GB2616145A

GB2616145A - Fraud detection device for checking and authenticating person, application fraud detection method, and application fraud detection program

Info

Publication number: GB2616145A
Application number: GB2307441.2A
Authority: GB
Inventors: Hasegawa Hiroki; Kondo Junya; Ikeda Yuichiro
Original assignee: Elements Inc
Current assignee: Elements Inc
Priority date: 2020-10-22
Filing date: 2021-07-27
Publication date: 2023-08-30
Also published as: WO2022085265A1; JPWO2022085265A1; GB202307441D0; JP7542076B2

Abstract

[Problem] To provide a fraud detection device for checking and authenticating a person online, an application fraud detection method, and an application fraud detection program. [Solution] An application fraud detection device 30 comprises: an application data reception unit 110 that receives an appearance and identification matter for an applicant and a terminal identifier of an application terminal; an applicant database 40 that accumulates the received data; an applicant data comparison unit 120 that compares the appearance and identification matter for the applicant with an appearance and identification matter for a previous applicant; and an application fraud determination unit 130 that executes first application fraud determination when a previous applicant whose appearance is similar to the appearance of the applicant is found yet the identification matter for the applicant and the identification matter for the previous applicant do not match, or when a previous applicant whose identification matter matches the identification matter for the applicant is found yet the appearance of the applicant and the appearance of the previous applicant are dissimilar.

Description

Title of Invention:

FRAUD DETECTION DEVICE FOR CHECKING AND AUTHENTICATING PERSON, APPLICATION FRAUD DETECTION METHOD, AND APPLICATION FRAUD DETECTION PROGRAM

Technical Field

[0001] The present invention relates to a fraud detection device for checking and authenticating a person using face authentication or the like, an application fraud detection method, and an application fraud detection program.

Background Art

[0002] In the past, research and development have been conducted on methods for detecting fraudulent applications in checking and authenticating a person using face authentication or the like. For example, Patent Literature 1 (Japanese Patent Laid-Open No. 2017120570) discloses a method for preventing fraudulent applications repeatedly made by a malicious applicant in a system for registering applications for opening an account and the like.

[0003] The method for preventing fraudulent applications described in Patent Literature 1 is an application fraud prevention system in a system that accepts the input of -2 -data required by an application for opening an account or the like from a terminal device of an applicant and registers the application for opening an account or the like on the basis of the data, the system for preventing fraudulent applications including: a mobile terminal device provided with a camera for input of certificate data required for opening an account or the like and a transmission unit that transmits the certificate data; and an application registration server provided with a reception unit that receives the certificate data, an authenticity determination unit that determines the authenticity of the received certificate data, a history information storage unit that stores history information associating the mobile terminal devices with the results of checking the certificate data inputted from the mobile terminal devices in the past, a comprehensive determination unit that makes a comprehensive determination of the certificate data on the basis of the determination result from the authenticity determination unit and the history information, and a transmission unit that transmits determination result information from the comprehensive determination unit.

[0004] Patent Literature 2 (Japanese Patent Laid-Open No. 2018-163677) discloses a service providing system, a service providing method, a verification device, a verification method, and a computer program capable of creating a database of information that may relate to -3 -fraudulent accesses as a blacklist to detect similar fraudulent accesses efficiently.

[0005] A fraudulent access detection system described in Patent Literature 2 is provided with a web server and an authentication server. The web server includes service providing means for providing information about a user to the authentication server and providing a service to a user determined to be a legitimate user, and transmitting means for transmitting, to a verification server, information about actions taken by the user to the web server. The authentication server includes determining means for determining whether the user is a legitimate user on the basis of the information about the user, and receiving means for receiving, from the verification server, the probability that the user is not a legitimate user.

The verification server includes a whitelist database in which information about actions taken by legitimate users is recorded and a blacklist database in which a record is registered when the record is determined not to correspond to a record in the whitelist database, compares information about actions taken by the user to data in the blacklist database, calculates an indicator that the user is not a legitimate user from the degree of similarity, and transmits the indicator to the authentication server. -4 -

[0006] Patent Literature 3 (Japanese Patent Laid-Open No. 2004-259253) discloses a personal authentication device that verifies with not only a face image of a person themselves but also a face image of a person under surveillance in checking the person.

[0007] The personal authentication device described in Patent Literature 3 is a personal authentication device that authenticates a user to be the user themselves, the device including an image capture unit that captures an image of the face of the user, a specific person comparison unit that compares the face image of the user captured by the image capture unit to a face image of a specific person retained in advance, a person image acquisition unit that acquires a face image of a person from a storage device, and an authentication unit that determines, according to a determination method that is different depending on the result of the comparison by the specific person comparison unit, whether the face image of the user captured by the image capture unit and the face image of the person acquired by the person image acquisition unit are images of the same person.

[0008] Patent Literature 4 (Japanese Patent Laid-Open No. 2019-086971) discloses a more convenient system and method for checking a person using face images.

