JP2007115141A - Card payment authentication server and card payment authentication method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a card payment authentication server capable of sufficiently securing security against an impersonation without deteriorating service to a user, and a card payment authentication method. <P>SOLUTION: The card payment authentication server 1 stores the addresses of sending destinations of merchandise designated by past purchase requests for merchandise due to the impersonation in a first database 14. When the card payment authentication server 1 receives a purchase request for merchandise transmitted from a user terminal 4, the card payment authentication server 1 collates the address of a sending destination of the merchandise designated in the purchase request for the merchandise with the addresses stored in the first database 14 to determine whether the purchase request for the merchandise of this time is aimed to swindle the merchandise due to the impersonation. When it is determined that the purchase request is aimed to swindle the merchandise, the card payment authentication server 1 stops the transaction. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a card payment authentication server and a card payment authentication method for determining whether or not a transaction by card payment is possible at a merchandise sales site operated on a network such as the Internet.

  Conventionally, when a purchase request for a product from a user is received on a network such as the Internet, a product sales site that conducts a transaction called online shopping has been operated in which the corresponding product is shipped to a shipping destination designated by the user. Yes. In this online shopping, as is well known, a user operates a user terminal such as a personal computer or a mobile phone at home to access the product sales site and operate the product sales site to request purchases of products desired to be purchased. To the active server. When the server receives a product purchase request from the user, the server determines whether to permit or reject the transaction related to the product purchase request. When it is determined that the transaction is permitted, the product requested to be purchased by the user is ordered from the store, and the user is notified by e-mail or the like that the order of the product has been accepted. On the other hand, if the server determines that the transaction relating to the purchase request for the product from the user is rejected, the server does not place an order for the product to the store. In addition, the user is notified by e-mail or the like that an order for a product cannot be accepted.

  In transactions in the above-mentioned online shopping, in many cases, the transaction amount is settled by card settlement using a credit card, debit card or the like (hereinafter simply referred to as a card). When the transaction amount is set to card payment, the user, when purchasing a product sold on the product sales site, the card number of the card used to settle the transaction amount, the expiration date of this card, the shipping address of the product Information such as an address is input at the user terminal, and an input operation related to transmission of a purchase request for the product is performed. The user terminal transmits a purchase request for a product including the information input by the user to the server. The server transmits an authentication request including information such as a card number, a card expiration date, and a transaction amount included in the purchase request to the card company. The card company authenticates the transaction by determining whether the card is valid / invalid or whether the transaction does not exceed the credit limit. The card company returns the authentication result to the server. Based on the authentication result in the card company, the server determines whether or not the transaction for the purchase request for the current product is possible.

  Note that the server requests the card company to settle the transaction amount when it receives a reply from the store after placing an order for the product with the store. As a result, the card company performs processing related to card payment.

By the way, recently, when purchasing a product through online shopping, crimes (so-called impersonation) of fraudulently fraudulently using the card information (card number and card expiration date) of other people's cards that have been obtained illegally have increased. Therefore, there is a strong demand for improved security against this impersonation. Damage caused by this impersonation will be incurred by the store or the card company. In response to this request,
1. 1. The same card has been used “X” times in the past “Y” minutes. 2. The same card has been requested to be settled at a location "X" kilometers away for the past "Y" minutes. Payment request from the same card, but the user's name has changed "X" times in the past "Y" days. Payment request from the same card, but “X” times changed in the past “Y” days, such as goods delivery address, user address, telephone number, etc. The same user has purchased goods using “X” cards in the past “Y” days. The same user has changed the name “X” times during the past “Y” days (identifies the same user by address and telephone)
7). The same user purchased a highly cashable item “X” times in the past “Y” days. If the same user has purchased a product through the ISP of “X” during the past “Y” days, it is likely to be impersonated and the transaction is allowed. In addition, a system for canceling is proposed (see Patent Document 1).
WO2003 / 032219

  However, Patent Literature 1 has a configuration in which whether or not impersonation is performed is determined based on a usage history of a card used for card payment or a purchase history of a user who has purchased a product. For this reason, in the configuration of Patent Document 1, when a card for which card information is illegally obtained is repeatedly used as a card used for card payment, or when a purchase request for a product by card payment with the same user name is made. Only when it was repeated many times could it be determined that the transaction was fraudulent due to impersonation. In other words, when the card used for each transaction (actually card information) is changed or the name of the authorized user of the card used is used, the configuration of Patent Document 1 accurately determines impersonation. I could not. Therefore, there is a problem that security against impersonation is not sufficiently secured.

