detection of abnormal transactions using the detection criteria information 281 . For example, the image processing unit 262 searches the transaction details information 283 for evidence data having a similarity with the currently received evidence data and a preset level or higher, and the same or similar evidence image from the past transaction details information 283. is searched, but if there is financial business data in which the type or amount of the transaction is different from the past transaction details, it can be detected as an abnormal transaction.

In one embodiment, the vault abnormal transaction detection system 2 further includes an electronic payment module 290 . The electronic payment module 290 provides a function for a general user, accountant, manager, etc. of the institution to access the vault abnormal transaction detection system 2 and prepare an official document to serve as evidence data for financial affairs or electronically authenticate it. . The electronic payment module 290 may provide a user interface through which a user accessing the vault abnormal transaction detection system 2 may prepare an official document or/or select a previously prepared official document form. The official document prepared by the user may be generated as evidence data through approval (eg, public certification or joint certification, etc.) by an authorized member of the institution (eg, an accountant, manager, etc.). This will be described later in detail with reference to FIG. 5B.

4A is a flowchart illustrating each step of a method for detecting an abnormal transaction in a vault according to an embodiment.

Referring to FIG. 4A, an institution that wants to use the vault abnormal transaction detection service provides detection criteria information for detecting abnormal transaction and notification rule information for notifying the person in charge when an abnormal transaction is detected, to the vault abnormal transaction detection system 2. It can be saved (S201). For example, a person in charge of accounting of an institution may access the vault abnormal transaction detection system 2 using his or her own terminal device 3 and set detection and notification rules. However, this is just an example, and the institution may set detection and notification rules in the vault abnormal transaction detection system 2 through a branch of the safe financial institution or in another different method.

The institution user 600 who wants to request a transaction related to the institution's safe account may visit a branch of the safe financial institution and request a transaction related to the safe business (S102). For example, the institution user 600 may be a public official belonging to each business department of the institution. In addition, at this time, the institutional user 600 may transmit evidence data for proving the authority to execute the vault business to the unit business server 1. For example, the supporting data may include a scan file of an official document transmitted internally between each department of the institution or transmitted by the institution to a safe and financial institution.

The vault financial institution's unit business server 1 executes the vault business-related transaction requested by the institution user 600 (S103), and transmits financial business data, which is information about the transaction, to the vault abnormal transaction detection system 2. It can be transmitted (S104). At this time, the financial business data may include the type and details of the transaction executed at the request of the institution, the transaction amount, and identification information of the user 600 requesting the transaction.

In the embodiment shown in FIG. 4A, the vault abnormal transaction detection system 2 receives financial business data from the business server 1 of the vault financial institution. However, this is just an example, and the vault abnormal transaction detection system 2 may receive financial business data from one or more arbitrary devices associated with an institution. For example, in one embodiment, as shown in FIG. 4B, when financial business data is transmitted from the business server 1 of the vault financial institution to the institution server 6, the institution server 6 detects an abnormal transaction in the vault ( 2) may transmit financial business data (S114).

In the embodiment shown in FIG. 4B, except for this step (S114), the operations of the remaining steps (S111 to S113, S115 to S117) are the same as the steps (S101 to S103, S105 to S107) of the embodiment shown in FIG. 4A, respectively. A detailed description of this is omitted.

Meanwhile, in another embodiment, the vault abnormal transaction detection system 2 may receive financial business data from a terminal device (not shown) (eg, a smartphone, a PC, etc.) of the institutional user 600 .

In the vault abnormal transaction detection system 2 receiving the financial business data, according to the detection criteria set in advance by the manager or accountant of the institution, among the financial business data received from the unit business server 1, abnormal transaction Corresponding ones can be detected (S105). For example, financial business data having a transaction amount greater than a preset amount, financial business data including a change to a transaction account or notification target, financial business data including a change to service subscription, and not a preset unit business server. A detection criterion may be set to extract financial business data received from other servers or repetitive transactions of a preset transaction type as abnormal transactions. In addition, since the detection criteria are set for each institution, the detection criteria may be different for each institution.

Table 1 below shows an example of detection criteria for detecting abnormal transactions.