[0009] In the system for checking a person described in Patent Literature 4, an identity check server is provided with an image data reception unit that receives proof -5 -image data of a driver's license and face image data of a user taken with a mobile phone camera, a character acquisition unit that acquires character data from the proof image data, a score acquisition unit that verifies the face image data with a face image in the proof image data to obtain a score, a face authentication determination unit that determines that face authentication is successful if the score is equal to or greater than a threshold value, and a facial determination result transmission unit that transmits the determination result and personal identifiable data included in the character data to a mobile terminal. The face authentication determination unit determines that face authentication is successful if location data received from the mobile terminal is near the address when the score is near the threshold value, and the mobile terminal is provided with an authenticated data transmission unit that transmits the personal identifiable data to a bank server 7 if the authentication result is that face authentication is successful.

[0010] Patent Literature 5 (Japanese Patent Laid-Open No. 2020-087461) discloses a system for authenticating a person, an authenticator, a program, and a method for authenticating a person with improved security.

[0011] The system for authenticating a person described in Patent Literature 5 is a system for authenticating a -6 -person provided with a camera-equipped mobile terminal to be carried by a user and a personal authentication server communicably connected to the mobile terminal, in which the mobile terminal includes: an image storage and processing unit that causes a face image, which is an image of the face of a holder holding a driver's license and which is acquired with a camera in identity check of the user, to be stored as a verification image in a verification image storage unit; a face image acquisition and verification unit that acquires a face image of a service user with a camera when a service is to be used and verifies the face image with the verification image stored in the verification image storage unit; and a verification result transmission unit that transmits a verification result from the face image acquisition and verification unit to the personal authentication server. The personal authentication server is provided with a service use allowing unit that allows use of the service on the basis of the verification result.

Citation List Patent Literature [0012] Patent Literature 1: Japanese Patent Laid-Open No. 2017- Patent Literature 2: Japanese Patent Laid-Open No. 2018- -7 - Patent Literature 3: Japanese Patent Laid-Open No. 2004- Patent Literature 4: Japanese Patent Laid-Open No. 2019- Patent Literature 5: Japanese Patent Laid-Open No. 2020-

Summary of Invention

Technical Problem [0013] In recent years, transactions over the Internet have been expanding due to the development of information and communications technology and improvements in services by operators in pursuit of customer convenience. For example, financial institutions offer various financial services such as opening an account and transferring funds over the Internet.

On the other hand, these Internet transactions are more anonymous than face-to-face transactions, and the fraudulent use of services by criminals is on the rise.

For this reason, financial institutions and other operators are working to prevent abuse of their services by checking and authenticating a person online when providing the services over the Internet.

Generally, checking a person online involves using appearance data captured with software provided by the operator and image data of an identity document that includes appearance, such as a driver's license, to check -8 -identification matter (such as name, date of birth, address, and driver's license number, for example) written on the identity document and to check that the appearance data matches the image data of the identity document. However, at present, criminals are constantly falsifying identification matter (such as name, date of birth, address, and driver's license number, for example) and impersonating other persons or fictitious persons. The reasons are that counterfeiting an identity document is easy and that detecting an elaborate forgery from image data is difficult.

Moreover, online authentication of a person authorizes access to a service by a customer themselves whose identity has been checked using an ID and password or other authenticating means, but at present, passwords are being obtained fraudulently by criminals through phishing and the like, and fraudulent access is on the rise.

[0014] In the method for preventing fraudulent applications described in Patent Literature 1, the authenticity determination unit determines the authenticity of application data by examining whether characters, symbols, and the like in the image data of a driver's license or the like conform to predetermined rules. Also, in the history information storage unit, a terminal ID of the mobile terminal device is compared to a terminal ID recorded in a history information table, -9 -and it is determined whether that terminal ID was determined to be a forgery in the past. In the method of Patent Literature 1, even a counterfeit driver's license may be determined not to be a fraudulent application if the characters, symbols, and the like in the image data of the driver's license or the like conform to the predetermined rules.

[0015] In the fraudulent access detection method described in Patent Literature 2, information about actions, such as OS, browser, language, IP address, time, and page transitions, is checked, and if the information about actions is different even though the user is the same, it is determined that there is a high probability of fraudulent access by a malicious third party, thereby preventing fraudulent access; however, determining that there is a high probability of fraudulent access by a malicious third party requires, for example, data for 20 or more times of normal access in advance, and using this fraudulent access detection method alone is considered risky.

[0016] In the personal authentication device described in Patent Literature 3, a face image of the user captured with the image capture unit is compared to a face image of a specific person retained in advance, and when the face image of the user is similar to the face image of the specific person, a more strict determination is made as to whether the face image of the user captured by the -10 -image capture unit and the face image of the person acquired by the person image acquisition unit are images of the same person.

However, in this case, if the face image of the person acquired by the person image acquisition unit is not of the user themselves to begin with, that is, if the name, date of birth, and the like were falsely registered at the time of initial registration, there is a possibility that someone who is not the person themselves will be authenticated as the person.

[0017] In the systems for checking a person described in Patent Literature 4 and Patent Literature 5, the person is checked by verifying the face image data of a user with proof image data of a driver's license, but if the driver's license is counterfeit, there is a possibility that someone else will be mistakenly authenticated as the person.

[0018] The main objective of the present invention is to provide a fraud detection device for checking and authenticating a person online, an application fraud detection method, and an application fraud detection program.