  In addition, as one idea for improving the security against impersonation, there is also a proposal of cash on delivery processing that is performed when a product is received for settlement of a transaction amount in online shopping. However, in this case, it becomes impossible for the user to purchase the product as a gift for his / her friend or the like (the address of the friend who gives the product or the like cannot be designated as the shipping destination of this product). ). In other words, the method of purchasing products using online mail order is restricted for the user, which causes another problem such as a decrease in service to the user and a decrease in sales accompanying this.

  An object of the present invention is to provide a card payment authentication server and a card payment authentication method that can sufficiently ensure the security against impersonation without degrading the service to the user.

  The card payment authentication server of the present invention has the following configuration in order to solve the above problems.

(1) a purchase request accepting means for accepting a transmitted purchase request for a product by card settlement;
A storage unit that stores a shipping destination of a product that does not permit a transaction in response to a purchase request for the product by card payment received by the purchase request receiving unit;
About the purchase request of the product by the card settlement accepted by the purchase request acceptance unit, the transaction is made for the shipping destination of the product included in the purchase request of the product and the purchase request of the product by the card settlement stored in the storage unit A first determination means for determining whether or not to permit the transaction,
About the purchase request of the product by the card settlement received by the purchase request receiving means, a transaction authentication request including the card number included in the purchase request for the product is transmitted to the card company, and whether or not the card company can accept the transaction is confirmed. An authentication result acquisition means for acquiring an authentication result including:
When a purchase request for a product by card settlement accepted by the purchase request acceptance unit is determined by the first determination unit to permit the transaction, and the authentication result acquired by the authentication result acquisition unit is transactable Ordering means for placing an order for goods.

  In this configuration, in response to a purchase request for a product by card settlement, the storage unit stores a delivery destination of the product for which the transaction is rejected, for example, a delivery destination of the product designated in the past by the purchase request for the product by impersonation. . When the purchase request accepting unit accepts the purchase request for the product, the first determination unit matches the shipping destination of the product included in the purchase request for the product with the shipping destination of the product stored in the storage unit. It is determined whether or not the transaction for the purchase request of the product is permitted. The first determination means may determine that the transaction is rejected when it is determined that the shipping destination of the product included in the purchase request for the current product is the shipping destination of the product stored in the storage means.

  Also, the authentication result acquisition means makes a transaction authentication request to the card company and acquires the authentication result. Then, when the ordering unit determines that the first determination unit permits the transaction, and the authentication result acquired by the authentication result acquisition unit is transactable, the product is ordered. In other words, if the first determination means determines that the transaction is rejected, or if the authentication result acquired by the authentication result acquisition means is non-transactionable, the transaction for the current product purchase request is rejected and the product is ordered. Do not do.

  In this way, whether or not a transaction for a purchase request for a product is possible is determined not only by authenticating the card used for settlement of the transaction amount, but also by authenticating the shipping destination of the product, so the card used for card settlement Fraudulent transactions aimed at fraudulent merchandise, even if the card (which has been obtained fraudulently) is changed for each transaction, or even if the card and user name are changed for each transaction It can be determined that this is a request. Normally, when performing an illegal transaction for the purpose of fraudulent product, it is necessary to receive this product at the shipping destination of the product, so the shipping destination of the product specified by the fraudulent transaction due to past impersonation If it is earlier, there is a very high possibility that it is a request for fraudulent transactions for the purpose of fraud of goods. Accordingly, it is possible to improve the security of transactions by card payment in online shopping and the like. In addition, there is no problem such as a decrease in service to users and a decrease in sales accompanying this.

  (2) The first determination means includes a shipping address of a product included in the purchase request for the product, and a storage means for the purchase request of the product by card settlement accepted by the purchase request accepting means. It is means for determining whether or not to permit the transaction based on the degree of coincidence with the address of the shipping address of the product that refuses the transaction based on the stored card settlement.

  In this configuration, in consideration of the fact that there are various notation formats even if the address is the same, the first determination means uses the address of the shipping address of the product included in the purchase request for the product. Whether the transaction is permitted or not is determined based on the degree of coincidence with the address of the shipping address of the product that refuses the transaction by card settlement stored in the storage means. For example, in the case of a street address, “1-2-3 No. 1”, “1-2-3”, “1-2 1-3”, etc. all indicate the same address. As a result, the same address is used even if the shipping address of the product included in the purchase request for the product and the address of the shipping address of the product that refuses the transaction by card settlement stored in the storage means are different. Can be determined to refuse the transaction.

  (3) When the authentication result acquired by the authentication result acquisition unit is transactable for the purchase request of the product by card settlement received by the purchase request reception unit, the first determination unit It is a means for determining whether or not a transaction relating to a purchase request is permitted.

