JP2008197939A - Suspicious behavior monitoring method and device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To decide whether a user of an unmanned transaction terminal encounters a fraud suffering such as " billing fraud" or not, and to give a warning to the user when it is decided that the user encounters the suffering. <P>SOLUTION: A monitoring camera is installed to the unmanned transaction terminal, specific behavior of the user is detected a plurality of times, it is decided that "suspicious behavior" is present when the specific behavior is detected a plurality of times, and the terminal puts a question of a situation of a transaction to the user. When it is decided that the user is very likely to encounter the fraud suffering as a result of an answer to the question, the warning is displayed on a transaction screen. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a monitoring method of a suspicious behavior of a terminal user in an unattended automatic transaction terminal, and a monitoring system using the same.

  Automatic teller machines (ATMs) are often used for transactions such as withdrawals, deposits, and transfers at financial institutions. In recent years, ATMs have been in operation for 24 hours or have been installed in convenience stores, making it possible to conduct transactions at many locations other than financial institutions. Although the use of ATM is convenient in this way, crimes such as voyeurization of card information and PIN numbers, peeping, and "transfer fraud" occur due to the fact that ATMs are operated unattended. It is a problem.

  In the voyeur of card information and security code, in order to send images taken by the camera to the outside by radio waves, it can be detected by a surveillance camera to detect illegally installed cameras, or suspicious radio waves can be monitored Technology has been developed to detect whether it is coming out of the inside. For example, Patent Document 1 describes the security code theft by looking into a suspicious person.

JP 2006-79382 JP

  However, the above technique is not effective in preventing “transfer fraud” without the presence of a suspicious object or a suspicious person. For example, in the Japan Police Agency website ("Beware of fraud due to tax refund!" Http://www.keishicho.metro.tokyo.jp/seian/kanpu/kanpu.htm) As an example, the victim was instructed by a malicious third party on how to operate the ATM using a mobile phone, etc., and the money was transferred to a malicious third party account. ing.

  In this way, the victim places a call to a malicious third party from his / her mobile phone in order to receive instructions on the operation method in front of the ATM. The third party gives a clever instruction as if the refund is to be transferred to the victim's account, and actually causes the victim to operate the transfer procedure from the victim's account to the third party's account. There are few effective prevention measures against such fraud using an unmanned terminal, and it is difficult to stop the damage unless the victim notices that the procedure is wrong during the terminal operation.

  The present invention has been made to solve at least a part of the above problems. An object of the present invention relates to a monitoring method and a monitoring device for a user's suspicious behavior in order to prevent a “transfer fraud” from being damaged while a mobile phone is instructed by a third party to operate the terminal. Is. In general, it is difficult to accurately determine a psychological crime called fraud from the behavior of the user. Therefore, in order to misdetermine behavior other than fraud damage as suspicious behavior, the specific behavior is judged multiple times and the user is inquired about the transaction status, thereby reducing the inconvenience of users involved in transactions due to misjudgment. The purpose is to do. Furthermore, it aims to prevent the damage by suggesting the possibility of fraud damage and providing users with time and opportunity to make a calm decision.

  The present invention is an apparatus for monitoring the behavior of a user who operates a terminal, wherein the user performs a specific behavior based on image input means for inputting the behavior of the user as an image and captured image information. A behavior determination means for determining that the behavior determination means is a specific behavior, an answer input means for asking the user about the status of the transaction and inputting the answer, and the behavior determination means In the user damage presence / absence determination means and the user damage presence / absence determination means for determining whether or not the user has suffered damage from fraud based on the output and the output of the answer input means, the user And a warning display means that warns the user when it is determined that the user has been damaged by an illegal act.

  In another preferred example, the behavior determination means is a monitoring device that is activated a plurality of times to perform behavior determination, or performs behavior determination continuously during a transaction.

  In another preferred example, the behavior determining means determines that the terminal user is performing a transaction operation while holding the telephone as a specific behavior.

  In another preferable example, the behavior determination means includes a voice input means, and also inputs a speech voice by a telephone of a user's transaction, and in addition to the suspicious behavior determination by the image, the suspicious behavior determination by the voice is combined. It is the monitoring device characterized by performing.

