JP2017058731A - Method and system for preventing unauthorized transaction - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a method for detecting an unauthorized transaction for suppressing the unauthorized transaction performed in the internet banking in a real time by illegally acquiring a user ID and a password or the like.SOLUTION: An unauthorized transaction detection method for detecting an unauthorized financial transaction by using an internet banking includes: a detection parameter determination step of performing a determination whether transaction information of a user making an access to a financial institute in financial transaction coincides with a detection parameter set as transaction information for preliminarily stopping the financial transaction; a processing interruption step of interrupting the financial transaction detected as the unauthorized transaction by a detection parameter part; a confirmation request notification step of notifying a request performed by second communication means different from first communication means by which the confirmation of the transaction to the financial institution is performed to the user corresponding to the interrupted financial transaction; and a processing re-start step of re-starting the interrupted financial transaction by the confirmation information in which the user is confirmed as an authorized user by an enquiry.SELECTED DRAWING: Figure 2

Description

  The present invention relates to an unauthorized transaction detection method and an unauthorized transaction detection system for detecting unauthorized transactions in Internet banking.

  In recent years, financial institutions have provided Internet banking services that allow users to check deposit balances, deposit / withdrawal details, and transfer / transfer funds from user terminals such as personal computers and portable information terminals via network lines including the Internet. (For example, refer to Patent Document 1). Thus, the user can perform the above-described transactions without going to the financial institution by accessing the Internet banking home page of the financial institution. By using this Internet banking mechanism, financial institutions provide highly convenient services to users.

On the other hand, various security measures have been implemented in order to prevent unauthorized withdrawal of Internet banking and unauthorized entry into a server or the like constituting the Internet banking system. In general, countermeasures such as encryption of communication between a user terminal and a server in an Internet banking system, a plurality of passwords, and prevention of unauthorized access based on terminal / network environment analysis are taken.
The security measures described above include, for example, a security server or the like between the network side where the financial institution server providing the Internet banking service is installed and the public network side to determine unauthorized access. It is known to be done.

JP 2010-113485 A

However, with the current security as described above, a malicious person illegally obtains an account such as another person's user ID (identification) and password, accesses the financial institution server using this account, and performs unauthorized financial transactions. Can not be sufficiently prevented.
Conventionally, fraudulent financial transactions are detected by an investigation after the transaction has already been performed, and it is difficult to suppress fraudulent financial transactions in real time.

  The present invention has been made in view of such circumstances, and illegally obtains transaction information which is an account such as a user ID and a password, and conducts an unauthorized financial transaction performed by this transaction information in Internet banking in real time. An object is to provide a fraudulent transaction detection method and a fraudulent transaction detection system to be suppressed.

  The present invention has been made to solve the above-described problems, and an unauthorized transaction detection method of the present invention is an unauthorized transaction detection method for detecting an unauthorized transaction in a financial transaction using Internet banking. In the transaction, a detection parameter determination process for determining whether or not the transaction information of the user who has accessed the financial institution matches the detection parameter set in the rejection table as the transaction information to stop the financial transaction in advance. A process interruption process for interrupting processing of the financial transaction of the user detected as an unauthorized transaction in the detection parameter determination process, and the user corresponding to the financial transaction interrupted as an unauthorized transaction in the process interruption process, The second communication is different from the first communication means that conducts the financial transaction inquiries of the transaction confirmation to the financial institution. The user is interrupted by a confirmation request notification process for making a notification requesting to be performed using means, and confirmation information for confirming that the user is a valid user based on the result of the inquiry. And a process resumption process for resuming the financial transaction.

  The fraudulent transaction detection method of the present invention is characterized in that the transaction information includes an IP address of a terminal used by the user and an account number in the financial institution to which the financial transaction is performed.

  In the fraudulent transaction detection method of the present invention, when it is confirmed in the inquiry that the user is a valid user, the financial transaction with the suspended financial institution is resumed on a per-user basis. It is characterized by.

  The fraudulent transaction detection method of the present invention is provided for each financial institution, and the rejection table in which the detection parameters are aggregated from each of the detection tables in which the detection parameters related to the fraudulent transaction detected by each of the financial institutions are described. The method further includes generating a reject table.

