WO2023053541A1

WO2023053541A1 - Fraud detection system, fraud detection method, and program

Info

Publication number: WO2023053541A1
Application number: PCT/JP2022/016533
Authority: WO
Inventors: 靖裕日昔
Original assignee: Bhi株式会社
Priority date: 2021-09-30
Filing date: 2022-03-31
Publication date: 2023-04-06
Also published as: JP2023051670A; JP2023051405A; JP7008381B1

Abstract

[Problem] To make it possible to detect the possibility of fraudulent use of a credit card. [Solution] This fraud detection system is characterized by comprising: a payment information acquisition unit that acquires payment information pertaining to a product or service that a user has purchased, from a server of a credit card company; a fraud detection unit that detects the possibility of fraudulent use of a credit card if an email message addressed to the user and related to the purchase of the product or service has not arrived from the seller of the product or service; and a notification unit that notifies the user in the case where the possibility of fraudulent use has been detected.

Description

Fraud detection system, fraud detection method and program

The present invention relates to fraud detection systems, fraud detection methods, and programs.

Patent Document 1 determines the possibility of credit card fraud.

Japanese Patent Application Laid-Open No. 2021-144346

A variety of methods are required to detect the possibility of fraud.

The present invention has been made in view of this background, and aims to provide a technology that can detect the possibility of unauthorized use of a credit card.

The main invention of the present invention for solving the above problems is a fraud detection system, comprising a payment information acquisition unit that acquires payment information related to a product or service purchased by a user from a server of a credit card company; a fraud detection unit that detects the possibility of fraudulent use of a credit card when an e-mail regarding the purchase of the product or service addressed to the user from the service seller does not arrive; and a notification unit that notifies the user when detected.

Other problems disclosed by the present application and their solutions will be clarified in the section of the embodiment of the invention and the drawings.

According to the present invention, it is possible to detect the risk of unauthorized use of credit cards.

It is a figure which shows the whole structural example of the fraud detection system of this embodiment. 3 is a diagram illustrating an example hardware configuration of a management server 2; FIG. 3 is a diagram showing a software configuration example of a management server 2; FIG. It is a figure explaining operation|movement of the fraud detection system of this embodiment.

<Overview of the invention>
The contents of the embodiments of the present invention are listed and explained. The present invention has, for example, the following configurations.
[Item 1]
a payment information acquisition unit that acquires payment information related to the product or service purchased by the user from the server of the credit card company;
a fraud detection unit that detects the possibility of fraudulent use of a credit card when an e-mail regarding the purchase of the product or service addressed to the user from the seller of the product or service does not arrive;
a notification unit that notifies the user when the possibility of unauthorized use is detected;
A fraud detection system comprising:
[Item 2]
The fraud detection system according to item 1,
an e-mail acquisition unit that acquires an e-mail addressed to the user from a mail server;
a transaction data extraction unit that analyzes the e-mail and extracts transaction data related to the purchase of the product or service from the e-mail;
further comprising
The fraud detection unit determines whether the transaction data extraction unit has succeeded in extracting the transaction data, and the settlement date, settlement amount, and name of the seller included in the extracted transaction data, and the name of the seller included in the settlement information. Determining whether or not there is an e-mail regarding the purchase of the product or service by comparing the date of use, the amount of money used, and the destination of use;
A fraud detection system characterized by:
[Item 3]
The fraud detection system according to item 1 or 2,
The fraud detection unit detects the possibility of fraudulent use when the e-mail does not arrive within a predetermined time after the payment information is acquired;
A fraud detection system characterized by:
[Item 4]
The fraud detection system according to any one of items 1 to 3,
further comprising a detection history storage unit that stores information related to the unauthorized use detected by the unauthorized detection unit;
A fraud detection system characterized by:
[Item 5]
The fraud detection system according to any one of items 1 to 4,
The degree to which the unauthorized use is detected for at least one of the product or service and the provider in association with at least one of the product or service and the provider for which the unauthorized use has been detected by the unauthorized detection unit a fraud degree storage unit that stores a certain fraud degree;
a degree-of-fraud providing unit that, in response to a request in which at least one of the goods or services and the provider is designated, responds with the degree of fraud with respect to at least one of the designated goods or services and the provider;
A fraud detection system, further comprising:
[Item 6]
a step of acquiring payment information related to the product or service purchased by the user from the server of the credit card company;
a step of detecting the possibility of fraudulent use of a credit card when an e-mail regarding the purchase of the product or service addressed to the user from the seller of the product or service does not arrive;
notifying the user when the potential abuse is detected;
A fraud detection method, characterized in that the computer executes
[Item 7]
a step of acquiring payment information related to the product or service purchased by the user from the server of the credit card company;
a step of detecting the possibility of fraudulent use of a credit card when an e-mail regarding the purchase of the product or service addressed to the user from the seller of the product or service does not arrive;
notifying the user when the potential abuse is detected;
A program that causes a computer to run

<System Overview>
A fraud detection system according to an embodiment of the present invention will be described below. The fraud detection system of this embodiment attempts to detect the risk of fraudulent use of a credit card.