  In another preferred example, when the warning display means warns the user that the user has been damaged by an illegal act, the management center operator has a means for telephone connection with the user. This is a characteristic monitoring device.

  In another preferred example, in an automatic transaction apparatus that executes various transactions, the automatic transaction apparatus includes the monitoring device.

  According to the present invention, a behavior of operating a terminal while receiving an instruction from a malicious third party with a mobile phone is detected by image processing. Further, on the terminal screen, a question screen is displayed about the operation behavior of the terminal and the past situation, and it is determined whether there is a possibility of fraud damage after obtaining the user's answer. This makes it possible to accurately determine fraud damage and to reduce the inconvenience of user terminal transactions due to erroneous determination.

  Furthermore, when it is determined that there is a high possibility of being scammed, the user has time and opportunity to make a calm decision by displaying a warning screen or providing an opportunity to consult with the operator. It is possible to prevent fraud damage in advance.

  Hereinafter, an embodiment of the present invention will be described with reference to FIGS.

  In this embodiment, after detecting a suspicious behavior of a user operating in front of an ATM, a warning is given after determining whether there is a possibility of being scammed or not based on an answer to a question to the user. The process of displaying the screen on the ATM transaction screen will be described.

  FIG. 1 shows a configuration example of the entire system. Reference numeral 101 denotes a financial sales store or a convenience store, which is connected to a data center 112 in which an accounting host computer 113 is installed via a wide area network 111. An automatic teller machine (ATM) 102 is connected to a network (LAN) 110 in the store. Reference numeral 103 denotes an proximity sensor for detecting that the user has approached the ATM. Reference numeral 104 denotes a handset for a user to converse with an operator 116 in the management center 114.

  Reference numeral 105 denotes a printer for issuing a statement, and paper on which a transaction result such as a transfer is printed is discharged. Reference numeral 106 denotes a monitoring camera for monitoring a user's behavior. This camera is also used as a camera for a videophone that captures the user's video when the user has a conversation with the operator 116 of the management center 114. Reference numeral 107 denotes a card reader device. The user inserts a cash card from the beginning of the transaction. Reference numeral 108 denotes a cash deposit / withdrawal port for depositing and withdrawing cash. Reference numeral 109 denotes a display / input device, which also has a touch panel function, and thus functions as an input device.

  An account host computer 113 performs account processing related to transactions such as deposits and withdrawals and transfers. Reference numeral 114 denotes a management center, in which an operator (person in charge) is arranged for a terminal user to consult via the handset 104. An automatic teller machine (ATM) 102 and an operator terminal 115 are connected via a wide area network 111.

  A process for detecting a suspicious behavior of an ATM user and displaying a warning in the system of FIG. 1 will be described with reference to FIGS.

  FIG. 2 is a diagram illustrating a configuration example of the ATM 102. The CPU 201 is a processor that performs ATM data processing and performs various processes and controls such as control of various programs and generation of commands. The LAN device 202 is a device for connecting a terminal to the LAN 110 in the sales office, and is connected to the accounting host computer 113 and the operator terminal 115 via the LAN 110. Reference numerals 103, 104, 105, 106, 107 and 109 are the same devices as the same numbers in FIG. 1. The cash processing device 203 is a device for performing cash processing in ATM, and is connected to the cash deposit / withdrawal port 108.

  The main storage device 205 stores various programs and data. Reference numeral 206 denotes an overall control program for controlling the entire ATM, and reference numeral 207 stores a business application program relating to work performed in ATM transactions. The specific behavior detection program 208 detects whether the user is performing the specific behavior using the image of the user input via the monitoring camera 106, and outputs the result to the transaction cancellation determination program 209.

  When the transaction cancellation determination program 209 determines that there is “suspicious behavior” based on the output of the specific behavior detection program 208, it asks the user about the status of the transaction and conducts fraudulent acts such as “transfer fraud”. Judge whether there is sex. When it is determined that there is a possibility that the user has suffered fraud, the handset 104 or the monitoring camera 106 is used so that a warning screen is displayed or the operator 116 of the management center 114 can consult with the user. Start the TV phone that was there. A bus 204 connects the processor and each device in the ATM.