  The fraudulent transaction detection method of the present invention is characterized in that for each detection parameter, an invalid / invalid flag for validating or invalidating detection processing using the detection parameter is provided in the rejection table for each financial institution. And

  The fraudulent transaction detection system of the present invention is a system for detecting fraudulent transactions in a financial transaction using Internet banking. In a financial transaction with a financial institution, transaction information of a user who has accessed the financial institution is preliminarily stored in the financial transaction. Parameter determination unit for determining whether or not it matches the detection parameter set in the rejection table as transaction information to be stopped, and processing of the financial transaction of the user detected by the detection parameter determination unit as an illegal transaction And a first communication means for inquiring the financial institution to confirm the transaction with respect to the user of the financial transaction that the processing interruption unit has interrupted as an illegal transaction. A confirmation request notifying unit for performing a notification requesting to be performed using a second communication means different from the above, and depending on the result of the inquiry, The confirmation information that the user is an authorized user is confirmed, characterized in that it comprises a said resume transaction processing restarter which is interrupted of the user.

  According to the present invention, the transaction information of the user extracted in the financial transaction using the Internet banking is compared with the detection parameter set as the transaction information for interrupting the transaction in advance, and if the transaction information matches, the financial transaction is fraudulent. And inquires the financial institution of the transaction using the second communication means different from the first communication means performing the financial transaction, and the user is a valid user according to the result of the inquiry. If this is confirmed, in order to resume this suspended financial transaction, an account such as a user ID and password is illegally obtained, and unauthorized financial transactions performed by this account in Internet banking are ensured for user usability. In addition, the present invention provides a fraudulent transaction detection method and fraudulent transaction detection system that suppresses in real time. Can.

It is a figure which shows the structural example of the internet banking system by embodiment of this invention. It is a figure which shows the structural example of the unauthorized transaction detection system 12 in the internet banking system 1 of FIG. It is a figure which shows the structural example of the detection table memorize | stored in the detection table database. It is a figure which shows the structural example of the refusal table which memorize | stored the detection parameter of the detection table memorize | stored in the refusal table database. It is a figure which shows the structural example of the transaction table memorize | stored in the transaction table database. It is a flowchart which shows the example of a flow operation | movement process of the fraud detection in the internet banking using the fraudulent transaction detection system 12 in this embodiment.

  Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a diagram illustrating a configuration example of an Internet banking system according to an embodiment of the present invention. In FIG. 1, the internet banking system 1 according to the present embodiment includes, for example, a transaction system 11 and an unauthorized transaction detection system 12. The user terminals 2_1 to 2_n are personal computers or servers possessed by companies, offices, or individuals, and perform internet banking with financial institutions by communicating with the internet banking system 1 via the network 100. The network 100 is an information communication network including an Internet line. The financial institution 3_1 to the financial institution 3_n are banks, credit unions, agricultural cooperatives, etc., and receive a financial transaction request from a user terminal via the network 100 from the Internet banking system 1, and transfer, transfer, etc. Execute the process.

  The transaction system 11 in the Internet banking system 1 supports financial transaction operations from the user terminal for each of the plurality of financial institutions 3_1 to 3_n in the Internet banking (including user authentication processing and ensuring communication security), This is performed independently for each of the financial institutions 3_1 to 3_n. In each of the financial institutions 3_1 to 3_n, the account system 32 executes a financial transaction such as a transfer / transfer to another financial institution, for example, based on business support from the transaction system 11 performed via the network 100.

  The fraudulent transaction detection system 12 is a main component in the embodiment of the present invention. For example, when an account such as a user ID and a password is obtained illegally, fraudulent financial transactions performed by this account in Internet banking are performed in real time. It has a function to detect. The fraudulent transaction detection system 12 has a function of stopping fraudulent financial transactions by an account obtained illegally by stopping until the legitimacy of the user is confirmed by the financial institution.

  FIG. 2 is a diagram illustrating a configuration example of the unauthorized transaction detection system 12 in the Internet banking system 1 of FIG. 2, the fraudulent transaction detection system 12 includes a rejection table edit processing unit 121, a detection parameter determination unit 122, a processing interruption unit 123, a confirmation request notification unit 124, a processing resumption unit 125, a detection table database 126, a rejection table database 127, Each of the transaction table databases 128 is provided.

FIG. 3 is a diagram illustrating a configuration example of the detection table stored in the detection table database 126. The detection table shows that each financial institution's financial information of each financial institution is used as a detection parameter. It is written from the engine operation terminal 31. In the detection table of FIG. 3, for example, for each record, an IP (Internet Protocol) address, a transfer account number, a detection parameter, and transaction contents are set as items of the table corresponding to the detection number.
The detection number is information for identifying the detected financial transaction, such as a serial number. The IP address is the IP address of the user terminal of the transmission source (access source) used by the user in the detected financial transaction. In the present embodiment, transfer / transfer will be described as an example of a financial transaction.