In the fraud detection system of the present embodiment, a store related to electronic commerce (EC) (any store that can sell products, such as an EC site or an online shopping mall) It may be a store or an individual who sells goods.In addition, it may be a company that provides services as well as sales of goods. The same.) is used. Transaction histories sent by e-mail have the same meaning as receipts in the real world. In this embodiment, the risk of unauthorized use of the credit card is detected by using e-mails containing such transaction details. Specifically, when payment by credit card is approved for a certain transaction, information including the details of the transaction (hereinafter referred to as payment information) is received, and an e-mail with the same content as the transaction details related to the payment information is sent to the user. is not received, it is determined that there is a risk of unauthorized use of the credit card.

FIG. 1 is a diagram showing an example of the overall configuration of the fraud detection system of this embodiment. The fraud detection system of this embodiment includes a management server 2 . The management server 2 is communicably connected to each of the credit card server 1 and the mail server 3 via a communication network. The communication network is, for example, the Internet, and is constructed by a public telephone line network, a mobile telephone line network, a wireless communication path, Ethernet (registered trademark), and the like.

The credit card server 1 is a computer operated by a credit card company. The credit card server 1 provides the management server 2 with settlement information including the result of credit card settlement approval at the credit card company.

The mail server 3 is a computer that manages e-mails of credit card users. The e-mail server 30 is a so-called MRA (Mail Retrieval Agent), has mailboxes, and can provide e-mails delivered to the mailboxes by protocols such as IMAP and POP, for example. It is assumed that the management server 2 has previously obtained permission from the user to access the mailbox managed by the mail server 3 .

The management server 2 is a computer that detects the risk of unauthorized use of credit cards. The management server 2 may be a general-purpose computer such as a workstation or personal computer, or may be logically implemented by cloud computing.

<Hardware configuration example>
FIG. 2 is a diagram showing a hardware configuration example of the management server 2. As shown in FIG. Note that the illustrated configuration is an example, and other configurations may be employed. The management server 2 includes a CPU 201 , a memory 202 , a storage device 203 , a communication interface 204 , an input device 205 and an output device 206 . The storage device 203 is, for example, a hard disk drive, solid state drive, flash memory, etc., which stores various data and programs. The communication interface 204 is an interface for connecting to the communication network 3, and includes, for example, an adapter for connecting to Ethernet (registered trademark), a modem for connecting to a public telephone network, and a wireless communication device for performing wireless communication. , a USB (Universal Serial Bus) connector and an RS232C connector for serial communication. The input device 205 is, for example, a keyboard, mouse, touch panel, button, microphone, etc. for inputting data. The output device 206 is, for example, a display, printer, speaker, or the like that outputs data. Each functional unit of the management server device 2, which will be described later, is implemented by the CPU 201 reading a program stored in the storage device 203 into the memory 202 and executing it. It is implemented as part of the storage area provided by 203 . Note that the credit card server 1 and mail server 3 can also have the same hardware configuration as the management server 2 .

<Software configuration example>
FIG. 3 is a diagram showing a software configuration example of the management server 2. As shown in FIG. The management server 2 includes a payment information acquisition unit 211, an e-mail acquisition unit 212, a transaction data extraction unit 213, a fraud detection unit 214, a notification unit 215, a fraud level provision unit 216, a payment information storage unit 231, a transaction data storage unit 232, A rule storage unit 233 , a billing name storage unit 234 , a detection history storage unit 235 , and a fraud degree information storage unit 236 are provided.

<Memory part>
The payment information storage unit 231 stores payment information related to payments approved by credit card companies. The payment information includes information indicating the user of the credit card (hereinafter referred to as user ID), date of use, destination (store name), amount used, payment type, current payment amount, and the like.