  Thus, the program has various functions, performs various processes, and is controlled by the hardware configuration of the CPU 201 as described above. In the present invention, the description will be focused on programs, but various functions of these programs, for example, specific behavior detection means, transaction stop determination means, etc., needless to say, each means can be expressed as each part.

  With reference to FIG. 3, the operation of the ATM 102 for determining whether the user is suffering from “transfer fraud” will be described. Steps 302, 306, 309, 310, 311, and 312 are processes that characterize the present invention. Here, it is assumed that a malicious third party uses a mobile phone to give an instruction for ATM operation to the user and transfers money to the third party's account.

  The determination of “transfer fraud” is made in two stages. In the first stage, it is detected whether the user is operating the ATM while holding the mobile phone, using the video obtained through the monitoring camera 106. In this embodiment, such behavior detection is called “specific behavior detection”. In the processing flow of FIG. 3, the specific behavior detection process is performed a plurality of times, and this is intended to reduce the probability of misjudging a behavior that is not fraud damage as a “transfer fraud”.

  For example, it is assumed that an ATM user uses a cash card borrowed from the card owner and enters a wrong PIN at the ATM, and the ATM rejects the transaction. At that time, the user may inquire the personal identification number on the spot using the mobile phone to the owner of the cash card. In this case, even if the user operates the ATM while holding the mobile phone, it does not mean that the user has been scammed.

  As another example, it is assumed that at the end of the transfer transaction, the owner name of the transfer account displayed on the display / input device 109 for confirmation is different from the owner name of the specified transfer account. . Even in that case, the transfer information may be confirmed to the parties concerned using the mobile phone on the spot, but this is not the same as the fraud damage.

  On the other hand, in the case of "transfer fraud", in order to prevent the user from being aware of fraud damage, operation instructions are often issued from the beginning to the end of the ATM transaction using the mobile phone held by the user. . As described above, in the case of an ATM operation behavior without fraud damage, a transaction operation may be performed while holding the mobile phone in a part of the ATM operation process.

  However, unlike the case of fraud damage, it is presumed that there are very few ATM operations while holding the mobile phone from the beginning to the end of the ATM transaction. Therefore, during ATM transactions, the user's behavior other than fraudulent behavior is misjudged as “suspicious behavior” by detecting the specific behavior that the user operates the ATM while holding the mobile phone. To prevent that.

  In the second stage, when the result of “specific behavior detection” is determined as “suspicious behavior”, the transaction status is confirmed with the user. Only with “specific behavior detection”, it is difficult to accurately determine the true meaning of the user's behavior. Therefore, the user is asked a question for confirming the transaction status, and based on the answer result, it is determined whether or not there is a high possibility that the user is finally suffering from “transfer fraud”. If it is determined that there is a high possibility of “transfer fraud” damage, the display / input device alerts the user and prompts them to confirm the transaction details.

  The above is the purpose of the processing flow.

  Details of the processing flow will be described below with reference to FIG.

  When the user approaches the ATM 102, the proximity sensor 103 detects that the user has come before the ATM, and the detection result is sent to the overall control program 206 (301). The overall control program 206 activates the specific behavior detection program 208. The specific behavior detection program 208 inputs an image captured by the monitoring camera 106, and detects whether there is a hand holding the mobile phone next to the face by image processing technology. The detected result is output to the transaction cancellation determination program 209 (302). An example of an image captured by the monitoring camera 106 is shown in FIG.

  The technique for detecting whether or not there is a hand next to the face may be any method, for example, using the similarity of the skin color of the face and the skin color of the hand and detecting the position of the face, What is necessary is just to determine whether the area | region of the color similar to a face exists in the side of. Alternatively, when the mobile phone is held, the mobile phone is kept in contact with the ear, so it seems that the movement of the face and the movement of the hand holding the telephone are linked, so there is an image area that moves in the same direction as the face. It may be determined whether it is present next to the face. Furthermore, it may be determined whether there is an area having a specific shape of the finger next to the face by using the fact that the gripping method of the finger holding the mobile phone is roughly similar.