  The transfer destination account number indicates the account number of the transfer destination financial institution in the transfer / transfer process which is a financial transaction. The detection parameter indicates transaction information in a financial transaction detected as an illegal transaction. This transaction information is information including, for example, the IP address of the access source and the transfer destination account number (hereinafter simply referred to as the transfer account number) in the financial institution in the present embodiment. For this reason, as the detection parameter, transaction information estimated to be an unauthorized transaction is described, and either or both of the IP address of the access source and the transfer destination account number as the estimation result are described. Is set. The details of the transaction are described in terms of how it was estimated that there was a possibility of fraudulent transactions after any transfer or transfer was made.

Returning to FIG. 2, the rejection table editing processing unit 121 performs an editing process of writing a detection parameter corresponding to the detection number input from the financial institution terminal 31 of each financial institution to the rejection table in the rejection table database 127. That is, the person in charge of the financial institution periodically refers to the detection table of the detection table database 126, and determines the transaction information detection number in the financial transaction that the person in charge presumes is particularly likely to be an unauthorized financial transaction. Transmit to the fraudulent transaction detection system 12. As a result, the rejection table edit processing unit 121 reads the transaction information of the record corresponding to the detection number supplied from the financial institution operation terminal 31 from the detection table of the detection table database 126.
Then, the rejection table editing processing unit 121 writes and stores the read transaction information and corresponding information in the rejection table of the rejection table database 127.

  Further, the rejection table editing processing unit 121 periodically refers to the detection table of each financial institution in the detection table database 126 and is written in the detection table of a plurality of financial institutions, or the detection table in the same financial institution. As a criterion for determining that there is a high possibility that the transaction is fraudulent financial transaction, the detection parameter of the financial transaction is detected from the detection table. It may be configured to extract and write to the rejection table of the rejection table database 127. Further, when a person in charge of each financial institution extracts a detection parameter that is estimated to have a particularly high possibility of an unauthorized financial transaction from the detection table, the financial institution operation terminal 31 accesses the unauthorized transaction detection system 12. The extracted detection parameter may be directly written from the financial institution operating terminal 31 to the rejection table of the rejection table database 127.

  FIG. 4 is a diagram showing a configuration example of a rejection table that is stored in the rejection table database 127 and that aggregates the detection parameters of the detection table. As described above, the rejection table is a table in which detection parameters determined to be highly likely to be a particularly fraudulent financial transaction from the detection table (highly likely to be involved in fraudulent transactions) are aggregated and written. It is. In the rejection table of FIG. 4, for example, for each record, detection parameters (IP address, bank account number), registered financial institution information, and valid / invalid flag are set as items corresponding to the registration number.

  The registration number is information for identifying the detection parameter, such as a serial number indicating the order in which the detection parameter is registered in the rejection table. The registered financial institution information is information indicating the contact information of the financial institution that registered the corresponding detection parameter. The valid / invalid flag is a flag indicating whether or not each of the detection parameters in the refusal table is used for determination of detecting that the financial transaction is an illegal transaction. That is, the detection parameter determination unit 122 does not use the detection parameter in which the valid / invalid flag is invalid in the refusal table for the determination that the financial transaction is an illegal transaction, while the valid / invalid flag is valid. The state detection parameter is used to determine that the financial transaction is an unauthorized transaction. In addition, the person in charge of each financial institution contacts the financial institution contact point indicated by the registered financial institution information in order to determine whether the detection parameter in the refusal table is valid or invalid. Inquiries can be made to obtain financial transaction information from financial institutions registered in the rejection table.

  Further, as shown in the rejection table of FIG. 4, this valid / invalid flag can be arbitrarily set for each financial institution. That is, the detection parameter determination unit 122 extracts information on the financial institution that is the request destination for each financial transaction of the user, and refers to the valid / invalid flag corresponding to the financial institution. Then, the detection parameter determination unit 122 determines, for each financial institution, whether or not to use the detection parameter based on the validity / invalidity flag, the detection parameter in a state where the validity / invalidity flag is valid, transaction information extracted in the financial transaction, By comparing, illegal transaction detection processing is performed. Here, each financial institution can only refer to its own valid / invalid flag, and the financial institution operation terminal 31 accesses the fraudulent transaction detection system 12, and the financial institution operation terminal 31 changes the state of its own valid / invalid flag. Can be rewritten arbitrarily. In addition, the valid / invalid flag may be configured so that the initial value when the detection parameter is registered is invalidated as a default or may be valid, and can be arbitrarily selected for each operational period depending on the operation of the financial institution.