In an application for checking a person online, the combination of appearance data, identification matter (such as name, date of birth, address, and driver's license number, for example), and user terminal identifier should be uniquely determined. This feature is used to detect the falsification of identification matter by criminals and the impersonation of other persons or fictitious persons. That is, a case is detected as a first fraud determination in the case in which there are multiple applications of identification matter for the same appearance data, the case in which there are multiple applications of appearance data for the same identification matter, and the case in which there are multiple applications of appearance data/identification matter from the same terminal identifier.

Furthermore, a commercial database (blacklist) may be utilized for the identification matter, such as address, telephone number, and IP address of the access source, at the time of the application for checking a person, and if there is a match, the application may be detected as the first fraud determination.

Also, the appearance data, identification matter, and terminal identifier for which the first fraud determination is issued are registered in a greylist database, and when checking and authenticating a person online, the greylist database is referenced to prevent further fraudulent use by the same criminal. That is, a case is detected as a second fraud determination in the case in which an application or access is performed with the data of any of the appearance data, identification -12 -matter, and terminal identifier registered in the greylist database.

Another objective of the present invention is to provide a fraud detection device, an application fraud detection method, and an application fraud detection program that can detect application fraud reliably, even in the case in which a criminal applies for checking themselves with a plurality of operators that provide services and the criminal uses the same appearance data with a plurality of pieces of different identification matter, a plurality of different appearance data with the same identification matter, or the same terminal identifier with a plurality of pieces of different identification matter/appearance data.

In the case in which a fraud detection device is closed within a single operator, fraud cannot be detected if the same appearance data with a plurality of pieces of different identification matter is used to apply for checking and authenticating a person to respectively different operators, for example. The present invention provides a fraud detection device, an application fraud detection method, and an application fraud detection program that can detect fraud reliably even in such cases.

Solution to Problem [0019] (1) -13 -A fraud detection device for checking and authenticating a person according to one aspect includes: an application data reception unit that receives at least one of appearance data of an applicant, identification matter data of the applicant, and terminal identifier data of an application terminal of the applicant; an applicant database that accumulates the appearance data, the identification matter data, and the terminal identifier data received by the application data reception unit; an application data comparison unit that compares the appearance data of the applicant to the appearance data of a previous applicant accumulated in the applicant database; and an application fraud determination unit that issues a first application fraud determination if the identification matter data of the applicant does not match the identification matter data of the previous applicant when the application data comparison unit finds the appearance data of the previous applicant similar to the appearance data of the applicant.

Note that the identification matter data of the applicant refers to, for example, the name, date of birth, address, and driver's license number of the applicant, or any other information.

[0020] The probability of the existence of different persons with the same identification matter is extremely low, and therefore if applicants having a similar -14 -appearance and different identification matter are found, the probability that at least one of the applicant or the previous applicant is committing application fraud is considered to be high, and the first application fraud determination is issued.

[0021] (2) A fraud detection device for checking and authenticating a person according to a second invention may be such that, in the fraud detection device for checking and authenticating a person according to the one aspect, the application data comparison unit additionally compares the identification matter data of the applicant to the identification matter data of a previous applicant accumulated in the applicant database, and the application fraud determination unit issues the first application fraud determination if the appearance data of the applicant is not similar to the appearance data of the previous applicant when the application data comparison unit finds the identification matter data of the previous applicant that matches the identification matter data of the applicant.

[0022] If the identification matter matches the identification matter data of the previous applicant but the appearance is not similar to the appearance of the previous applicant, the probability that the same person is impersonating a person with different identification -15 -matter is considered to be high, and therefore the first application fraud determination is issued.

[0023] (3) A fraud detection device for checking and authenticating a person according to a third invention may be such that, in the fraud detection device for checking and authenticating a person according to the one aspect or the second invention, the application data comparison unit additionally compares the terminal identifier data of the applicant to the terminal identifier data of a previous applicant accumulated in the applicant database, and the application fraud determination unit issues the first application fraud determination if the appearance data of the applicant is not similar to the appearance data of the previous applicant or if the identification matter data of the applicant does not match the identification matter data of the previous applicant when the application data comparison unit finds the terminal identifier data of the previous applicant that matches the terminal identifier data of the applicant.

[0024] For the terminal identifier, "a combination of terminal information such as operating system (03) type and version, browser type and version, and terminal model", "a universally unique identifier (UUID) issued for software installed in the terminal", or the like can be used, for example.

-16 -[0025] (4) A fraud detection device for checking and authenticating a person according to a fourth invention may be such that the fraud detection device for checking and authenticating a person according to any from the one aspect to the third invention further includes a greylist database that records the appearance data, the identification matter data, and the terminal identifier data of the applicant for whom the application fraud determination unit issues the first application fraud determination.

[0026] There is a possibility that an applicant who has submitted a fraudulent application in a previous identity application may also submit a fraudulent application in a subsequent application. Consequently, by creating and using the greylist database that records the appearance, identification matter, and terminal identifier of applicants for whom the first application fraud determination or the second application fraud determination is issued, the comprehensiveness of application fraud detection can be increased.

[0027] (5) A fraud detection device for checking and authenticating a person according to a fifth invention may be such that, in the fraud detection device for checking and authenticating a person according to the fourth invention, the greylist database allows -17 -registration of any data related to the applicant. For example, an operator that provides a service to an applicant or a system provider may register data automatically or manually.