Abnormal transaction type detection criteria Transactions over a certain amount - When the amount deposited or withdrawn is more than a preset amount (e.g., 10 million won at a time) account change transaction - When a new or canceled transaction occurs for an account of a pre-set account type (eg, general deposit) Change of notification recipient - When a new person in charge is registered, changed, or deleted (notified to the existing person in charge) Service change transaction - When subscribing to a pre-set risky service such as corporate Internet and mobile banking transfer service - When changing the transfer limit (increased amount, etc.) other than the vault
Over-the-counter transaction - When a transaction occurs at a branch (window) other than the pre-designated vault mother branch (branch)
- When repeating transactions using counters other than the safe store (occurs more than the specified number of times within the specified period, etc.) a certain kind
issue a certificate - When issuing pre-set certificates such as balance certificates
- When there is a request for additional issuance of certificates that are periodically issued in batches repeat transaction - When repeating a deposit transaction for a specific account (e.g., individual account) (more than a specified number of deposits within a specified period, etc.)
- In case of discrepancy in the transaction amount of a transaction that is repeated periodically (e.g., when a new subscription is different from the cancellation amount when a new subscription is made after the cancellation of a time deposit)

In Table 1, the risk service refers to a service that allows withdrawal through a route other than the branch of a safe and financial institution, for example, Internet banking and mobile banking services, but are not limited thereto.

In one embodiment, when it is necessary to execute an abnormal transaction as illustrated in Table 1 above, the institution requests transaction processing through the branch office of the vault financial institution, and when the transaction is requested without going through the branch office of the vault financial institution, Detection criteria can be set to detect abnormal transactions. For example, if an institution raises the deposit or withdrawal limit of a safe account, the institution must submit it in the form of an official document to the safe financial institution, and the transaction requested through a method other than this route can be detected as an abnormal transaction. there is.

Furthermore, in one embodiment, the detection criteria can be set to detect it as an abnormal transaction for the vault business requested through a route (eg, another branch) other than the vault financial institution-designated branch (mother branch) with relatively strict internal control. . Alternatively, when a transaction of the type illustrated in Table 1 occurs among vault services requested through a route other than the mother office, it is also possible to set detection criteria to detect it as an abnormal transaction.

Meanwhile, the abnormal transaction detection criteria that can be applied according to the embodiments of the present specification are not limited to the examples in Table 1 above. For example, in addition to account-based reception and electronic financial services among safe deposit boxes, abnormal transaction detection may be performed targeting credit card services based on safe deposit boxes or income and expenditure tasks performed through safe accounts. In this case, the vault financial institution that transmits the financial business data to the vault abnormal transaction detection system 2 is not limited to a bank and may be a credit card company or another type of financial institution.

In addition, in one embodiment, the abnormal transaction detection criteria are set in such a way that parameters for detecting abnormal transactions are automatically determined based on machine learning or deep learning in addition to the method of setting rules in advance. It is also possible to become

Furthermore, the abnormal transaction detection criteria applied through the vault abnormal transaction detection system 2 according to the embodiments may be continuously updated according to requests from institutions or safe financial institutions or cases of financial accidents.

When an abnormal transaction is detected, the vault abnormal transaction detection system 2 may extract financial business data corresponding to the abnormal transaction and transmit notification information about it to the terminal device 3 of the person in charge of the institution (S106). At this time, if there is evidential data such as an official document received from the institutional user 600 in relation to the corresponding financial business, the vault abnormal transaction detection system 2 may transmit the evidential data to the terminal device 3 together with notification information.

In another embodiment, the vault abnormal transaction detection system 2 may receive evidence data related to the vault business data from the institution server 6 (FIG. 1). For example, the institutional user 600 inputs a document identifier capable of identifying an official document of the institution corresponding thereto, such as a payment order number, when requesting a financial business to a safe financial institution, and the unit business server 1 of the safe financial institution may transmit the document identifier to the vault abnormal transaction detection system 2. Thereafter, in the vault abnormal transaction detection system 2, when the corresponding financial business is identified as an abnormal transaction, the institution server 6, which is the business system of the institution, is searched by using the document identifier such as the payment order number. ) may receive evidence data from.

In one embodiment, the vault abnormal transaction detection system 2 may further transmit notification information on the abnormal transaction to the institution server 6 . For example, when the vault abnormal transaction detection system 2 connects to an administrative network capable of communicating with the business system of an administrative agency and uploads notification information on an abnormal transaction, the person in charge of the administrative agency who is the subject of notification sends his or her own terminal device 3. It is also possible to check the notification of the abnormal transaction by using a method of accessing the institution server 6 using the transaction data.