  Returning to FIG. 2, the detection parameter determination unit 122 attempts to perform Internet banking with a predetermined financial institution, and the user terminal is the transaction information of the user who has accessed the Internet banking system 1 through the user terminal. An IP address and a transfer destination account number that is a transfer destination in a financial transaction are extracted. Also, the detection parameter determination unit 122 refers to the rejection table in the rejection table database 127 and matches the transaction information (IP address, bank account number) extracted from the detection parameters for which the valid / invalid flag is valid. It is determined whether or not a detection parameter (either one or both of an IP address and a transfer account number) is detected. At this time, if a detection parameter that matches the extracted transaction information exists in the rejection table, the detection parameter determination unit 122 sends a detection signal indicating that the transaction has been detected as an unauthorized transaction to the processing interruption unit 123. Output.

When the detection signal is supplied from the detection parameter determination unit 122, the processing interruption unit 123 interrupts the transaction corresponding to the transaction number indicating the detected financial transaction included in the detection signal. That is, the process interruption unit 123 sets (writes) a flag indicating interruption in the interruption flag column in the financial transaction record to be interrupted in the transaction table in the transaction table database 128. As a result, the transaction system 11 refers to the transaction table interruption flag in the transaction table database 128 and determines whether to advance or temporarily stop (interrupt) the financial transaction. Then, the transaction system 11 does not output a transaction instruction for this financial transaction to the financial institution operation terminal 31 while the interruption flag is in the flag state indicating interruption in the transaction table of the transaction table database 128.
In addition, the process interruption unit 123 outputs information (including information on the financial institution) of the financial transaction for which the process is interrupted to the confirmation request notification unit 124.

  FIG. 5 is a diagram illustrating a configuration example of a transaction table stored in the transaction table database 128. The transaction table is a table indicating information on financial transactions in Internet banking performed by each of the user terminals, which is processed by the transaction system 11 and the fraudulent transaction detection system 12. In the transaction table of FIG. 5, for example, a transaction number, an IP address, a transfer account number, an interruption flag, and an interruption cause are set as items for each record.

  The transaction number is information for identifying each financial transaction, and is a serial number indicating the order in which transactions are registered in the transaction table. The IP address is the transmission source IP address of the user terminal 21 that the user uses for financial transactions. The transfer destination account number is the account number of the transmission destination financial institution in the transfer / transfer process as a financial transaction. The interruption flag is rewritten by the processing interruption unit 123 depending on whether the transaction information matches the detection parameter. Here, when the transaction information and the detection parameter match, it is set to a state indicating that the transaction process is interrupted. On the other hand, when the transaction information and the detection parameter do not match, the transaction information is set to indicate a continuation of the transaction process. The The reason for the suspension is, for example, that the suspension flag is in a state indicating suspension of transaction processing because the IP address in the transaction information matches the IP address of the detection parameter, or the transfer destination account number in the transaction information is the detection parameter. The determination result in the detection parameter determination unit 122 is described, which indicates whether the IP address and the transfer destination account number match.

Returning to FIG. 2, the confirmation request notifying unit 124 sends a transaction screen (input screen) that the transaction system 11 displays on the user terminal to the financial institution requesting the financial transaction. In order to confirm the contents of the transaction, an image display prompting to call the designated financial institution telephone number is displayed. Here, communication means such as SMS (short message service) may be used as long as an answer to a question can be obtained directly from the user in an interactive manner without telephone contact. That is, in the present embodiment, the first communication is performed while maintaining the connection of the first communication means, which is a line on which the user terminal performs Internet banking with the financial institution, via the network 100. The identity of the user who intends to conduct a financial transaction is confirmed by a second communication means such as telephone or SMS different from the means.
In addition, the confirmation request notifying unit 124 notifies the user terminal indicating that the telephone communication is performed, and responds to the financial transaction information supplied from the processing interruption unit 123 to perform the financial transaction. A notification mail (e-mail) indicating the transaction number of the financial transaction for which the fraudulent transaction is estimated is transmitted to the financial institution operating terminal 31.

  The person in charge of the financial institution, when the user contacts the financial institution in response to the notification by the above screen display, the personal information (address) of the user corresponding to the user ID and password account of this user , Date of birth, etc.) to verify the identity of the user and confirm the validity of the identity of the person holding the account. The person in charge of the financial institution is the person who holds the account as a result of the identity verification based on the personal information of the user, and if the legitimacy of the user can be confirmed, the fraudulent transaction detection system 12 is operated by the financial institution operation terminal 31. And the interruption flag in the transaction table of the transaction table database 128 is rewritten to a flag indicating the continuation of the process. In other words, the person in charge of the financial institution has confirmed the legitimacy of the user, so that the transaction interruption flag of all the same IP addresses, which are in a state of interrupting the transaction processing, is set to continue the transaction. Rewritten by the engine operation terminal 31.