  In this configuration, when an authentication result indicating that the transaction is permitted is obtained from the card company, it is determined whether or not the transaction is permitted by the first determination means. In other words, if an authentication result indicating that a transaction is permitted is not obtained from the card company, it is not determined whether or not the transaction is permitted by the first determination means. Therefore, useless determination processing by the first determination unit is not performed.

  (4) When a purchase request for a product by card settlement accepted by the purchase request acceptance unit is determined that the first determination unit does not permit a transaction, information relating to the purchase request for the product is determined in advance. It is provided with a delivery means for delivering to.

  In this configuration, the distribution means can notify, for example, a card company or a store of information relating to a request for fraudulent transactions for the purpose of fraudulent merchandise, such as a card number or a shipping address of the merchandise. Overall security can be improved.

(5) history storage means for storing a history of purchase requests for products by card payment accepted by the purchase request accepting means;
Shipment in which the number of times designated as the shipping destination of a product within a predetermined period in the purchase request of the product by card settlement is a predetermined number of times or more in the purchase request of the product by card settlement from the history of the purchase request of the product by card settlement stored in the history storage means An extraction means for extracting the destination as a shipping destination that does not allow the transaction;
About the purchase request of the product by the card settlement accepted by the purchase request accepting unit, the shipping destination of the product included in the purchase request for the product is matched with the shipping destination extracted by the extracting unit, and the transaction is permitted. A second determination means for determining whether or not
The ordering unit determines that the first determination unit and the second determination unit permit the transaction for the purchase request of the product by card settlement received by the purchase request reception unit, and the authentication result acquisition unit This is a means for placing an order for a product when the authentication result obtained by the customer is transactable.

  In this configuration, a purchase request that is frequently specified as the shipping destination of a product within a predetermined period is likely to be a fraudulent purchase request for the product by impersonation. As for purchase requests in which the number of times specified as “exceeds the predetermined number of times within a predetermined period”, it is determined that the transaction is rejected. Thereby, the security of the transaction by card payment can be further improved.

  According to the present invention, it is possible to improve the security of transactions by card settlement in online shopping and the like. Further, there is no limitation on the method of purchasing the product for the user, and there is no problem such as a decrease in service for the user and a decrease in sales accompanying this.

  Embodiments of the present invention will be described below.

  FIG. 1 is a diagram showing a configuration of a transaction processing system to which a card payment authentication server according to an embodiment of the present invention is applied. The transaction processing system of this embodiment operates a merchandise sales site on a network such as the Internet, and determines a card payment authentication server 1 that determines whether or not a transaction by card payment is possible, and a credit card or debit card (hereinafter referred to as a card payment). , Generically referred to as a card)) and a store apparatus 3 of a store that actually sells products sold on a merchandise sales site operated by the card payment authentication server 1 Are connected to the network 5. Also, 4 shown in FIG. 1 is a user terminal operated by a user who uses a merchandise sales site operated by the card payment authentication server 1. The user terminal 4 is an unspecified number of terminal devices such as a personal computer and a mobile phone that can access the merchandise sales site operated by the card payment authentication server 1 via the network 5. A card company 2 exists for each card company 2 used for card settlement, and each card company 2 is connected to the network 5. Furthermore, the store apparatus 3 exists for each store that actually sells products sold on the product sales site operated by the card payment authentication server 1, and the store apparatus 3 of each store is connected to the network 5. It is connected.

  FIG. 2 is a block diagram showing a functional configuration of the card payment authentication server according to the embodiment of the present invention. The card payment authentication server 1 issues an authentication request to the card company 2 about whether or not a transaction by card payment is possible, and an authentication result from the card company 2 to the card company 2 and the management function unit 11 that operates the product sales site on the network 5. The function unit 12 for the card company to be acquired, the first database 13 for storing the shipping destination of the product for which the transaction by card settlement is rejected, and the product from the user received at the product sales site operated by the management function unit 11 Using the second database 14 for storing purchase requests and the transaction history at the product sales site stored in the second database 14, the product is designated as a shipping destination within a predetermined period, for example, 10 days. The extraction function unit 15 that extracts a shipping destination whose number of times is a predetermined number of times, for example, 5 times or more, and the quotient included in the purchase request for the product from the user The shipping destination of the product stored in the first database 13 and the shipping destination of the product extracted by the extraction function unit 15 are matched, and the product included in the purchase request for the product from the user is matched. The shipping destination matching unit 16 for determining whether the shipping destination is the shipping destination of the product stored in the first database 13 or the shipping destination of the product extracted by the extraction function unit 15; And an ordering function unit 17 for performing such processing.