Person in charge information for receiving notification when an abnormal transaction related to the vault business of the institution occurs may be set in the form of notification rule information for each institution and stored in the vault abnormal transaction detection system 2 . The vault abnormal transaction detection system 2 identifies the person in charge of the institution to be notified of the abnormal transaction and the terminal device 3 of the person in charge according to the notification rule information set in advance, and sends notification information to the corresponding terminal device 3. can transmit

In one embodiment, a person in charge of receiving notification of an abnormal transaction may be an accountant in charge of a vault of an institution. Alternatively, in another embodiment, a person in charge to be notified of an abnormal transaction may be set to a plurality of people. For example, store the user information of the person in charge of a plurality of institutions in the vault abnormal transaction detection system 2, and set the person in charge to be notified of the abnormal transaction for each transaction type of the abnormal transaction detected by the vault abnormal transaction detection system 2 It is also possible to do That is, different types of abnormal transactions may be notified to different persons in charge.

In another embodiment, a user of an institution may be a first user with a relatively higher rank or authority (eg, a manager) and a second user with a relatively lower rank or authority than the first user (eg, an accountant). According to the type of abnormal transaction detected by the vault abnormal transaction detection system 2, the target person to be notified of or the number of targets may be made different from each other. For example, for an abnormal transaction set to have a relatively low risk (eg, deposit and withdrawal of a certain amount or more), notification information is transmitted only to the second person in charge, but an abnormal transaction set to have a relatively high risk (eg, change of notification target, etc.) ), the notification rule may be configured to transmit notification information to the first person in charge or to transmit notification information to both the first person in charge and the second person in charge.

In one embodiment, the vault abnormal transaction detection system 2 extracts those corresponding to risky transactions again among the detected abnormal transactions, and further transmits evidence data to the terminal device 3 of the person in charge only when corresponding to risky transactions. may be configured. At this time, the risk transaction refers to a high-risk transaction that requires additional confirmation to verify whether an official document for evidence is forged or tampered with among the abnormal transactions described above. Transactions, etc. may fall under risky transactions, but are not limited thereto.

In one embodiment, the vault abnormal transaction detection system 2 may detect risky transactions by further using evidence data such as an official document scan file received from the institution user 600 . Evidence data may include an official document indicating that the financial fisherman was normally approved in advance by the institution and electronic payment information therefor. For example, the form of an official document transmitted by an institution for proof is shown in Table 2 below.

Sent title Change of SMS mobile phone number for vault abnormal transaction detection service notification 1. According to the personnel appointment on January 1, 2000, the recipients of SMS notifications have changed . We request the following changes . Please change them as soon as possible.

go. Change history buisnessman
Registration Number financial transaction
Provide information Send SMS text Before change) after change) spot
(name) Cell Phone spot
(name) Cell Phone 000-00-00000 agreement ○○
○○○ 010-0000-0000 ○○
○○○ 010-0000-0000 agreement ○○
○○○ 010-0000-0000 ○○
○○○ 010-0000-0000 Attachment: 1 copy of unique identification number . end. (Institution name) Chief (official seal)

In this case, the vault abnormal transaction detection system 2 may detect or support detection of abnormal transaction by analyzing evidence data. For example, the vault abnormal transaction detection system 2 may detect an abnormal transaction by detecting whether an official document of evidence data has been forged or altered. This detection operation may be performed by the vault abnormal transaction detection system 2, or may be performed by the vault abnormal transaction detection system 2 transmitting evidence data to a separate image processing server (not shown) or device. For example, the vault abnormal transaction detection system 2 may transmit the evidence data to the terminal device of the person in charge and receive a confirmation result as to whether or not the evidence data is abnormal from the person in charge as a response.

In one embodiment, the detection module 260 (FIG. 3) of the vault abnormal transaction detection system 2 includes an image processing unit 262 (FIG. 3) configured to specify a type of transaction by extracting a preset keyword from evidence data. can do. This extracts text data from image data through Optical Character Recognition (OCR), machine learning, and other arbitrary methods, and converts the extracted text data into a pre-built vault abnormal transaction detection system (2). It can be performed in a way of comparing terms with a dictionary for each transaction type. For example, in the example described in Table 2, words such as "SMS", "text", "mobile phone number", "notification", and "change" may be extracted as keywords defining transaction types.