In other words, the person in charge of the financial institution, if the legitimacy of the user can be confirmed in the result of the exchange of information with the user himself / herself, sets a transaction interruption flag for each user in the transaction table of the transaction table database 128. Is rewritten to continue. At this time, the person in charge of the financial institution, in the cause of the interruption in the transaction table of the transaction table database 128, not only the IP address but also the transfer destination account number is interrupted in accordance with the detection parameter. It may be possible to confirm the transfer / transfer of the financial transaction during the telephone contact and reflect the intention of the user to perform rewrite processing of the interruption flag.
In this embodiment, the suspension of the financial transaction of the user who has been confirmed to be legitimate in the telephone communication is canceled on a per-user basis, but as a configuration that is canceled per transaction in accordance with the operation of the financial institution. Also good.

When the process resuming unit 125 detects that the financial institution has edited the transaction table in the transaction table database 128, the process resuming unit 125 refers to the transaction table, and the interruption is rewritten from the state indicating the interruption of the process to the state indicating the continuation of the process. Perform flag detection. And the process resumption part 125 will output the instruction | indication which encourages the transaction system 11 to restart the financial transaction of the said interruption flag, if the interruption flag rewritten to the state which shows the continuation of a process is detected. Thereby, the transaction system 11 refers to the transaction table in the transaction table database 128 and resumes the processing of the interruption flag rewritten to the state indicating continuation.
Further, the process resuming unit 125 deletes the image display that prompts the financial institution requesting the financial transaction to contact the transaction processing screen displayed on the user terminal by the transaction system 11 and displays the image display. Change the screen to an input screen that continues processing.

When the display screen is changed to the input screen, the user resumes the process of inputting necessary items for performing the financial transaction on the input screen. As a result, the transaction system 11 outputs, via the network 100, an instruction for causing the account system 32 of the financial institution corresponding to the financial transaction to perform the transfer process as a financial transaction.
In addition, when a telephone call is not made from the user, the financial transaction process is kept suspended. At this time, if the user does not disconnect the connection between the user terminal and the Internet banking system 1 due to logoff or the like, the processing interruption unit 123 performs a certain period of time after displaying that prompts the user to call the display screen. After the elapse of time, the Internet line used for the transaction with the user terminal may be disconnected.

  Next, the flow of fraud detection processing in internet banking using the fraudulent transaction detection system 12 in this embodiment will be described with reference to FIG. FIG. 6 is a sequence diagram illustrating an operation example of fraud detection processing in Internet banking using the fraudulent transaction detection system 12 in the present embodiment. Hereinafter, the operation of the fraudulent transaction detection system 12 in this embodiment will be described by taking as an example the case of performing bank transfer / transfer Internet banking to the financial institution 3_2 using the user terminal 2_1 in FIG.

Step S1:
The user accesses the home page of the financial institution 3_2 from the user terminal 2_1. Thereby, the internet banking system 1 displays the home page for internet banking of the financial institution 3_2 provided on the transaction system 11 on the user terminal 2_1. Then, the user inputs his / her user ID and password on the login screen of the financial institution 3_2 on the displayed transaction system 11. As a result, the user logs in to the home page for internet banking of the financial institution 3_2 provided on the transaction system 11. And the transaction system 11 performs an authentication process with a user ID and a password, and if the input user ID and password are registered, the login from the user terminal 2_1 is permitted.

Step S2:
The transaction system 11 is an input screen for inputting information necessary for a financial transaction, for example, a transfer destination account number of a transfer destination financial institution, a transfer amount, etc., if it is a transfer / transfer to the display unit of the user terminal 2_1. Is displayed.

Step S3:
The user inputs the transfer destination account number of the transfer destination financial institution, the transfer amount, etc. on the input screen, and clicks a button indicating that the transfer / transfer process is advanced on the input screen with a mouse or the like. In the present embodiment, as the Internet banking process proceeds, the transaction system 11 sequentially displays an input screen for inputting information necessary for the transaction according to the input information. And after a user inputs the information set as a detection parameter in a predetermined input screen, the input information is fraudulent transaction detection system together with the transaction system 11 by clicking the button indicating the end of input on the display screen. 12 is input. Thereby, the fraudulent transaction detection system 12 extracts all the parameters of the transaction information to be compared with the detection parameters, and the financial transaction is an fraudulent transaction at a timing before the processing of the financial transaction in Internet banking proceeds to the next session. Whether or not is determined.

That is, at the above timing, the detection parameter determination unit 122 uses the IP address that is the transmission source IP address of the user terminal 2_1 as the transaction information used for comparison with the detection parameter, and the transfer destination entered by the user on the input screen. Extract account number.
Moreover, the detection parameter determination part 122 gives a transaction number with respect to the financial transaction which extracted transaction information with respect to the transaction table of the transaction table database 128, and writes an IP address and a transfer account number. At this time, the detection parameter determination unit 122 sets the interruption flag as a default value and keeps the process.