  The management function unit 11 accepts access from the user terminal 4 at the product sales site operated on the network 5. For example, the management function unit 11 receives a purchase request for a product sold on a managed product sales site from a user. This management function part 11 is a structure corresponded to the purchase request reception means said by this invention. The user accesses the product sales site operated by the management function unit 11, and performs an input operation related to the purchase of a product sold on this product sales site (a product that accepts a purchase request from the user on this site). Is performed at the user terminal 4. The user terminal 4 transmits a purchase request corresponding to the user's input operation to the management function unit 11 via the network 5. The purchase request transmitted from the user terminal 4 to the management function unit 11 includes the card number of the card used for settlement of the transaction amount, the expiration date of this card, the address of the shipping address of the purchased product, etc. ing.

  The card company support function unit 12 includes the card number of the card used for the settlement of the transaction amount included in the purchase request for the product transmitted from the user terminal 4, the expiration date of this card, and the user purchases the card. An authentication request including the transaction amount of the desired product is transmitted to the card company 2. The card company 2 determines whether or not it is a valid card that can be used for transactions using the card number included in the authentication request transmitted from the card company support function unit 12, the expiration date of this card, The amount of money is used to determine whether the transaction does not exceed the credit limit, and based on these determination results, the validity of the transaction is authenticated. The card company 2 returns the transaction authentication result to the card company corresponding function unit 12. This card company correspondence function part 12 is the structure corresponded to the authentication result acquisition means said by this invention.

  The card settlement authentication server 1 and the card company 2 do not communicate directly via the network 5 but communicate via a server not shown in FIG. This server determines the card company that issued the card of the card number included in the authentication request transmitted from the card settlement authentication server 1, and performs processing for transmitting the authentication request to the card company 2 determined here. Provide service. For this reason, the card payment authentication server 1 does not need to determine the card company 2 that issued the card having the card number included in the purchase request for the product.

  The first database 13 stores the address of the shipping destination of the product designated in the past by the product purchase request by impersonation. Regarding fraudulent transactions by impersonation, in many cases, the card company 2 charges the transaction amount to the authorized user of the card with the card number, and this user makes an offer of non-use. It turns out when there was. Each card company 2 investigates the contents of the fraudulent transaction by impersonation, and specifies the fraudulent transaction by impersonation using the card number of the card issued by the company. You have the shipping address for the product. In the transaction processing system of this embodiment, each card company 2 is provided with the address of the shipping destination of the designated product in an illegal transaction by impersonation, and this is sent to the first database 13 of the card settlement authentication server 1. To remember. The first database 13 is a database that stores the postal code of the shipping destination of the product provided from each card company 2 and the notation of the address in association with each other. This address format is based on a pre-determined method. For example, the head is the prefecture name, the name up to the town name is registered in the general zip code database, and the address format Stipulates “○ Chome ○ Address ○ No.”. This first database has a configuration corresponding to the storage means referred to in the present invention.

  In general, the time when the card company 2 charges the transaction amount to the user is a time delayed by about 1 to 2 months from the time when the transaction is actually performed. In other words, a time lag of about one to two months occurs until the card number used in the purchase request for an illegal product by impersonation is revealed.

  The second database 14 stores product purchase requests from users in an accumulative manner. Specifically, for each purchase request for a product, the card number of the card used for settlement, the expiration date of the card, the postal code of the shipping destination of the product, and the address are stored in association with each other. The address stored in the second database 14 may be based on a predetermined system such as the system in the first database 13 or may be actually input by the user. If the address stored in the second database 14 is determined according to a predetermined method, the process for extracting an address in the extraction function unit 15 described later is simplified. On the other hand, if the user actually inputs, when storing the purchase request for the product in the second database 14, the process of converting the address input by the user into a notation of a predetermined method is performed. It becomes unnecessary. The second database 14 has a configuration corresponding to the history storage means referred to in the present invention.