In addition, the image extraction unit may further extract identification information for specifying an institution that is a subject of transaction from the evidence data. For example, the part where the name of the institution appears, such as "from" or the official seal column in an official document, and/or letters and/or numbers identifying the institution from "business registration number" or "unique number certificate" attachments (eg, unique number Or business registration number) can be extracted. Through a combination of institution identification information and transaction type keyword, the detection module 280 may identify the content of the transaction request indicated by the corresponding evidence data. In the example shown in Table 2, it can be confirmed through image data that a transaction called [Change of notification recipient] has been requested from an institution identified through [business registration number].

At this time, the vault abnormal transaction detection system 2 compares the content of the financial business data detected as an abnormal transaction with the content of the transaction defined based on the keywords and identification information extracted from the evidence data, and the content different from the evidence data. If there is financial business data corresponding to a transaction of , it can be determined as a risky transaction. Regarding the risky transaction detected in this way, evidence data may be transmitted to the person in charge of the institution or additional notices may be sent to the person in charge of the institution in addition to the notification of the abnormal transaction, so that the person in charge may verify whether the official document is forged or tampered with.

In addition, in one embodiment, the DB 280 (FIG. 3) of the vault abnormal transaction detection system 2 stores transaction detail information 283 (FIG. 3) including contents and supporting images of vault business for a certain period in the past. It is also possible to detect risky transactions by comparing the evidence data received along with the current vault business data with past transaction history information. For example, in comparison with the evidence data received for the currently detected abnormal transaction, if the same or a certain level or more similar evidence image was used in the past transaction details, the abnormal transaction may be classified as a risky transaction. At this time, whether the proof images are the same can be determined using identification information such as a hash value of the image file, and the similarity between the images can be determined through machine learning or any other image processing method.

As another example, the vault abnormal transaction detection system 2 extracts past vault business transaction details in which the same or a certain level or more similar evidence image to the evidence data of the currently detected abnormal transaction is used from the transaction details information, and the current detection If the transaction type of the detected abnormal transaction and the past transaction details are different or the transaction amount differs by more than a preset threshold value, the currently detected abnormal transaction may be classified as a risky transaction. This is to request additional verification from the accountant by classifying it as a risky transaction and notifying it if the type or amount of the transaction is significantly different even though the supporting documents are the same or similar, since there is a possibility that it is not a normal transaction.

Furthermore, in one embodiment, the vault abnormal transaction detection system 2 extracts past vault business transaction details in which an evidence image identical to or similar to the evidence data of the currently detected abnormal transaction is used, and the extracted past The transaction details may be transmitted to the terminal device 3 of the person in charge along with the currently detected abnormal transaction data.

5A is a flowchart illustrating each step of a method for detecting an abnormal transaction in a vault according to another embodiment.

Referring to FIG. 5A, in this embodiment, the unit business server 1 of the vault financial institution, when there is a transaction request from the institution user 600 (S201), prior to executing the corresponding transaction, the vault abnormal transaction detection system 2 ) may transmit financial business data for the transaction request (S202). That is, in this embodiment, the unit business server 1 requests prior approval from the vault abnormal transaction detection system 2 prior to executing a financial transaction, and the financial business data transmitted to the vault abnormal transaction detection system 2 may include transaction request data.

The vault abnormal transaction detection system (2) detects abnormal transactions by applying the detection criteria to the financial business data received from the unit business server (1) (S203), and if the abnormal transaction is not detected, the unit business server (1) Transaction execution can be requested (S207).

However, when an abnormal transaction is detected as a result of applying the detection criteria to the financial business data (S203), the vault abnormal transaction detection system 2 may transmit notification information on the abnormal transaction to the terminal device 3 of the person in charge of the institution (S204). ). At this time, if there is evidential data such as an official document received from the institution user 600 in relation to the corresponding financial business, the vault abnormal transaction detection system 2 may further transmit the evidential data to the terminal device 3 of the person in charge of the institution ( S205). Since the above process is the same as that of the embodiment described above with reference to FIG. 4, a detailed description thereof will be omitted in order to avoid duplication of description.

The accountant of the institution may determine whether to approve the transaction requested from the institution user 600 after checking the notification information received in the terminal device 3 of the institution. When proof data such as an official document is further received, the accountant may determine whether to approve the transaction requested by the user 600 by further checking the contents of the proof data. When the accountant approves the transaction, the accountant transmits a response pre-approving the transaction to the vault abnormal transaction detection system 2 through the terminal device 3 (S06), and the vault abnormal transaction detection system 2 ) may request transaction execution to the unit business server 1 in response thereto (S207).