The transaction data storage unit 232 stores information on purchased products (hereinafter referred to as transaction data). The transaction data includes the user ID indicating the user who purchased the product, the date and time when the e-mail regarding the purchase of the product was received, the date when the user purchased the product (transaction date), the store name indicating the store where the product was purchased, The product name indicating the purchased product, product price, shipping fee, payment amount, payment method, etc. can be included. These can be obtained from an e-mail sent by a seller (store) such as an EC site to a user who is a purchaser as information for confirmation. If multiple products are purchased with one payment, the transaction data may include multiple pairs of product names and product prices. In addition, when multiple deliveries are performed, multiple shipping charges may be included. The settlement amount is the sum of the purchase amount of the product plus the shipping fee, and the amount for settlement by credit card after applying the discount by using points or coupons. The means of payment are

The rule storage unit 233 stores rules for analyzing email data. The rule storage unit 233 can store rules for each store. A rule may be, for example, a learning model learned by machine learning of e-mail data. The rule storage unit 233 further associates and stores the pattern of the address that is the transmission source of the e-mail (it may be the address itself, or it may be a pattern expressing the address using a regular expression or the like). can also be

The billing name storage unit 234 associates and stores the name of the store, which is the subject of the commercial transaction, with the name of the billing person (description) who makes the billing as the member store of the credit card. The payment information obtained from the credit card server 1 will include this biller name as the billing party.

The detection history storage unit 235 is a database of blacklists of fraudulent detections. The detection history storage unit 235 stores information (hereinafter referred to as detection information) related to fraudulent use detected by the fraud detection unit 214, which will be described later. The detection information includes the user ID, the date and time when fraud was detected, the date of use of the credit card related to the fraudulent use, the name of the store, the name of the product, and the like.

The fraud level information storage unit 236 associates at least one of the product and the store for which the fraud detection unit has detected fraudulent use, and stores the fraud level, which is the degree to which fraudulent use is detected for at least one of the product and the store. Remember. The degree of fraud can be expressed, for example, as a ratio of the number of cases of fraud detected for the product and store to the number of transaction data including the product and store.

<Function part>
The payment information acquisition unit 211 acquires payment information from the credit card server 1 . The payment information acquisition unit 211 can register the acquired payment information in the payment information storage unit 231 . The payment information acquisition unit 211 may, for example, periodically access the credit card server 1 to acquire additional payment information, or may be triggered by the payment being approved by the credit card server 1. Payment information may be sent and received.

The e-mail acquisition unit 212 acquires e-mail data addressed to the user. The e-mail acquisition unit 212 can access the mail server 3 and acquire e-mail data from the user's mailbox according to protocols such as POP (Post Office Protocol) and IMAP (Internet Message Access Protocol). The management server 2 is provided with a mail server storage section for managing mail servers to be accessed in association with user IDs, and the e-mail acquisition section 212 accesses all mail servers registered in the mail server storage section. can also be configured to collect email data.

The transaction data extraction unit 213 analyzes the e-mail and extracts transaction data related to product purchase from the e-mail. E-mail data related to commercial transactions includes information related to transactions (transaction data). Transaction data extraction unit 213 can extract transaction data from e-mail data according to rules registered in rule storage unit 233 . The transaction data extracting unit 213 reads from the rule storage unit 233 a rule corresponding to an address pattern matching the source address included in the e-mail data, and extracts the transaction data from the e-mail data based on the read rule. can be extracted. Further, the transaction data extraction unit 213 may apply all the rules stored in the rule storage unit 233 and use the rules that successfully extract transaction data. A store name corresponding to the rule can be specified.

In addition, the transaction data extraction unit 213 acquires from the e-mail data information (for example, a URL for viewing the transaction history) for specifying the transaction history managed by the EC site, etc. Based on this, it is possible to access the EC site and acquire the transaction data. In this case, the transaction data extraction unit 213 can extract the transaction data displayed as the transaction history from the linked web page by scraping or the like. Further, the transaction data extracting unit 213 can acquire transaction data by passing information for identifying the transaction history extracted from the e-mail data to an API provided by the EC site.

The fraud detection unit 214 can detect the possibility of fraudulent use of the credit card when an e-mail regarding the purchase of the product addressed to the user from the store or EC site that sells the product does not arrive after payment. . The fraud detection unit 214 determines whether the transaction data extraction unit 213 has succeeded in extracting transaction data, and the payment date, payment amount, and seller name included in the extracted transaction data, and the usage date and usage date included in the payment information. By comparing the amount and the destination of use, it is possible to determine whether or not there is an e-mail regarding the purchase of the product. Further, the fraud detection unit 214 may detect the possibility of fraudulent use when no e-mail arrives within a predetermined time after the payment information acquisition unit 211 acquires the payment information.

The notification unit 215 notifies the user when the possibility of unauthorized use is detected. The notification unit 215 may notify the possibility of unauthorized use by e-mail, or may notify by a message or push notification by a chat service. The notifier 215 can include, for example, payment information corresponding to the detected fraud in the message.