  The extraction function unit 15 uses the history of purchase requests for products stored in the second database 14 in an accumulative manner to extract the address of the shipping destination of the products specified a predetermined number of times within a predetermined period. At this time, the extraction function unit 15 searches the second database 14 using the address of the shipping address of the product as a key regardless of whether or not the card numbers of the cards used for the card settlement are the same. Count the number of times specified in the shipping address. Further, the extraction function unit 15 also extracts the zip code at the same time. If the notation format of the shipping address of the product stored in the second database 14 is based on a predetermined method such as the method in the first database 13, an address whose notation completely matches is searched. Therefore, the processing in the extraction function unit 15 is simplified. On the other hand, if the notation format of the shipping address of the product stored in the second database 14 is actually entered by the user, it is not sufficient to search for an address whose notation completely matches. . For example, even if the address is the same, it is determined that the address is “1-2-3” and “1-2-3” or “1 of 2-3” are different addresses. End up. For this reason, if the notation format of the shipping address of the product stored in the second database 14 is actually input by the user, it is determined from the degree of coincidence whether or not they are the same. . For example, we do not match the prefecture name, calculate the notation or reading match for the city name, and for the address, we use non-numeric characters (for example, “chome”, “number”, If there is a “No.” or “No”) or a symbol (eg “-”), etc., a delimiter is calculated and the degree of coincidence of the numbers included in each delimiter is calculated. Judge whether. In addition, the extraction function unit 15 stores a storage unit (not shown) that is extracted from the second database 14 and stores the postal code and address of the shipping destination of the product specified a predetermined number of times within a predetermined period in association with each other. Have. The address notation format stored in the extraction function unit 15 is the same as the method in the first database 13, and if the address notation format stored in the second database 14 is input by the user, Using an unillustrated postal code data database, the address extracted from the second database 14 is converted into the same notation format as the method in the first database 13 and stored. This extraction function part 15 is the structure corresponded to the extraction means said by this invention.

  The shipping address matching unit 16 includes the shipping address of the product included in the purchase request for the product received by the management function unit 11 from the user, and the shipping address of the product stored in the first database 13. To determine whether or not the shipping address of the product included in the purchase request for the product received from the user this time is the address stored in the first database 13. In addition, the shipping destination matching unit 16 extracts the address of the shipping destination of the product included in the purchase request for the product received from the user by the management function unit 11 and the extraction function unit 14 from the second database 14. The address of the shipping address of the product that is stored in the purchase request for the product received from the user this time is matched with the address of the shipping address of the stored product. Determine whether or not. The shipping destination abutting portion 16 corresponds to the first determining means and the second determining means referred to in the present invention. The ordering function unit 17 determines whether the transaction for the purchase request for the product transmitted from the user this time is possible based on the authentication result in the card company 2 and the address matching result in the shipping destination matching unit 16. Further, the ordering function unit 17 performs notification of a product ordering request to the store apparatus 3, notification of whether or not an order can be accepted in response to the current product purchase request to the user terminal 4, and the like. The ordering function unit 17 has a configuration corresponding to ordering means in the present invention.

  The operations of the above-described units of the card payment authentication server 1 are controlled by a main control unit (not shown).

  Next, the operation of transaction processing in this transaction processing system will be described. This transaction processing system is a system for processing transactions by so-called online mail order. The management function unit 11 of the card payment authentication server 1 operates a product sales site on the network 5. FIG. 3 is a flowchart showing the operation of the user terminal when the card payment authentication server purchases a product at a product sales site operated on the network. FIG. 4 is a flowchart showing the operation of the card payment authentication server according to the embodiment of the present invention.

  The user performs an input operation on the user terminal 4 for accessing the merchandise sales site operated by the management function unit 11 of the card settlement authentication server 1 on the network. In response to this input operation, the user terminal 4 accesses the merchandise sales site (s1). The user operates the user terminal 4 to check whether or not the product he / she wants to purchase is sold at this product sales site. If the product that the user wants to purchase is not sold at the product sales site, the user performs an input operation to stop access to the product sales site. On the other hand, when a product that the user wants to purchase is sold on the product sales site, the user performs an operation for purchasing the product. Specifically, by operating the user terminal 4, enter the product to be purchased, the card number of the card used for settlement of the transaction amount, the expiration date of this card, the address of the shipping address of the product, etc. Then, an input operation related to transmission of the purchase request is performed. The address of the shipping address of the product input here may be the address of the owner of the card of the input card number, that is, the user himself / herself, or may be another address. The reason for doing this is to provide a system that allows the user to purchase gifts for friends and the like. The user terminal 4 receives the identification code of the product designated by the user, the entered card number, the expiration date of the card, the address of the shipping address of the product, etc. as information related to the purchase request for the product (s2), A purchase request including these pieces of information is transmitted to the card settlement authentication server 1 (s3).

  Note that the user terminal 4 ends the processing shown in FIG. 3 when an input operation for stopping access to the merchandise sales site is performed. In addition, the user's name, address, e-mail address, etc. may be entered by the user as information related to the purchase request for the product. If the number of types of information to be input by the user is increased, improvement of security against impersonation can be expected, but the input operation of the user who purchases the product becomes complicated.