In one embodiment, the above-described pre-approval process may be performed only for previously set risky transactions among abnormal transactions. For example, the vault abnormal transaction detection system 2 obtains prior approval from the accountant for risky transactions, which are set as requiring verification of whether or not forgery or falsification of public documents, such as new transactions in ordinary savings accounts and transactions of increasing transfer limits, among abnormal transactions. However, notification information may be transmitted to the terminal device 3 for general abnormal transactions other than risky transactions, but transaction execution may be requested to the unit task server 1 without a prior approval process.

After the unit task server 1 receives a transaction execution request transmitted when the vault abnormal transaction detection system 2 does not detect an abnormal transaction or if an abnormal transaction is detected but the accountant approves in advance (S207) , Transactions related to safe work may be executed according to the request (S208).

5B is a flowchart illustrating each step of a method for detecting an abnormal transaction in a vault according to another embodiment.

In the safe deposit box abnormal transaction detection method according to an embodiment, the safe deposit box abnormal transaction detection system 2 performs the function of a platform capable of preparing, paying, and/or storing an official document that is evidence data for an institution's financial business. This operation may be implemented through communication between the vault abnormal transaction detection system 2 and one or more devices related to the institution. For example, the vault abnormal transaction detection system 2 may provide functions such as preparation and payment of an official document through a software platform that the institution user 600 can access based on an application or web page in his/her terminal device.

In more detail with reference to FIG. 5B , the institutional user 600 may transmit a task request to the vault abnormal transaction detection system 2 in order to prepare an official document as evidence data. The task request may be first uploaded to the institution server 6 from the institution user 600 (S211), and then transmitted from the institution server 6 to the vault abnormal transaction detection system 2 (S212). It is not. For example, the institutional user 600 accessing the vault abnormal transaction detection system 2 may request a task by directly selecting a web page, menu, address, etc. for writing an official document or paying for an official document.

In response to the work request, the vault abnormal transaction detection system 2 allows the institution user 600 to fill out an official document or / or to select an official document form previously stored in the vault abnormal transaction detection system 2 A user interface can be provided. When the user 600 writes an official document, the vault abnormal transaction detection system 2 may request payment for the official document from an authorized user of the institution, for example, the administrator 700 of the institution (S213).

The manager 700 of the institution may perform electronic payment for the official document by inputting the authentication information of the institution or the authentication information of the institution into the vault abnormal transaction detection system 2 (S214). This electronic payment process is to indicate that the financial business corresponding to the contents of the official document has been normally approved in advance, and the institution's certificate (public certificate, joint certificate, etc.) and password for the certificate are entered for a specific official document, or It can be performed by inputting the ID or certificate of the administrator 700 and its password. The electronic payment information that has been authenticated (eg, public certification or co-certification information) can be combined with an official document and stored in the vault abnormal transaction detection system 2 as official document information (S215), and this official document information can be used for the corresponding financial business. It serves as supporting data.

In one embodiment, the vault abnormal transaction detection system 2 may transmit evidential data including official information to the institution user 600 and/or the institution server 6 (S216). However, in another embodiment, the vault abnormal transaction detection system 2 may store the evidence data only in the vault abnormal transaction detection system 2 without transmitting it to the institution.

The institution user 600 may request a transaction corresponding to the evidence data generated by the above process to the business server 1 of the safe and financial institution (S217). In the case of an implementation in which a transaction is conducted without prior approval, the business server 1 at least partially executes the transaction requested by the institutional user 600 (S218), and transmits the corresponding financial business data to the vault abnormal transaction detection system 2. It can be transmitted (S219). Meanwhile, in another embodiment, financial business data may be transmitted to the vault abnormal transaction detection system 2 from the institution server 6 or terminal devices of one or more users of the institution.

The vault abnormal transaction detection system 2 detects an abnormal transaction from the financial business data according to the detection criteria (S220), and when an abnormal transaction is detected, it may transmit notification information about it to the terminal device 3 of the person in charge of the institution (S221). ). At this time, the vault abnormal transaction detection system 2 may further transmit evidence data generated through the vault abnormal transaction detection system 2, that is, official information, to the terminal device 3 corresponding to the corresponding transaction. The person in charge of the institution can check whether the corresponding transaction has been normally approved by the institution in advance through official information.