[0028] In this case, necessary data can be registered in the greylist database according to the judgment of the operator that provides the service to an applicant, the system provider, or the like.

[0029] (6) A fraud detection device for checking and authenticating a person according to a sixth invention may be such that, in the fraud detection device for checking and authenticating a person according to the fourth or fifth invention, the application data comparison unit additionally compares the appearance data of the applicant to the appearance data of a previous applicant accumulated in the greylist database, and the application fraud determination unit issues a second application fraud determination if the application data comparison unit finds the appearance data of the previous applicant similar to the appearance data of the applicant.

[0030] In this case, by performing a search to know whether a previous applicant with appearance data similar to the appearance data of the applicant exists in the greylist database, the comprehensiveness of application fraud detection can be increased.

-18 -[0031] (7) A fraud detection device for checking and authenticating a person according to a seventh invention may be such that, in the fraud detection device for checking and authenticating a person according to any from the fourth to sixth inventions, the application data comparison unit additionally compares the identification matter data of the applicant to the identification matter data of a previous applicant accumulated in the greylist database, and the application fraud determination unit issues a second application fraud determination if the application data comparison unit finds the identification matter data of the previous applicant identical to the identification matter data of the applicant.

[0032] In this case, by performing a search to know whether a previous applicant with identification matter matching the identification matter of the applicant exists in the greylist database, the comprehensiveness of application fraud detection can be increased.

[0033] (8) A fraud detection device for checking and authenticating a person according to an eighth invention may be such that, in the fraud detection device for checking and authenticating a person according to any from the fourth to seventh inventions, the application data comparison unit additionally compares the terminal identifier data of the applicant to the terminal -19 -identifier data of a previous applicant accumulated in the greylist database, and the application fraud determination unit issues a second application fraud determination if the application data comparison unit finds the terminal identifier data of the previous applicant that matches the terminal identifier data of the applicant.

[0034] In this case, by performing a search to know whether a previous applicant with terminal identifier data matching the terminal identifier data of the applicant exists in the greylist database, the comprehensiveness of application fraud detection can be increased.

[0035] (9) A fraud detection device for checking and authenticating a person according to a ninth invention may be such that, in the fraud detection device for checking and authenticating a person according to any from the one aspect to the eighth invention, the applicant database and the greylist database are constructed across a plurality of operators that provide services to the applicant.

[0036] An applicant who submits fraudulent applications for checking themselves will often apply to open an account or the like to a plurality of operators that provide services, such as a plurality of banks, using the same appearance data with a plurality of pieces of -20 -different identification matter, a plurality of different appearances with the same identification matter, or the same terminal with a plurality of pieces of different identification matter/appearances.

The fraud detection device for checking and authenticating a person according to the fourth invention can determine that applications are fraudulent even in the case in which the applicant applies to open an account or the like using the same appearance data with a plurality of pieces of different identification matter, a plurality of different appearances with the same identification matter, or the same terminal with a plurality of pieces of different identification matter/appearances among a plurality of operators.

If an applicant is recorded in the greylist database for a certain operator, the fraud detection device can detect as fraudulent even in the case the application is submitted to another operator.

[0037] (10) A fraud detection device for checking and authenticating a person according to a 10th invention may be such that, in the fraud detection device for checking and authenticating a person according to any from the one aspect to the ninth invention, the application data reception unit additionally receives an access source IF' address of the applicant at the time of application, and the application fraud determination unit issues the first -21 -application fraud determination if the access source IP address is suspicious.

Cases in which the IP address is suspicious include, for example, the case in which the country code of the IP address is not Japan or the case in which the IP address seems to he using an anonymous network.

[0038] In some cases, an applicant who submits a fraudulent identity application applies via a network outside the country or via an anonymous network.

The fraud detection device for checking and authenticating a person according to the fifth invention can detect that an application is fraudulent in such cases.

[0039] (11) A fraud detection device for checking and authenticating a person according to an 11th invention may be such that, in the fraud detection device for checking and authenticating a person according to any from the one aspect to the 10th invention, the application data reception unit additionally receives an address of the applicant, and the application fraud determination unit issues the first application fraud determination if the address of the applicant is not a real address or is a suspicious address.

[0040] A fraudulent application for opening an account or user registration may include a fictitious address as the address of the applicant in some cases.

-22 -The fraud detection device for checking and authenticating a person according to the 11th invention can detect that an application is fraudulent in the case in which the address written on the application form is not a real address or an unoccupied house. In detecting whether an application is fraudulent, the address of the applicant may be verified with any data or information, such as a commercial database, for example.

[0041] (12) A fraud detection device for checking and authenticating a person according to a 12th invention may be such that, in the fraud detection device for checking and authenticating a person according to any from the one aspect to the 11th invention, the application data reception unit additionally receives a telephone number of the applicant, and the application fraud determination unit issues the first application fraud determination if the telephone number of the applicant does not exist or is a suspicious telephone number.

[0042] A fraudulent application for opening an account or user registration may include a fictitious telephone number or a telephone number for which the payment of usage fees is overdue as the telephone number of the applicant in some cases.