  The ATM user inserts a cash card into the card reader device 107 at the beginning of the transaction (303) and inputs a personal identification number for identification from the display / input device 109 (304). Thereafter, the transaction menu displayed on the display / input device 109 is selected using the touch panel 109 (305). Here, it is assumed that the user has selected a transfer transaction.

  Next, the specific behavior detection program 208 is started again, and the image captured by the monitoring camera 106 is input in the same manner as described in step 302, and the mobile phone is held next to the face by image processing technology. Detect if there is a hand. The detected result is output to the transaction cancellation determination program 209 (306).

  In order to perform the transfer transaction selected in step 305, the user inputs the account number of the transfer destination and the transfer amount as transaction information via the display / input device 109 (307). The entered transaction information is displayed on the display / input device 109, and after confirming whether or not the displayed transaction content is acceptable, the user presses the confirmation key on the screen (308).

  After that, the specific behavior detection program 208 is started again, and the image captured by the surveillance camera 106 is input in the same manner as described in step 302, and the hand holding the mobile phone beside the face by image processing technology. Detect if there is any. The detected result is output to the transaction cancellation determination program 209 (309).

  The transaction cancellation determination program 209 confirms the detection results output so far by the specific behavior detection program 208 and the transaction status of the user, and finally the user may have suffered "transfer fraud" damage. The final judgment is made as to whether the property is high. If it is determined that there is a high possibility of being damaged in the final determination, it is determined to cancel the transaction. (310).

  Details of the processing in step 310 will be described with reference to FIGS.

  The transaction cancellation determination program 209 initializes the transaction stop flag to an off state (401), and then comprehensively determines the three detection results output so far by the specific behavior detection program 208. In the embodiment, the specific behavior detection process is performed three times, but here, when all the detection results verify the state of holding the mobile phone, it is determined that the behavior is suspicious (402). Here, the suspicious behavior is determined when all are detected, but other reliable determination methods such as majority determination of detection results may be used. If it is determined that the behavior is suspicious, the process proceeds to step 404; otherwise, the process ends (403).

  The transaction cancellation determination program 209 displays a message on the display / input device 109 that suggests that there is a possibility of being a victim of “transfer fraud”, and then makes a question for confirming the transaction status. Examples of the screen are shown in FIGS. Thereafter, when a user's answer to the questions shown in FIGS. 6 and 7 is input, the transaction cancellation determination program 209 may eventually fall into the case of “transfer fraud” damage. It is determined whether it is high (404). If it is determined that there is a high possibility of being damaged, the process proceeds to step 406, and if not, the process ends (405).

  When it is determined that there is a high possibility of being damaged, the transaction cancellation determination program 209 displays a message warning the display / input device 109 that there is a high possibility of being a “transfer fraud” victim. indicate. An example of the message is shown in FIG. The user answers the question (406) displayed on a part of the warning screen as to whether or not to consult with an operator (person in charge). If he / she chooses to consult, the process proceeds to step 408 and does not select. If so, the process proceeds to step 409 (407). When the operator connection is selected, the operator connects to the operator in the management center, and the user talks with the operator using the handset 104 (408). At that time, the operator can respond while viewing the user's image taken by the monitoring camera 106.

  Next, the user selects whether to continue or cancel the transfer transaction (409). An example of the selection screen is shown in FIG. When the user selects transaction cancellation, the transaction cancellation determination program 209 turns on the transaction cancellation flag (410). If the user has not selected to cancel the transaction, the process ends.

  The transaction cancellation determination 310 is performed by the processing of steps 401 to 409 described above.

  In step 311, the transfer transaction is stopped when the transaction stop flag is on (312). If it is off, a transfer transaction is performed with the host computer 113 (313).

  By the above steps 301 to 313, it is determined whether or not the user is highly likely to be damaged by "transfer fraud". If it is determined that the possibility is high, the transfer transaction is stopped. It is possible to prevent damage.

  In the above-described embodiment, the specific behavior detection process is activated three times as steps 302, 306, and 309 during the ATM operation. Alternatively, if the ATM CPU is not loaded, the specific behavior detection process may be performed continuously.