The fraud level providing unit 216 can provide the fraud level in response to an external request. At least one of a product and a store is specified in the request. The fraud level providing unit 216 can read out the fraud level corresponding to at least one of the specified product and store from the fraud level information storage unit 236 and respond to the request.

<Action>
FIG. 4 is a diagram for explaining the operation of the fraud detection system of this embodiment.

The management server 2 acquires payment information from the credit card server 1 and registers it in the payment information storage unit 231 (S301). The management server 2 acquires the e-mail from the mail server 3 (S302), extracts transaction data from the acquired e-mail, and registers it in the transaction data storage unit 232 (S303). When the payment information corresponding to the extracted transaction data is not registered in the payment information storage unit 231 (S304), the management server 2 determines that the time from the acquisition of the payment information in step S301 exceeds a predetermined threshold. If the timeout has not occurred (S305: NO), the process from step S302 is repeated.

When a timeout occurs (S305: YES), the management server 2 notifies the user of the possibility of unauthorized use of the credit card (S306).

As described above, according to the fraud detection system of the present embodiment, after the credit card company approves the payment, the purchase of the product from the product provider (store) related to the payment is made within a predetermined time. The possibility of unauthorized use of the credit card can be detected by not receiving an e-mail notifying that the transaction related to the product has been made to the person (user).

Although the present embodiment has been described above, the above embodiment is intended to facilitate understanding of the present invention, and is not intended to limit and interpret the present invention. The present invention can be modified and improved without departing from its spirit, and the present invention also includes equivalents thereof.

1 credit card server 2 management server 3 mail server

Claims

a payment information acquisition unit that acquires payment information related to the product or service purchased by the user's credit card payment from the server of the credit card company;
an e-mail acquisition unit that acquires an e-mail addressed to the user from a mail server;
a transaction data extraction unit that analyzes the e-mail and extracts transaction data related to the purchase of the product or service from the e-mail;
The transaction data extraction unit succeeds in extracting the transaction data, and the payment date, payment amount, and seller name included in the extracted transaction data, and the usage date, usage amount, and usage date included in the payment information. Check with the destination to determine whether or not there is an e-mail related to the purchase of the goods or services, and if the e-mail related to the purchase of the goods or services does not arrive, the possibility of unauthorized use of the credit card a fraud detection unit that detects
a notification unit that notifies the user when the possibility of unauthorized use is detected;
A fraud detection system comprising:
The fraud detection system according to claim 1,
The fraud detection unit detects the possibility of fraudulent use when the e-mail does not arrive within a predetermined time after the payment information is acquired;
A fraud detection system characterized by:
The fraud detection system according to claim 1 or 2,
further comprising a detection history storage unit that stores information related to the unauthorized use detected by the unauthorized detection unit;
A fraud detection system characterized by:
The fraud detection system according to any one of claims 1 to 3,
The degree to which the unauthorized use is detected for at least one of the product or service and the seller in association with at least one of the product or service and the seller for which the unauthorized use has been detected by the fraud detection unit a fraud degree storage unit that stores a certain fraud degree;
a degree-of-fraud providing unit that, in response to a request in which at least one of the goods or services and the seller is specified, responds with the degree of fraud with respect to at least one of the specified goods or services and the seller;
A fraud detection system, further comprising:
a step of acquiring payment information related to the product or service purchased by the user's credit card payment from the server of the credit card company;
obtaining an email addressed to the user from a mail server;
parsing the e-mail to extract transaction data relating to the purchase of the goods or services from the e-mail;
Succeeded in extracting the transaction data, and collating the settlement date, settlement amount, and seller name included in the extracted transaction data with the usage date, usage amount, and usage destination included in the settlement information. determining whether or not there is an e-mail regarding the purchase of the product or service;
a step of detecting the possibility of fraudulent use of a credit card when an e-mail relating to the purchase of the goods or services has not been received;
notifying the user when the potential abuse is detected;
A fraud detection method, characterized in that the computer executes
a step of acquiring payment information related to the product or service purchased by the user's credit card payment from the server of the credit card company;
an e-mail acquisition unit that acquires an e-mail addressed to the user from a mail server;
a transaction data extraction unit that analyzes the e-mail and extracts transaction data related to the purchase of the product or service from the e-mail;
Succeeded in extracting the transaction data, and collating the settlement date, settlement amount, and seller name included in the extracted transaction data with the usage date, usage amount, and usage destination included in the settlement information. determining whether or not there is an e-mail regarding the purchase of the product or service;
a step of detecting the possibility of fraudulent use of a credit card when an e-mail relating to the purchase of the goods or services has not been received;
notifying the user when the potential abuse is detected;
A program that causes a computer to run