The fraud detection device for checking and authenticating a person according to the 12th invention can detect that an application is fraudulent in the case -23 -in which the telephone number written on the application form is not a real telephone number, a telephone number for which the payment of usage fees is overdue, or the like. In detecting whether an application is fraudulent, the telephone number of the applicant may be verified with any data or information, such as a commercial database, for example.

[0043] (13) A fraud detection device for checking and authenticating a person according to a 13th invention may be such that, in the fraud detection device for checking and authenticating a person according to any from the one aspect to the 12th invention, the application fraud determination unit issues the first application fraud determination if the identification matter data of the applicant corresponds to a person under surveillance. [0044] In this case, the first application fraud determination can be issued for the person under surveillance.

[0045] (14) An application fraud detection method for checking and authenticating a person according to another aspect includes: an application data receiving step of receiving at least one of appearance data of an applicant, identification matter data of the applicant, and terminal -24 -identifier data of an application terminal of the applicant; an application data accumulating step of accumulating, in an applicant database, the appearance data, the identification matter data, and the terminal identifier data received in the application data receiving step; an application data comparing step of comparing the appearance data of the applicant to the appearance data of a previous applicant accumulated in the applicant database and comparing the identification matter data of the applicant to the identification matter data of a previous applicant accumulated in the applicant database; and an application fraud determining step of issuing a first application fraud determination, wherein if the identification matter data of the applicant does not match the identification matter data of the previous applicant when the appearance data of the previous applicant similar to the appearance data of the applicant is found in the application data comparing step, or first application fraud determination is issued. [0046] The application fraud detection method for checking and authenticating a person according to another aspect is the invention of an application fraud detection -25 -method corresponding to the fraud detection device for checking and authenticating a person according to the one aspect and the second invention.

[0047] (15) An application fraud detection program for checking and authenticating a person according to yet another aspect includes: an application data receiving process of receiving at least one of appearance data of an applicant, identification matter data of the applicant, and terminal identifier data of an application terminal of the applicant; an application data accumulating process of accumulating, in an applicant database, the appearance data, the identification matter data, and the terminal identifier data received in the application data receiving process; an application data comparing process of comparing the appearance data of the applicant to the appearance data of a previous applicant accumulated in the applicant database and comparing the identification matter data of the applicant to the identification matter data of a previous applicant accumulated in the applicant database; and an application fraud determining process of issuing a first application fraud determination, wherein if the identification matter data of the applicant does not match the identification matter data of the -26 -previous applicant when the appearance data of the previous applicant similar to the appearance data of the applicant is found in the application data comparing process, or first application fraud determination is issued. [0048] The application fraud detection program for checking and authenticating a person according to yet another aspect is the invention of an application fraud detection program corresponding to the fraud detection device for checking and authenticating a person according to the one aspect and the second invention.

Brief Description of Drawings

[0049] [Figure 1] Figure 1 is a schematic conceptual diagram of a system for checking or authenticating a person including a fraud detection device in an embodiment.

[Figure 2] Figure 2 is a schematic diagram illustrating a configuration of the fraud detection device.

[Figure 3] Figure 3 is a table illustrating an example of an applicant database.

[Figure 4] Figure 4 is a table illustrating an example of a greylist database.

[Figure 5] Figure 5 is a schematic flowchart illustrating an example of an application fraud determination by -27 -appearance, identification matter, and application terminal identifier.

[Figure 6] Figure 6 is a schematic flowchart illustrating an example of the application fraud determination by comparison with a greylist database.

[Figure 7] Figure 7 is a schematic flowchart illustrating an example of the application fraud determination by access source IP address, address, telephone number, and comparison with a person under surveillance.

Description of Embodiment

[0050] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. In the following description, the same components are denoted with the same signs. The names and functions of these components are also the same. Consequently, a detailed description of these components is not repeated.

[0051] [Embodiment] (Overall configuration of system 60 for checking or authenticating person including fraud detection device 30) Figure 1 is a schematic overall configuration diagram of a system 60 for checking or authenticating a person including a fraud detection device 30 according to the present embodiment, and Figure 2 is a schematic -28 -diagram illustrating an example of the configuration of the fraud detection device 30.

[0052] As illustrated in Figure 1, the system 60 for checking or authenticating a person includes an applicant terminal 10, a receiving terminal 20, the fraud detection device 30, and an operator terminal 50. Note that an applicant database 40 and a greylist database 45 are included in the fraud detection device 30, but the applicant database 40 and the greylist database 45 are databases shared with the fraud detection device 30 included in other identity verification or identity authentication systems 60 for checking or authenticating a person.

Applicant application data 70, such as appearance, identification matter, address, and telephone number, is transmitted from the applicant terminal 10 to the receiving terminal 20. Also, the receiving terminal 20 obtains a terminal identifier and the IP address of the applicant terminal 10, wherein the terminal identifier is based on a combination of the OS type and version of the applicant terminal 10, a browser type and version, terminal model name, and the like.

The applicant application data 70, such as appearance, identification matter, address, and telephone number, received by the receiving terminal 20 is transmitted to the operator terminal 50.

-29 -In addition, application data 80, including the applicant application data 70, such as appearance, identification matter, address, and telephone number, and the terminal identifier and IP address of the applicant terminal 10, received by the receiving terminal 20, is also transmitted to the fraud detection device 30.