  When the card payment authentication server 1 receives the purchase request transmitted from the user terminal 4 by the operation function unit 11 (s11), the card number of the card used for the payment of the transaction amount included in the purchase request, An authentication request including information such as the expiration date of the card and the transaction amount of the product the user desires to purchase is transmitted from the card company support function unit 12 to the card company 2 (s12). In the card company 2, whether the card with the card number included in the transmitted authentication request is a valid card that can be used for the transaction, if it is a valid card, the expiration date is correct, It is determined whether or not the transaction by the current card settlement is performed within the range of the credit limit, and the transaction is authenticated based on these determination results. The authentication of the transaction in this card company 2 is the same method as before. The card company 2 returns an authentication result including whether or not the transaction is possible to the card settlement processing server 1 that has transmitted the authentication request this time.

  Note that the card settlement authentication server 1 and the card company 2 do not communicate directly via the network 5, but communicate via a server not shown in FIG. 1 as described above.

  When the card settlement authentication server 1 receives the authentication result transmitted from the card company 2 (s13), the card payment authentication server 1 determines whether the authentication result in the card company 2 is transactable or not transactable (s14). If the card settlement authentication server 1 determines that the authentication result is unsuccessful in s14, the card settlement authentication server 1 stops the current transaction (s15) and ends the present process. In s15, the reason that the card company 2 made the transaction impossible may be transmitted to the user terminal 4 as necessary. For example, if you suspect that the card number has been entered incorrectly, check the card number. If you exceed the credit limit, the credit limit will be exceeded. You cannot trade with this card. A message is transmitted to the user terminal 4. In addition, when the transaction is stopped in s15, a purchase request for the product including the user information, not the product order, is made to the store apparatus 3 of the store selling the product that the user desires to purchase. You may make it notify that there existed. In this way, the store side can grasp the user who wants to purchase the product, and can use this information for sales promotion activities and the like. In s15, information related to the purchase request for the current product is stored in the second database 14.

  If the card settlement authentication server 1 determines that the authentication result in the card company 2 is transactable in s14, the card settlement authentication server 1 registers the shipping address of the product included in the purchase request for the current product and the first database 13. The address of the shipping address of the product for which the transaction is rejected is matched, and it is determined whether or not the shipping address of the product included in the purchase request is the address stored in the first database 13. (S16). The address stored in the first database 13 is the address of the shipping destination of the product designated in the past for the purpose of fraud of the product, as specified in the purchase request of the product by impersonation, and the shipment of the product that refuses the transaction This is the previous address.

  Here, the processing according to s16 will be described in detail with reference to FIG. The card payment authentication server 1 extracts the name of the prefecture, the name of the municipality, and the town name from the address of the shipping address of the merchandise included in the merchandise purchase request (s31). The card payment authentication server 1 stores a postal code database (not shown) in which postal codes are associated with addresses. The card payment authentication server 1 searches the zip code database using the prefecture name, city name, and town name extracted in s31, and acquires the zip code of this address (s32). The card payment authentication server 1 determines whether or not the corresponding zip code is stored in the first database 13 using the zip code acquired in s32 as a key (s33). As described above, the first database 13 stores postal codes and addresses in association with each other.

  If the card payment authentication server 1 determines that the postal code corresponding to the first database 13 is not stored in s33, the address of the shipping address of the product included in the current purchase request is stored in the first database 13. It is determined that the address is not stored (s34). On the other hand, if it determines with the postal code corresponding to the 1st database 13 having been memorize | stored in s33, the card payment authentication server 1 will read the address of the address matched with this applicable postal code (s35). Further, a part after the town name is cut out from the address of the shipping destination of the product included in the current purchase request (s36), and a number indicating the address is extracted from the cut out part (s37). In s37, a character other than a number (for example, “chome”, “number”, “no.”, “no”) or a symbol (for example, “-”) is separated, and the number included in each division is Is extracted as a number indicating. The card settlement authentication server 1 determines whether or not the two addresses are the same address from the degree of coincidence between the number indicating the address extracted in s37 and the number of the address read in s35 (s38). For example, differences are taken for chome, number, and number at two addresses, and the degree of coincidence is calculated based on the sum of these differences. In this case, the smaller the sum, the greater the coincidence between the two addresses. The card payment authentication server 1 determines that the two addresses are the same address if the degree of coincidence is equal to or greater than a predetermined value. If the degree of coincidence is less than the predetermined value, the two addresses are different. It is determined that it is an address.

  Note that the reason for not determining whether the addresses are the same is based on the exact match of the numbers indicating the address, for example, if the delivery person who delivers the goods can identify the correct address even if the address is a little wrong This is to consider the actual situation of delivering the product.

  If the card payment authentication server 1 determines that the two addresses are different in s38, the shipping address of the product included in the current purchase request is an address that is not stored in the first database 13. It is determined that there is (s34). On the other hand, if it is determined in s38 that the two addresses are the same address, it is determined that the shipping address of the product included in the current purchase request is the address stored in the first database 13 ( s39).