Then, the detection parameter determination unit 122 refers to the rejection table of the rejection table database 127, and the extracted transaction information (IP address, bank account number) is a detection parameter (IP address, bank account number, or both). ) Is determined.
When the extracted transaction information does not match the detection parameter, the detection parameter determination unit 122 interrupts processing (output of a detection signal) instructing to rewrite the suspension flag of the corresponding financial transaction in the transaction table of the transaction table database 128. The interruption flag is not performed on the unit 123, and the state where the processing is continued is kept.

  At this point, the transaction system 11 detects that a financial transaction with a new transaction number has been entered in the transaction table of the transaction table database 128 and is not currently processing the transaction table, and the interrupt flag is processed. Start the execution of financial transactions that are in a state of continuation. That is, the transaction system 11 instructs the account system 32 of the financial institution 3_2 having a transfer destination account that performs transfer / transfer of financial transactions to execute a new financial transaction process. Thereby, the account system 32 of the financial institution 3_2 performs the transfer / transfer process according to the transaction information supplied from the transaction system 11.

Step S4:
On the other hand, when the extracted transaction information matches the detection parameter, the detection parameter determination unit 122 outputs a detection signal indicating that this financial transaction has been detected as an illegal transaction to the processing interruption unit 123.
Thereby, the process interruption part 123 rewrites and changes the interruption flag of the applicable financial transaction of the transaction table of the transaction table database 128 from the state which continues a process to the state which interrupts a process. Further, for example, when the IP address of the transaction information matches the IP address of the detection parameter and the process is interrupted, the process interruption unit 123 displays information indicating that the IP address matches the cause of the interruption of the transaction table in the transaction table database 128. Write and store.

Further, the transaction system 11 detects that a financial transaction with a new transaction number has been entered in the transaction table of the transaction table database 128, and is not currently processing in the transaction table, and the interruption flag continues processing. Since there is no financial transaction in the state, the execution of the financial transaction is not started. At this time, the transaction system 11 does not instruct the account system 32 of the financial institution 3_2 having a transfer destination account that performs transfer / transfer of financial transactions to execute processing of new financial transactions. As a result, the financial transaction detected as the fraudulent transaction is temporarily stopped and suspended.
The confirmation request notifying unit 124 responds to the processing screen of the user terminal 2_1 displayed by the transaction system 11 corresponding to the interruption flag that has been newly rewritten to interrupt the processing in the transaction table of the transaction table database 128. Then, a display screen that prompts the financial institution 3_2 to make a telephone contact with the telephone number of the financial institution designated for confirming the financial transaction is displayed.

Step S5:
The confirmation request notifying unit 124 transmits to the financial institution operating terminal 31 of the financial institution 3_2 a notification mail indicating that the fraudulent transaction has been detected, including the transaction number of the financial transaction estimated as the fraudulent transaction. At this time, when the person in charge of the financial institution 3_2 confirms the notification mail at the financial institution operation terminal 31, the person in charge of the financial institution 3_2 accesses the fraudulent transaction detection system 12, refers to the transaction table in the transaction table database 128, and is described in the notification mail. Check the financial transaction information of the transaction number.

Step S6:
When the telephone contact is received from the user, the person in charge of the financial institution 3_2 is registered corresponding to the user ID and password account while referring to the transaction table in the transaction table database 128 by the financial institution operation terminal 31, for example. The identity of the user who made the inquiry is verified using the personal information of the existing user. For example, a person in charge of the financial institution 3_2 asks a user who has made an inquiry and listens to a preset item in the personal information of the user recorded in correspondence with the account in a question format. The identity of the user who has made the inquiry is verified by checking whether or not the registered personal information matches.

Step S7:
When the person in charge of the financial institution 3_2 confirms the validity of the user who has contacted the telephone by checking the preset items, the financial institution operation terminal 31 uses the transaction table in the transaction table database 128. Edit. In other words, the person in charge of the financial institution 3_2 determines that the IP address of the user terminal 2_1 used by the user whose validity has been confirmed matches the detection parameter and is determined to be an illegal transaction and is suspended. All the interruption flags are rewritten and changed from a state indicating interruption of processing to a state indicating continuation of processing. Thereby, the suspended state of the financial transaction which the user is performing via the user terminal 2_1 is cancelled | released.