The fraud detection device 30 accumulates the received application data 80 in the applicant database 40 and uses the application data 80 accumulated in the applicant database 40 by its own fraud detection device 30 and other fraud detection devices 30 to determine the presence or absence of application fraud, and transmits an application fraud determination result 100 to the operator terminal 50.

[0053] As illustrated in Figure 2, the fraud detection device 30 includes an application data reception unit 110, an application data comparison unit 120, an application fraud determination unit 130, the applicant database 40, and the greylist database 45. The applicant database 40 and the greylist database 45 are databases shared with the fraud detection device 30 included in other systems 60 for checking or authenticating a person.

The appearance of the applicant, identification matter, address, telephone number, terminal identifier and IP address of the applicant terminal 10, and the like received by the application data reception unit 110 are -30 -accumulated in the applicant database 40 and sent to the application data comparison unit 120.

The application data comparison unit 120 compares the appearance and identification matter of the applicant, the terminal identifier and IF address of the applicant terminal 10, and the like to the data accumulated in the applicant database 40 and sends a comparison result to the application fraud determination unit 130.

The application fraud determination unit 130 uses the result of the comparison between the data of the applicant and the data accumulated in the applicant database 40 sent from the application data comparison unit 120 and commercial databases for real address determination, real telephone number determination, and IF address determination, for example, to determine whether an application for checking a person is fraudulent. Details about the application fraud determination are described later in (Application fraud determination flowcharts).

The application fraud determination result 100 is transmitted to the operator terminal 50 and is added to the greylist database 45 in the case of a newly determined application fraud.

[0054] (Example configuration of applicant database 40) Figure 3 illustrates an example of the applicant database 40.

-31 -The applicant database 40 contains identification matter data, appearance data, application terminal identifier, access source IP address, address, and the like. The identification matter data is, for example, name, date of birth, address, driver's license number, and the like.

[0055] (Example configuration of greylist database 45) Figure 4 illustrates an example of the greylist database 45.

The greylist database 45 contains the application fraud determination result 100 in addition to the data in the applicant database 40 above. Note that it is desirable for the application fraud determination result 100 field to contain specific details, such as "Reuse of appearance" and "Reuse of identification matter".

The greylist database 45 may also allow registration of any data by operators that provide services to applicants.

[0056] (Application fraud determination flowcharts) Figures 5 to 7 illustrate flowcharts of the application fraud determination. Figure 5 is a flowchart of the application fraud determination by appearance, identification matter, and application terminal identifier, Figure 6 is a flowchart of the application fraud determination by comparison with the greylist database 45, and Figure 7 is a flowchart of the application fraud determination by access source IP -32 -address, address, telephone number, and comparison with a person under surveillance.

[0057] First, the flowchart in Figure 5 of the application fraud determination by appearance, identification matter, and application terminal identifier will be described.

(Si) The application data reception unit 110 receives data such as appearance, identification matter, application terminal identifier, IP address, address, and telephone number.

(S2) The application data reception unit 110 sends the received data to the applicant database 40, and the applicant database 40 accumulates the received data. At this time, the application data reception unit 110 also sends the received data to the application data comparison unit 120.

(53, 54) The application data comparison unit 120 compares the appearance sent from the application data reception unit 110 to appearances in the data accumulated in the applicant database 40, and checks whether an applicant with a similar appearance exists in the applicant database 40. The result of the comparison is sent to the application fraud determination unit 130.

(S5-S7) If an applicant with a similar appearance exists in the applicant database 40 according to the sent comparison result, the application fraud determination unit 130 compares the identification matter of the -33 -applicant to the identification matter of the applicant with a similar appearance. If the identification matter of the applicant and the identification matter of the applicant with a similar appearance are different, the first application fraud determination (reuse of appearance) is issued, the application fraud determination result 100 is transmitted to the operator terminal 50, and the applicant is registered in the greylist database 45.

[0058] (58, 59) The application data comparison unit 120 compares the identification matter sent from the application data reception unit 110 to identification matter in the data accumulated in the applicant database 40, and checks whether an applicant with the same identification matter exists in the applicant database 40. The result of the comparison is sent to the application fraud determination unit 130.

(510-512) If an applicant with the same identification matter as the applicant exists in the applicant database 40 according to the sent comparison result, the application fraud determination unit 130 compares the appearance of the applicant to the appearance of the applicant with the same identification matter. If the appearance of the applicant and the appearance of the applicant with the same identification matter are different, the first application fraud determination (reuse of identification matter) is issued, -34 -the application fraud determination result 100 is transmitted to the operator terminal 50, and the applicant is registered in the greylist database 45. [0059] (313, 314) The application data comparison unit 120 compares the terminal identifier sent from the application data reception unit 110 to terminal identifiers in the data accumulated in the applicant database 40, and checks whether an applicant with the same terminal identifier exists in the applicant database 40. The result of the comparison is sent to the application fraud determination unit 130.