  In the above embodiment, it is detected that the mobile phone is held by using image processing. However, the voice detection means for detecting that the user is speaking using the phone while holding the mobile phone is provided. It may be used. Or you may perform comprehensive determination using both the image processing and audio | voice detection together. In that case, it is necessary to add a microphone for inputting speech to the configuration of the ATM 102 in FIG. Furthermore, the specific behavior detection program needs to have a voice detection function or a voice recognition function that captures the presence or absence of a user's speech. The voice recognition function is a function for detecting a specific keyword spoken by the user, for example, “refund”.

  Furthermore, in the above embodiment, it is determined in step 404 of FIG. 4 whether or not there is a high possibility that it corresponds to a case of “transfer fraud” damage by answering the transaction status question of the ATM user. Yes. In addition to such responses from ATM users, a threshold is set for the transfer amount, and if the threshold is exceeded, it is determined that there is a high possibility that the case is in a “transfer fraud” case. May be added.

  That is, in the case of fraud damage, there is a high possibility that a larger amount of money will be transferred than in a normal transaction. This is because a malicious third party intends to obtain as much money as possible in one transaction. The threshold value may be set to a constant value common to ATM users, or may be changed for each ATM user. In the latter case, for example, referring to the past transfer transaction history, the average value of the transfer amount is set as a threshold value, or the maximum amount of the past transfer transaction is set as a threshold value. A threshold setting method may be adopted.

The figure which shows the example of whole structure of the system in this invention Example. The figure which shows the structural example of an automatic teller machine (ATM). The figure which shows the whole process flow of this invention Example. The figure which shows the detail of the transaction cancellation determination in FIG. The figure which shows the example of the image caught with the surveillance camera 106. FIG. The figure which shows the example of the screen for calling the terminal user's attention of fraud damage and asking a question. The figure which shows the example of the screen for calling the terminal user's attention of fraud damage and asking a question. The figure which shows the example of the screen for displaying the warning of fraud damage to a terminal user. The figure which shows the example of the screen for a terminal user to select transaction continuation or cancellation.

Explanation of symbols

DESCRIPTION OF SYMBOLS 201 ... CPU, 202 ... LAN device, 103 ... Proximity sensor, 104 ... Handset, 105 ... Specification issue printer, 106 ... Monitoring camera, 107 ... Card reader device, 107 ... Card reader device, 109 ... Display / input device, DESCRIPTION OF SYMBOLS 203 ... Cash processing apparatus, 204 ... Bus, 205 ... Main memory, 206 ... ATM whole control program, 207 ... Business application program, 208 ... Specific behavior detection program, 209 ... Transaction cancellation determination program

Claims (6)

A device for monitoring the behavior of a user operating a terminal,
Image input means for inputting the user's behavior as an image;
Behavior determination means for determining that the user has performed a specific behavior from the captured image information;
When the behavior determining means determines that the behavior is a specific behavior, an answer input means for asking the user about the transaction status and inputting the answer, an output of the behavior determining means, and an output of the answer input means Based on a user damage presence / absence judging means for judging whether or not the user has suffered damage from fraud,
In the user damage presence / absence determining means, when it is determined that the user has suffered damages of fraud, warning display means for warning the user;
A monitoring apparatus comprising:   The monitoring apparatus according to claim 1, wherein the behavior determination unit is activated a plurality of times to perform behavior determination, or performs behavior determination continuously during a transaction.   The monitoring apparatus according to claim 1, wherein the behavior determining unit determines that the user is performing a transaction operation while holding a telephone as a specific behavior.   2. The monitoring apparatus according to claim 1, wherein the behavior determination unit includes a voice input unit, and also inputs a speech voice by a telephone during the transaction of the user, and in addition to a specific behavior determination by an image, a specific behavior by a voice. A monitoring device characterized by making a judgment together.   2. The monitoring device according to claim 1, further comprising means for telephone-connecting an operator of a management center and the user when the warning display means warns the user that he / she has been damaged by an illegal act. A monitoring device characterized by that. In an automatic transaction apparatus that executes various transactions,
An automatic transaction apparatus comprising the monitoring apparatus according to claim 1.

Images