Step S8:
When the process resuming unit 125 detects that the transaction table of the transaction table database 128 has been rewritten, the user terminal displayed by the transaction system 11 corresponding to the interrupt flag that has been newly rewritten to continue processing. In response to the processing screen of 2_1, an input screen on which a notification that prompts the financial institution 3_2 to contact the telephone number of the financial institution designated for confirming the financial transaction is displayed on the screen is displayed. Change to normal input screen without

Step S9:
When the display screen of the user terminal 2_1 is changed to the input screen by the process resuming unit 125, the user resumes the process of inputting necessary items for performing the financial transaction on the input screen of the user terminal 2_1. Thereby, the process of the financial transaction stopped as an illegal transaction shifts from a suspended state to a continued state as a legitimate financial transaction instead of an illegal transaction.

Step S10:
The transaction system 11 detects that the interruption flag of the transaction table in the transaction table database 128 has been rewritten to a state in which the process is continued, and resumes the transfer process that has been rewritten to a state in which the process is continued, and responds to this financial transaction. An instruction to cause the account system 32 of the financial institution 3_2 to perform the transfer process is output.
Thereby, the accounting system 32 of the financial institution 3_2 executes a financial transaction from the user requested from the user terminal 2_1 via the Internet banking system 1.

Here, in the flowchart of FIG. 6 described above, the process resuming unit 125 prompts the user to contact the input screen with the notification screen prompting the user after detecting that the transaction table of the transaction table database 128 has been rewritten. The configuration has been described as performing the process of changing to a normal input screen with no notification screen display (step S8).
However, the process resuming unit 125 may be configured as described below. That is, after detecting that the transaction table in the transaction table database 128 has been rewritten, the process resuming unit 125 keeps the screen display of the notification for prompting contact on the input screen, and is interrupted in step S9. You may comprise so that it may transfer to the state continued from the state. Here, after it is determined that the user using the user terminal 2_1 is a legitimate user corresponding to the account, the user performs the financial transaction on the input screen in which the screen display prompting the notification is displayed as it is. Click the button on the input screen to shift to the process. In response to this click, when the process resuming unit 125 detects that the user has clicked the button for shifting to the next process, the transaction system 11 in step S10 is performed in order to continue the suspended financial transaction process. The instruction for causing the account system 32 of the financial institution 3_2 to perform the transfer process is output via As a result, the billing system 32 of the financial institution 3_2 performs a financial transaction such as a transfer requested by the user of the user terminal 2_1 via the Internet banking system 1. As described above, after the validity of the user who uses the user terminal 2_1 is confirmed, when the user clicks the button to shift to the next process, the process is interrupted as an internal process in the Internet banking system 1. The transaction of the existing financial transaction is continued, and the financial transaction such as a transfer is supported to the account system 32 of the financial institution 3_2.

As described above, in the present embodiment, when the IP address and the transfer destination account number, which are transaction information of a financial transaction, are described in the rejection table, the financial transaction is interrupted and the detection Internet banking is performed. The second communication means such as telephone and SMS, which is different from the first communication means of the network line that is used, can contact the person in charge of the financial institution and correspond to the user ID and password After confirming the validity of the user based on the personal information, the processing of the financial transaction is resumed.
For this reason, according to the present embodiment, the financial transaction is not interrupted suddenly, but the financial transaction is temporarily suspended and resumed if the user's validity can be confirmed. There is an effect that a psychological restraint that it is difficult for a malicious person who illegally uses an ID and a password to make a call makes it possible to prevent unauthorized transactions using the user ID and password of another person. In particular, when the telephone (including Internet telephone) is used as the second means of communication, the voice tone (voice inflection) is transmitted to the other party, so talking directly against fraudulent transactions in financial transactions Is a great deterrent.

  In addition, according to the present embodiment, when the legitimacy of the user performing the financial transaction is confirmed in the communication by the second communication means to the financial institution, the user terminal (the first terminal used by the user for the financial transaction) In order to cancel the suspension of all suspended financial transactions corresponding to (1 communication means), the resumption of all the financial transactions requested by the user is made in one batch by contacting the second communication means once. Therefore, even when a plurality of financial transactions are interrupted, user usability can be ensured.

  In addition, according to the present embodiment, the detection parameter determination unit 122 detects fraudulent transactions using a rejection table created by aggregating detection parameters from each of the detection tables created by each financial institution. Institutions can share information on fraudulent transactions. In some financial institutions, even if this is the first fraudulent transaction from a malicious user, the detection parameters related to this fraudulent user's fraudulent transaction Since there is a possibility that the institution has detected, it is possible to detect fraudulent transactions in real time in financial transactions with a plurality of financial institutions with respect to the detection parameters registered in the rejection table.

Further, according to the present embodiment, the valid / invalid flag of each detection parameter of each financial institution in the refusal table can be arbitrarily rewritten from the financial institution operating terminal of each financial institution. Settings corresponding to the detection operation can be made.
Further, according to the present embodiment, the detection parameter in the refusal table can be deleted by the registered financial institution, so that it is possible to arbitrarily delete the detection parameter that has been determined not to be involved in fraudulent transactions. .