In one embodiment, when a transaction is carried out without prior approval for a financial transaction, the vault abnormal transaction detection system 2 may request post-approval for the corresponding transaction from the terminal of the authorized user of the institution (S222). For example, the vault abnormal transaction detection system 2 may request post-approval by transmitting post-approval information including details of financial business, notification information therefor, and supporting data for the financial business. In this case, the authorized user of the institution to perform the post-approval may be an account manager of the institution who is notified of the abnormal transaction, the manager 700 of the institution, or other authorized users. For example, the manager 700 who electronically approved the official document may also process post-approval, but is not limited thereto.

In one embodiment, a post-approval process by an authorized user of an institution may be performed before the corresponding financial business is completed. For example, the business server 1 of the vault financial institution preferentially executes a part of the transaction requested by the institutional user 600, but receives the authorized user's approval response to the post-approval request for the transaction before the transaction. may be configured to finally complete.

In the embodiment shown in FIG. 5B , a form in which official information for proof is generated through the vault abnormal transaction detection system 2 and a corresponding transaction is executed in a post-approval manner has been described. However, the process of generating and using official information through the vault abnormal transaction detection system 2 is the embodiment shown in other drawings of this specification, for example, in which a transaction is executed in a pre-approved manner as shown in FIG. The same can be applied to the examples.

6 is a flowchart illustrating a process of managing detection and notification rules in a method for detecting abnormal transaction in a vault according to an embodiment.

Referring to FIG. 6 , in the present embodiment, the safe and abnormal transaction detection system 2 may store user information for setting the manager 700 of the corresponding institution for each institution. For example, in order to designate the manager 700, the institution may request the designation of the manager for the vault abnormal transaction detection system 2 through a branch of the safe financial institution. The manager 700 may have the highest authority necessary for the institution to enjoy the abnormal transaction detection service, such as registering the institution as a member for the vault abnormal transaction detection service and setting the detection criteria for detecting the abnormal transaction (S301 ).

For example, after subscribing to the vault abnormal transaction detection service, the manager 700 accesses the safe vault abnormal transaction detection system 2 to create detection criteria, or the vault abnormal transaction detection system 2 provides and pre-set detection The detection criteria may be set in such a way as to select a rule to be applied to the user's institution among the criteria (S301). The safe and abnormal transaction detection system 2 may store the detection criteria set by the administrator 700 in the safe and abnormal transaction detection system 2 as detection criteria information of the corresponding institution (S302).

In one embodiment, the vault abnormal transaction detection system 2 determines whether the manager 700 belongs to an institution based on pre-established user information or information received from the institution server 6 and determines whether the manager 700 belongs to the institution 700 You can also verify the authority of . When the authority of the manager 700 with respect to the institution is confirmed, the system 2 approves the manager 700's use of the service, and the manager 700, whose subscription procedure is completed, enters the safe through the terminal device 31. After logging in to the abnormal transaction detection system 2, it is possible to set abnormal transaction detection criteria or to set abnormal transaction notification targets.

In addition, the manager 700 may play a role of approving or processing another person in charge (eg, accountant) to be notified of an abnormal transaction in the same institution by the vault abnormal transaction detection system 2. . This is to enable employees of the institution to easily register or change notification targets without visiting a branch of the safe financial institution when using the service provided by the vault abnormal transaction detection system 2 .

That is, when another user (e.g., an accountant, etc.) who wants to be notified of an abnormal transaction within the institution makes a service subscription request to the vault abnormal transaction detection system 2 through the terminal device 32 (S303), the vault abnormal transaction The detection system 2 may request user approval from the manager 700 having the highest authority of the institution (S304). For example, the vault abnormal transaction detection system 2 may transmit a user approval request to the terminal device 31 of the manager 700 registered in advance.

The administrator 700 accesses the safe deposit box abnormal transaction detection system 2 using the terminal device 31 and inputs his/her own authentication information (eg, ID, password, public certificate, etc.) ) may perform user authentication and/or authority authentication. In addition, the manager 700 may approve the service subscription of other persons in charge, such as an accountant of the institution, by inputting a response to the user approval request of the vault abnormal transaction detection system 2 after the authentication process (S305).

When an additional user such as an accountant is approved for service subscription, the vault abnormal transaction detection system 2 creates a notification rule to notify the terminal device 32 of the corresponding user when an abnormal transaction related to the safe business of the institution is detected, Notification rule information may be stored in the vault abnormal transaction detection system 2 (S306). In this case, the notification rule may be to notify the terminal device 32 of all abnormal transactions of the relevant institution, or to notify the terminal device 32 of only some abnormal transactions selected by the person in charge or manager among the abnormal transactions.