(S15-S18) If an applicant with the same terminal identifier exists in the applicant database 40 according to the sent comparison result, the application fraud determination unit 130 compares the appearance of the applicant to the appearance of the applicant with the same terminal identifier. If the appearance of the applicant is similar to the appearance of the applicant with the same terminal identifier, the identification matter of the applicant is further compared to the identification matter of the applicant with the same terminal identifier. If the appearance of the applicant is not similar to the appearance of the applicant with the same terminal identifier, or if the identification matter of the applicant is different from the identification matter of the applicant with the same terminal identifier, the first application fraud -35 -determination (reuse of terminal identifier) is issued, the application fraud determination result 100 is transmitted to the operator terminal 50, and the applicant is registered in the greylist database 45. [0060] Next, the flowchart in Figure 6 of the application fraud determination by comparison with the greylist database 45 will be described.

(519, 520) The application data comparison unit 120 compares the appearance sent from the application data reception unit 110 to appearances in the data accumulated in the greylist database 45, and checks whether an applicant with a similar appearance exists in the greylist database 45. The result of the comparison is sent to the application fraud determination unit 130.

(S21, S22) The application data comparison unit 120 compares the identification matter sent from the application data reception unit 110 to the identification matter in the data accumulated in the greylist database 45, and checks whether an applicant with the same identification matter exists in the greylist database 45. The result of the comparison is sent to the application fraud determination unit 130.

(523, 324) The application data comparison unit 120 compares the terminal identifier sent from the application data reception unit 110 to terminal identifiers in the data accumulated in the greylist database 45, and checks whether an applicant with the -36 -same terminal identifier exists in the greylist database 45. The result of the comparison is sent to the application fraud determination unit 130.

(325) If an applicant with an appearance similar to the appearance of the applicant exists in the greylist database 45, if an applicant with the same identification matter as the applicant exists in the greylist database 45, or if an applicant with the same terminal identifier as the applicant exists in the greylist database 45 according to the sent comparison result, the application fraud determination unit 130 issues the second application fraud determination and transmits the application fraud determination result 100 to the operator terminal 50.

[0061] Next, the schematic flowchart in Figure 7 illustrating an example of the application fraud determination by access source IP address, address, telephone number, and comparison with a person under surveillance will be described.

(S27, S28 and S32, S33) The application fraud determination unit 130 uses a commercial database for IP address determination, and if the IP address is suspicious, such as if the IP address of the access source is an IF address outside Japan or an IP address used on an anonymous network, the application fraud determination unit 130 issues the first application fraud determination (suspicious IP address), transmits the -37 -application fraud determination result 100 to the operator terminal 50, and registers the applicant in the greylist database 45.

(329 and 332, 333) The application fraud determination unit 130 uses a commercial database for real address determination to check whether the address of the applicant is a real address, and if the address is not real, the application fraud determination unit 130 issues the first application fraud determination (suspicious address), transmits the application fraud determination result 100 to the operator terminal 50, and registers the applicant in the greylist database 45.

(330 and 332, 333) The application fraud determination unit 130 uses a commercial database for real telephone number determination to check whether the telephone number of the applicant is a real telephone number, and if the telephone number is not real, the application fraud determination unit 130 issues the first application fraud determination (suspicious telephone number), transmits the application fraud determination result 100 to the operator terminal 50, and registers the applicant in the greylist database 45.

(331 and 332, 333) The application fraud determination unit 130 uses a commercial database for looking up persons under surveillance to check whether the applicant corresponds to a person under surveillance, and if the applicant corresponds to a person under -38 -surveillance, the application fraud determination unit 130 issues the first application fraud determination (corresponds to person under surveillance), transmits the application fraud determination result 100 to the operator terminal 50, and registers the applicant in the greylist database 45.

Note that in the above flowcharts of the application fraud determination, if neither the first application fraud determination nor the second application fraud determination is issued, the application fraud determination unit 130 transmits the application fraud determination result 100 to the operator terminal 50 at the end of the applicant fraud determination.

[0062] In the present embodiment, the application data reception unit 110 corresponds to the "application data reception unit", the applicant database 40 corresponds to the "applicant database", the application data comparison unit 120 corresponds to the "application data comparison unit", the application fraud determination unit 130 corresponds to the "application fraud determination unit", the fraud detection device 30 corresponds to the "fraud detection device", and the greylist database 45 corresponds to the "greylist database".

[0063] The foregoing describes a preferred embodiment of the present invention, but the present invention is not solely limited thereto. It should be understood that various embodiments are possible without departing from -39 -the spirit and scope of the present invention. Furthermore, actions and effects obtained by a configuration of the present invention are described in the present embodiment, but these actions and effects are merely examples and do not limit the present invention.