  Moreover, in this embodiment, the user who has confirmed the identity of the user who is conducting the financial transaction determined to be fraudulent transaction through the second communication means, and has made an inquiry using the second communication means The user's legitimacy is confirmed by directly exchanging questions about the personal information of the users registered in the user's account. However, in the operation of the financial institution, when the financial institution refers to the transaction table in the transaction table database 128 without directly confirming the identity of the user, it is confirmed that there is no problem from the history of the financial transaction of the user. The fraudulent transaction detection system 12 may be configured to resume financial transactions in Internet banking.

  Further, a program for realizing each function of the illegal transaction detection system 12 in the Internet banking system 1 in FIG. 1 is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into the computer system. The processing for detecting fraudulent transactions in Internet banking may be carried out by executing. Here, the “computer system” includes an OS and hardware such as peripheral devices.

Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used.
The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Furthermore, the “computer-readable recording medium” dynamically holds a program for a short time like a communication line when transmitting a program via a network such as the Internet or a communication line such as a telephone line. In this case, a volatile memory in a computer system serving as a server or a client in that case, and a program that holds a program for a certain period of time are also included. The program may be a program for realizing a part of the functions described above, and may be a program capable of realizing the functions described above in combination with a program already recorded in a computer system.

  The embodiment of the present invention has been described in detail with reference to the drawings. However, the specific configuration is not limited to this embodiment, and includes design and the like within a scope not departing from the gist of the present invention.

DESCRIPTION OF SYMBOLS 1 ... Internet banking system 2_1, 2_2, 2_n ... User terminal 3_1, 3_2, 3_n ... Financial institution 11 ... Transaction system 12 ... Unauthorized transaction detection system 31 ... Financial institution terminal 32 ... Account system 100 ... Network 121 ... Denial table edit process 122: Detection parameter determination unit 123 ... Processing interruption unit 124 ... Confirmation request notification unit 125 ... Processing resumption unit 126 ... Detection table database 127 ... Rejection table database 128 ... Transaction table database

Claims (6)

A fraudulent transaction detection method for detecting fraudulent transactions in financial transactions using internet banking.
Detection for determining whether or not the transaction information of a user who has accessed the financial institution is in advance matched with a detection parameter set in the rejection table as transaction information to stop the financial transaction in a financial transaction with the financial institution Parameter determination process;
A process interruption process of interrupting the processing of the financial transaction of the user detected as an unauthorized transaction in the detection parameter determination process;
A second communication means different from the first communication means for making a transaction confirmation inquiry to the financial institution to the user corresponding to the financial transaction suspended as an illegal transaction in the process interruption process; A confirmation request notification process for making a notification requesting to be used, and
And a process resumption process for resuming the user's suspended financial transaction based on confirmation information confirming that the user is a legitimate user based on the result of the inquiry. Transaction detection method.   2. The fraudulent transaction detection method according to claim 1, wherein the transaction information includes an IP address of a terminal used by the user and an account number in the financial institution to which the financial transaction is performed. The said financial transaction with the said suspended financial institution is restarted per said user when the said user is confirmed in the said inquiry that it is a legitimate user. Item 3. The fraudulent transaction detection method according to Item 2. A refusal table generating step for generating the refusal table in which the detection parameters are aggregated from each detection table provided for each financial institution and describing detection parameters related to fraudulent transactions detected by each of the financial institutions; The fraudulent transaction detection method according to any one of claims 1 to 3, wherein the fraudulent transaction is detected. 5. The fraud according to claim 4, wherein for each detection parameter, an invalid / invalid flag for validating or invalidating a detection process using the detection parameter is provided in the rejection table for each financial institution. Transaction detection method. A fraudulent transaction detection system that detects fraudulent transactions in financial transactions using internet banking.
In a financial transaction with a financial institution, a detection parameter determination unit that determines whether or not the transaction information of a user who has accessed the financial institution coincides with a detection parameter set in advance as the transaction information for which the financial transaction should be stopped When,
A process interruption unit for interrupting the process of the financial transaction of the user detected by the detection parameter determination unit as an unauthorized transaction;
Using the second communication means different from the first communication means performing the financial transaction to the user of the financial transaction that the processing interruption unit has interrupted as the fraudulent transaction. A confirmation request notifying unit for notifying to request,
A fraudulent transaction comprising: a process resuming unit for resuming the transaction suspended by the user based on confirmation information confirming that the user is a legitimate user based on the result of the inquiry. Detection system.

Images