The above approval process by the manager 700 can be equally applied even when previously set notification rule information is modified. For example, in the vault abnormal transaction detection system 2 according to an embodiment, notification rule information defining contents and ranges to be notified in relation to vault business may be set for each institution, organization, and user. At this time, when the accountant of the institution wants to change the type of abnormal transaction to which he or she is notified or the person to be notified of the abnormal transaction, the accountant can use the terminal device 32 to detect abnormal transaction in the safe. A change of notification rule may be requested (S307).

The vault abnormal transaction detection system 2 transmits a notification rule change request to the terminal device 31 of the manager 700 of the corresponding institution (S308), and a response in which the manager 700 approves the change in the notification rule is sent to the terminal. When received from the device 31 (S309), the notification rule may be changed according to the approved content and the updated notification rule may be stored in the vault abnormal transaction detection system 2 (S310).

The above approval process may be equally applied to a case in which an accounting person registers, corrects, or deletes an abnormal transaction detection criterion itself, in addition to notification rules. In this case, some detection criteria and/or notification rules previously set for each institution may be configured to be unchangeable. Meanwhile, in the embodiments of the present specification, the manager 700 is illustrated as a single entity for convenience of description, but the manager 700 may be one or a plurality of users set for each institution, department, and task.

7 is a flowchart illustrating a process of transmitting audit information on an abnormal transaction to an institution in a safe depository abnormal transaction detection method according to an embodiment.

In this embodiment, the vault abnormal transaction detection system 2 receives financial business data from one or more devices related to the institution, for example, the unit business server 1 of the safe financial institution (S401). In addition, the vault abnormal transaction detection system 2 detects abnormal transaction therefrom and performs an operation of notifying the terminal devices 31 and 32 of one or more persons in charge of the institution (S402 and S403), which is the same as the above-described embodiments. Since it can be easily understood from, a detailed description is omitted.

Meanwhile, in the present embodiment, the notification module 270 (FIG. 3) of the vault abnormal transaction detection system 2 further generates audit information to be transmitted to the institution (S404). In this specification, audit information is arbitrary information for grasping the flow of funds through the treasury business in an institution, and may include the date and time and details of each institution's income and / or expenditure business, list and / or tally. For example, audit information is an individual report on the processing result in the unit of payment order number, a daily revenue and expenditure schedule, a daily revenue and expenditure and cash balance table, a revenue laurel table, and an annual expenditure to grasp the current status of funds in units of a certain period (day or month, etc.). It can include reports such as laurels, or the entire transaction history of the vault account.

The vault abnormal transaction detection system 2 may generate audit information as described above in real time or at regular intervals, and transmit it to the terminal devices 31 and 32 of the person in charge of the institution and/or the institution server 6 (S405, S406). In order to periodically generate audit information, in one embodiment, transaction history information may be stored in the DB 280 (FIG. 3) of the vault abnormal transaction detection system 2. For example, the vault abnormal transaction detection system 2 may generate audit data for vault operations performed the previous day and provide the audit data through the administrative network of the institution the next day.

The operation by the vault abnormal transaction detection method according to the embodiments described above may be at least partially implemented as a computer program and recorded on a computer-readable recording medium. Computer-readable recording media on which programs for implementing operations by methods according to embodiments are recorded include all types of recording devices in which computer-readable data is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, and optical data storage devices. In addition, computer-readable recording media may be distributed in computer systems connected through a network, and computer-readable codes may be stored and executed in a distributed manner. In addition, functional programs, codes, and code segments for implementing this embodiment can be easily understood by those skilled in the art to which this embodiment belongs.

Further, each block or each step shown in the flowcharts herein may represent a module, segment or portion of code that includes one or more executable instructions for executing specified logical function(s). Also, in some alternative embodiments, it is possible for the functions mentioned in blocks or steps to occur out of order. For example, two blocks or steps shown in succession may in fact be performed substantially concurrently, or the blocks or steps may sometimes be performed in reverse order depending on their function.

The present invention reviewed above has been described with reference to the embodiments shown in the drawings, but this is only exemplary, and those skilled in the art will understand that various modifications and variations of the embodiments are possible therefrom. However, such modifications should be considered within the technical protection scope of the present invention. Therefore, the true technical protection scope of the present invention should be determined by the technical spirit of the appended claims.