  Further, in the delivery of goods, as described above, even if the address is a little wrong, it may be delivered. That is, as for the address, the product may be delivered even if the two addresses do not completely match. For this reason, the card payment authentication device 1 does not determine whether the two addresses are the same depending on whether the addresses at the two addresses completely match, but from the degree of coincidence of the addresses at the two addresses. It is determined whether two addresses are the same. Thereby, the accuracy of the determination which determines whether it is the purchase request of the goods by impersonation by matching of an address is aimed at.

  If the card payment authentication server 1 determines in s16 that the shipping address of the product included in the current purchase request is not the address stored in the first database 13, it is included in the current purchase request. It is determined whether or not the shipping address of the existing product is the address extracted by the extraction function unit 15 from the second database 14 (s17). The determination relating to s17 is made by matching the shipping address of the product included in the current purchase request with the address extracted and stored by the extraction function unit 15 from the second database 14. The determination by this matching is the same as the process shown in FIG.

  If the card payment authentication server 1 determines in s17 that the shipping address of the product included in the current purchase request is not the address extracted from the second database 14 by the extraction function unit 15, the card payment authentication server 1 responds. It is determined that the transaction is permitted (s18). On the other hand, if the card payment authentication server 1 determines in s16 that the shipping address of the product included in the current purchase request is the address stored in the first database 13, or the current payment in s17. When it is determined that the shipping address of the product included in the purchase request is the address extracted by the extraction function unit 15 from the second database 14, it is determined that the transaction is stopped (s19).

  If the card payment authentication server 1 determines that the transaction is permitted in s18, the card payment authentication server 1 issues an order request for the product that the user desires to purchase in the current purchase request to the store apparatus 3 of the corresponding store, and places an order. An ordering process for transmitting a message indicating acceptance to the user terminal 4 is performed (s20). On the other hand, if the card payment authentication server 1 determines that the transaction is to be canceled in s19, the card payment authentication server 1 does not make an order request for the product that the user desires to purchase in the current purchase request to the store terminal 4 of the corresponding store. That is, no product is ordered from the store. However, a message indicating that the order has been accepted is transmitted to the user terminal 4 (s21). By performing the processing relating to s21, it is possible to make the user who has transmitted a purchase request for the product by impersonation not aware of unauthorized use of the card for the purpose of fraudulent product. Therefore, by reporting this information to related organizations such as the police, it is possible to increase the crime clearance rate by impersonation, and by increasing the clearance rate, a deterrent effect against this type of crime can also be expected.

  When the user terminal 4 receives the notification from the card payment authentication server 1 (s4), it displays it (s5) and ends this process.

  As described above, the card payment authentication server 1 according to this embodiment is configured so that the designated merchandise shipping destination is a merchandise shipping destination designated in the past by an illegal use of the card number, or within a predetermined period. Transactions can be canceled if the item is the destination of the product specified more than once. Therefore, it is possible to improve the security of transactions in online shopping etc. without limiting the shipping destination of the product to the user's own address.

  Further, when it is determined that the card company 2 cannot perform the transaction, the card payment authentication server 1 does not execute the processing after s16, and therefore the load on the apparatus main body can be reduced. Further, by not performing the processing after s16, an unnecessary increase in processing time can be suppressed.

  Further, in the above embodiment, when it is determined that the transaction is stopped in s15 or s19, the store apparatus 3 in the store is not notified of the order for the product. You may make it notify the store apparatus 3 of the purchase request of other goods. However, in this case, it is preferable to notify the store apparatus 3 in such a manner that an input operation relating to an order cannot be performed. This prevents the card company 2 from performing processing related to the card payment in response to the purchase request of the product while knowing that there is a high possibility that it is a purchase request of the product by impersonation due to an operation error or the like at the store side. it can.

  Further, the card payment authentication device 1 may store the purchase request for the product determined to be canceled in s15 or s19 in an accumulative manner so that the card company 2 or the store device 3 can check this. Furthermore, these pieces of information may be managed by another server connected to the network 5.

  Further, when it is determined that the transaction is canceled in s15 or s19, the card payment authentication device 1 may distribute the purchase request for the product at this time to the card company 2. In this way, the card company 2 can be notified in real time of the card number of the card that is likely to be used illegally by impersonation, and the card company 2 should respond smoothly. Can do. In this case, the card payment authentication apparatus 1 may notify the card company 2 of a purchase request for the merchandise using the card company correspondence unit 12 or may be connected to the card company 2 via a dedicated line. You may make it carry out using.