Reference Signs List [0064] 30 Fraud detection device Applicant database Greylist database Applicant application data Application data reception unit Application data comparison unit Application fraud determination unit

Claims

-40 -Claims [Claim 1] A fraud detection device for checking and authenticating a person, comprising: an application data reception unit that receives at least one of appearance data of an applicant, identification matter data of the applicant, and terminal identifier data of an application terminal of the applicant; an applicant database that accumulates the appearance data, the identification matter data, and the terminal identifier data received by the application data reception unit; an application data comparison unit that compares the appearance data of the applicant to the appearance data of a previous applicant accumulated in the applicant database; and an application fraud determination unit that issues a first application fraud determination if the identification matter data of the applicant does not match the identification matter data of the previous applicant when the application data comparison unit finds the appearance data of the previous applicant similar to the appearance data of the applicant.
[Claim 2] -41 -The fraud detection device for checking and authenticating a person according to claim 1, wherein the application data comparison unit additionally compares the identification matter data of the applicant to the identification matter data of a previous applicant accumulated in the applicant database, and the application fraud determination unit issues the first application fraud determination if the appearance data of the applicant is not similar to the appearance data of the previous applicant when the application data comparison unit finds the identification matter data of the previous applicant that matches the identification matter data of the applicant.
[Claim 3] The fraud detection device for checking and authenticating a person according to claim 1 or 2, wherein the application data comparison unit additionally compares the terminal identifier data of the applicant to the terminal identifier data of a previous applicant accumulated in the applicant database, and the application fraud determination unit issues the first application fraud determination if the appearance data of the applicant is not similar to the appearance data of the previous applicant or if the identification matter data of the applicant does not match the identification matter data of the previous applicant when -42 -the application data comparison unit finds the terminal identifier data of the previous applicant that matches the terminal identifier data of the applicant.
[Claim 4] The fraud detection device for checking and authenticating a person according to any one of claims 1 to 3, further comprising a greylist database that records the appearance data, the identification matter data, and the terminal identifier data of the applicant for whom the application fraud determination unit issues the first application fraud determination.
[Claim 5] The fraud detection device for checking and authenticating a person according to claim 4, wherein the greylist database allows registration of any data related to the applicant.
[Claim 6] The fraud detection device for checking and authenticating a person according to claim 4 or 5, wherein the application data comparison unit additionally compares the appearance data of the applicant to the appearance data of a previous applicant accumulated in the greylist database, and the application fraud determination unit issues a second application fraud determination if the application -43 -data comparison unit finds the appearance data of the previous applicant similar to the appearance data of the applicant.
[Claim 7] The fraud detection device for checking and authenticating a person according to any one of claims 4 to 6, wherein the application data comparison unit additionally compares the identification matter data of the applicant to the identification matter data of a previous applicant accumulated in the greylist database, and the application fraud determination unit issues a second application fraud determination if the application data comparison unit finds the identification matter data of the previous applicant identical to the identification matter data of the applicant.
[Claim 8] The fraud detection device for checking and authenticating a person according to any one of claims 4 to 7, wherein the application data comparison unit additionally compares the terminal identifier data of the applicant to the terminal identifier data of a previous applicant accumulated in the greylist database, and the application fraud determination unit issues a second application fraud determination if the application data comparison unit finds the terminal identifier data -44 -of the previous applicant that matches the terminal identifier data of the applicant.
[Claim 9] The fraud detection device for checking and authenticating a person according to any one of claims 1 to 8, wherein the applicant database and the greylist database are constructed across a plurality of operators that provide services to the applicant.
[Claim 10] The fraud detection device for checking and authenticating a person according to any one of claims 1 to 9, wherein the application data reception unit additionally receives an access source IP address of the applicant at the time of application, and the application fraud determination unit issues the first application fraud determination if the access source IP address is suspicious.
[Claim 11] The fraud detection device for checking and authenticating a person according to any one of claims 1 to 10, wherein the application data reception unit additionally receives an address of the applicant, and the application fraud determination unit issues the first application fraud determination if the address of -45 -the applicant is not a real address or is a suspicious address.
[Claim 12] The fraud detection device for checking and authenticating a person according to any one of claims 1 to 11, wherein the application data reception unit additionally receives a telephone number of the applicant, and the application fraud determination unit issues the first application fraud determination if the telephone number of the applicant does not exist or is a suspicious telephone number.
[Claim 13] The fraud detection device for checking and authenticating a person according to any one of claims 1 to 12, wherein the application fraud determination unit issues the first application fraud determination if the identification matter data of the applicant corresponds to a person under surveillance.
[Claim 14] An application fraud detection method for checking and authenticating a person, comprising: an application data receiving step of receiving at least one of appearance data of an applicant, identification matter data of the applicant, and terminal -46 - (identifier data of an application terminal of the applicant; an application data accumulating step of accumulating, in an applicant database, the appearance data, the identification matter data, and the terminal identifier data received in the application data receiving step; an application data comparing step of comparing the appearance data of the applicant to the appearance data of a previous applicant accumulated in the applicant database; and an application fraud determining step of issuing a first application fraud determination if the identification matter data of the applicant does not match the identification matter data of the previous applicant when the appearance data of the previous applicant similar to the appearance data of the applicant is found in the application data comparing step.
[Claim 15] An application fraud detection program for checking and authenticating a person, comprising: an application data receiving process of receiving at least one of appearance data of an applicant, identification matter data of the applicant, and terminal identifier data of an application terminal of the applicant; -47 -an application data accumulating process of accumulating, in an applicant database, the appearance data, the identification matter data, and the terminal identifier data received in the application data receiving process; an application data comparing process of comparing the appearance data of the applicant to the appearance data of a previous applicant accumulated in the applicant database; and an application fraud determining process of issuing a first application fraud determination if the identification matter data of the applicant does not match the identification matter data of the previous applicant when the appearance data of the previous applicant similar to the appearance data of the applicant is found in the application data comparing process.