Claims (16)

A collection module configured to receive one or more financial business data related to money management business from one or more unit business servers of a safe financial institution that manages the institution's funds in the form of a safe;
a detection module configured to extract abnormal transaction data corresponding to at least one of a transaction amount and a transaction type preset for the institution from the one or more financial business data, based on preset detection criterion information; and
a notification module configured to transmit notification information corresponding to the abnormal transaction data to a terminal device of a user of the institution based on preset notification rule information;
The collection module is further configured to receive evidence data related to the money management task from one or more devices associated with the institution or to generate the evidence data through communication with the one or more devices;
The evidence data includes official information of the institution indicating that the financial business has been normally approved in advance by the institution,
The official information is transmitted between departments of the institution or from the institution to the safe financial institution, and includes an official document image for identifying transaction request contents of the institution corresponding to the financial business.
delete According to claim 1,
The official document information includes electronic payment information by the institution or an authorized member of the institution.
According to claim 3,
The electronic payment information includes public authentication or joint authentication information as payment information of the institution or an authorized member of the institution for the official document.
According to claim 1,
The detection module analyzes the official document information to detect forgery or alteration, thereby detecting or supporting the detection of an abnormal transaction related to the financial business data.
According to claim 1,
The safe and abnormal transaction detection system of claim 1, wherein the notification module is further configured to transmit the evidential data to the terminal device.
According to claim 1,
The notification module,
When the pre-approval information corresponding to the transaction request data is received, further configured to request execution of the transaction corresponding to the transaction request data to the unit task server in response to receiving the pre-approval information;
The vault abnormal transaction detection system further configured to transmit post-approval request data of the transaction request data to a terminal of an authorized user of the institution before the financial transaction is completed when the financial transaction proceeds without the pre-approval information.
According to claim 1,
The detection module includes financial business data having a transaction amount greater than or equal to a preset amount, financial business data including a change in a transaction account or notification target, financial business data including a change in service subscription, and a preset unit business server. The vault abnormal transaction detection system further configured to detect, as the abnormal transaction data, financial business data received from a different server or repeated transactions of a preset transaction type.
storing detection criterion information and notification rule information set in advance according to the institution in the vault abnormal transaction detection system;
receiving, by the vault abnormal transaction detection system, at least one financial business data related to a fund management business from at least one unit business server of a safe financial institution that manages funds of the institution in the form of a safe;
extracting, by the vault abnormal transaction detection system, abnormal transaction data corresponding to at least one of a transaction amount and a transaction type preset for the institution based on the detection reference information;
transmitting, by the safe and abnormal transaction detection system, notification information corresponding to the abnormal transaction data to a terminal device of a user of the institution, based on the notification rule information; and
Receiving, by the vault abnormal transaction detection system, evidence data related to the money management business from one or more devices related to the institution, or generating the evidence data through communication with the one or more devices,
The evidence data includes official document information of the institution indicating that the financial business has been normally approved in advance by the institution;
The official information is transmitted between departments of the institution or from the institution to the safe financial institution, and includes an official document image for identifying transaction request contents of the institution corresponding to the financial business.
delete According to claim 9,
Wherein the official document information includes electronic payment information by the institution or an authorized member of the institution.
According to claim 11,
The electronic payment information includes public authentication or joint authentication information as payment information of the institution or an authorized member of the institution for the official document.
According to claim 9,
The step of extracting the abnormal transaction data may include the step of allowing the vault abnormal transaction detection system to analyze the official document information to detect forgery or falsification, thereby detecting or supporting the detection of an abnormal transaction related to the financial business data. Transaction detection method.
According to claim 9,
The method of detecting abnormal transaction in a vault further comprising transmitting, by the safe deposit box abnormal transaction detection system, the evidential data to the terminal device.
According to claim 9,
When the vault abnormal transaction detection system receives the pre-approval information corresponding to the transaction request data, requesting execution of the transaction corresponding to the transaction request data to the unit task server in response to receiving the pre-approval information ; and
Further comprising the step of, by the vault abnormal transaction detection system, transmitting post-approval request data of the transaction request data to a terminal of an authorized user of the institution before the financial transaction is completed, when the financial transaction proceeds without the pre-approval information Vault abnormal transaction detection method.
According to claim 9,
In the step of extracting the abnormal transaction data, the vault abnormal transaction detection system includes financial business data having a transaction amount greater than a preset amount, financial business data including a change in a transaction account or notification target, and a change in service subscription. and extracting financial business data including, financial business data received from a server other than a preset unit business server, or repeated transactions of a preset transaction type as the abnormal transaction data.

Images