  Further, the shipping destination of the product specified in the purchase request for the product by impersonation stored in the first database 13 is provided from each card company 2 periodically, for example, every 10 days. 1 database 13 may be updated. In this way, it is possible to further improve the accuracy of determination as to whether the purchase request is for goods by impersonation.

It is a figure which shows the structure of the transaction processing system to which the card payment authentication server which is embodiment of this invention is applied. It is a block diagram which shows the function structure of the card payment authentication server which is embodiment of this invention. It is a flowchart which shows operation | movement of a user terminal. It is a flowchart which shows operation | movement of the card payment authentication server which is embodiment of this invention. It is a flowchart which shows the matching process of an address in the card payment authentication server which is embodiment of this invention.

Explanation of symbols

1-card payment authentication device 2-card company 3-store device 4-user terminal 5-network 11-operation function unit 12-card company response unit 13-first database 14-second database 15-extraction function unit 16-shipping section 17-ordering function section

Claims (7)

A purchase request receiving means for receiving a purchase request for a product by card payment,
A storage unit that stores a shipping destination of a product that does not permit a transaction in response to a purchase request for the product by card payment received by the purchase request receiving unit;
About the purchase request of the product by the card settlement accepted by the purchase request acceptance unit, the transaction is made for the shipping destination of the product included in the purchase request of the product and the purchase request of the product by the card settlement stored in the storage unit A first determination means for determining whether or not to permit the transaction,
About the purchase request of the product by the card settlement received by the purchase request receiving means, a transaction authentication request including the card number included in the purchase request for the product is transmitted to the card company, and whether or not the card company can accept the transaction is confirmed. An authentication result acquisition means for acquiring an authentication result including:
When a purchase request for a product by card settlement accepted by the purchase request acceptance unit is determined by the first determination unit to permit the transaction, and the authentication result acquired by the authentication result acquisition unit is transactable And a card payment authentication server comprising ordering means for placing an order for goods.   The first determination unit is configured to store, with respect to a purchase request for a product by card settlement received by the purchase request reception unit, an address of a shipping destination of the product included in the purchase request for the product, and a card stored in the storage unit The card payment authentication server according to claim 1, wherein the card payment authentication server is a means for determining whether or not to allow a transaction based on a degree of coincidence with an address of a shipping destination of a product that refuses the transaction by the settlement.   When the authentication result acquired by the authentication result acquisition unit is transactable with respect to the purchase request of the product by card payment received by the purchase request reception unit, the first determination unit may The card payment authentication server according to claim 1, wherein the card payment authentication server is means for determining whether or not to permit such a transaction.   When the first determination unit determines that the transaction is not permitted for the purchase request for the product by card settlement received by the purchase request reception unit, the information related to the purchase request for the product is distributed to a predetermined device. The card payment authentication server according to claim 1, further comprising a distribution unit. History storage means for storing a history of purchase requests for products by card payment accepted by the purchase request accepting means;
Shipment in which the number of times designated as the shipping destination of a product within a predetermined period in the purchase request of the product by card settlement is a predetermined number of times or more in the purchase request of the product by card settlement from the history of the purchase request of the product by card settlement stored in the history storage means An extraction means for extracting the destination as a shipping destination that does not allow the transaction;
About the purchase request of the product by the card payment accepted by the purchase request accepting unit, the shipping destination of the product included in the purchase request for the product is matched with the shipping destination extracted by the extracting unit, and the transaction is permitted. A second determination means for determining whether or not
The ordering unit determines that the first determination unit and the second determination unit permit the transaction for the purchase request of the product by card settlement received by the purchase request reception unit, and the authentication result acquisition unit The card settlement authentication server according to claim 1, which is means for placing an order for a product when the acquired authentication result is acceptable. When a purchase request for a product by card payment is stored in the storage means, and a purchase request for the product by card payment transmitted from an arbitrary terminal device is received at the receiving unit. ,
Regarding the purchase request of the product by card payment received this time, the shipping destination of the product included in the purchase request of this product and the product that does not permit the transaction for the purchase request of the product by card payment stored in the storage means A first step of matching the shipping destination and determining whether to allow the transaction;
Regarding the purchase request of the product by card payment received this time, the transaction request including the card number included in the purchase request for this product is sent to the card company, and the authentication result including the possibility of the transaction is obtained from the card company. A second step of:
About the purchase request of the goods received by card payment received this time, it is determined that the transaction is permitted in the first step, and if the authentication result obtained in the second step is acceptable, the product is ordered. A card payment authentication method comprising: a third step.   The card payment authentication method according to claim 6, wherein the first step is executed when the result of authentication acquired in the second step indicates that the transaction is possible.

Images