JP4785651B2 - Financial institution booth monitoring system - Google Patents

Description

  The present invention relates to a monitoring system in a financial institution booth that monitors a suspicious behavior of an end user in a financial institution booth by a monitoring camera and reports the detected suspicious behavior.

  In recent years, fraudulent transactions due to counterfeiting of cash cards and credit cards have become a major problem. Along with this, biometrics authentication systems that use individual biometric features are being recognized as authentication means that are less likely to suffer financial damages such as counterfeiting, theft or loss of cards. However, the time and cost required to incorporate the biometrics authentication system into transactions of all financial institutions, and the problems such as the above risks of existing financial institution cards that do not support the authentication system and the leakage of personal information It is still difficult to deal with.

  Under these circumstances, there are ATMs (automated transaction devices) installed by financial institutions, and bad guys use voyeur cameras or counterfeit card readers in financial institution booths where there are no bankers or security guards. Then, steal personal information recorded on the card and personal identification number of the card from a bona fide end user (general customer) who is dealing with the card with an automatic machine, create a forged card, and fraud There is an urgent need for financial institutions to take measures against problematic behaviors such as transactions. As measures against this, detect suspicious behavior that is suspected of problematic behavior, such as the installation and use of voyeur cameras and counterfeit card readers, etc. in financial institution booths, staff and security personnel involved in monitoring in financial institution booths, etc. It may be possible to report to the appropriate action.

  On the other hand, Patent Document 1 below discloses a monitoring system that detects and reports a suspicious behavior of a suspicious person within a certain space. In this monitoring system, a monitoring target such as a safe or ATM is set in the monitoring area based on the image taken by the monitoring camera, and the occurrence of an object (suspicious person who attempts to illegally access the monitoring target) is detected in the monitoring area. , Acquiring a relative change amount of the object with respect to the monitoring target (detecting a suspicious movement of approaching the monitoring target), and determining whether to alert the monitoring center according to the change amount When necessary, the operator is notified and the image of the object is displayed on the main screen of the monitoring monitor.

  Further, Patent Document 2 below discloses a monitoring system that detects and warns the time from entry to exit of a monitored person in a certain space. In this monitoring system, when the entrance detection sensor detects that the user has entered a predetermined room such as a bathroom, the timer starts a time measuring operation, and the monitored person is removed from the predetermined room before the time measured by the timer expires. If it is not detected by the exit detection sensor that the user has left the room, a warning indicator lamp is displayed as a warning.

JP 2000-295598 A JP 2002-31815 A

  When the conventional monitoring system such as Patent Document 1 described above is applied in a financial institution booth, it is possible to automatically detect the approach of a person to an automatic machine as a suspicious action, but from other automatic machines Suspicious behavior such as the installation and use of voyeur cameras at remote locations or time-saving transactions with automatic machines cannot be automatically detected. In addition, when a good-willed end user approaches an automatic machine trying to conduct a transaction, it is automatically erroneously detected as a suspicious action. In addition, it is possible to display an image of the vicinity of the automatic machine photographed by the monitoring camera on the monitoring monitor and allow the monitoring staff to monitor the suspicious behavior judgment criteria of the monitoring staff, etc., monitor monitoring ability, difference in monitoring target scale, etc. There is a concern that the judgment result of suspicious behavior may vary due to oversight of suspicious behavior or overjudgment due to human factors.

  When a conventional monitoring system such as Patent Document 2 described above is applied in a financial institution booth, a suspicious behavior of a person staying in a financial institution booth for a certain period of time or more is automatically detected by an entrance / exit detection sensor. However, it is not possible to automatically detect suspicious behavior such as installation of a voyeur camera performed in other financial institution booths. In addition, if the inside of a financial institution booth is crowded and it takes a long time for a bona fide end user to enter the financial institution booth, make a transaction, and then leave the room, it is automatically detected as a suspicious stay. End up.

  The present invention solves the above-described problems, and the object of the present invention is to monitor financial institution booths that can reliably detect and report suspicious behavior of end users in financial institution booths. To provide a system.

In order to achieve the above object, a monitoring system in a financial institution booth according to the present invention is installed in an entrance / exit detection sensor for detecting an entrance / exit of an end user in a financial institution booth installed by the financial institution, and in the financial institution booth. An automatic machine capable of carrying out predetermined transactions, a first surveillance camera for photographing the entire financial institution booth, a second surveillance camera for photographing the vicinity of the automated machine, and images taken by the first and second surveillance cameras, Consists of a terminal device that displays the state in a financial institution booth, and a monitoring device that monitors and records the detection results of the entrance / exit detection sensors, the images taken by the first and second monitoring cameras, and the use state of the automatic machine is, the monitoring device, the entry and exit detection sensor of the detection results, based on the usage state of the photographed image, and automatic machines of the first and second surveillance camera, the end user line in a financial institution booth The monitor tracks, detects a suspicious behavior of the end user, it notifies the information of the suspicious behavior and the photographed image of the end user has been detected in the terminal device.

As described above, the behavior of the end user in the financial institution booth is tracked and monitored based on the detection result of the entrance / exit detection sensor, the captured images of the first and second monitoring cameras, and the use state of the automatic machine. When a suspicious behavior is detected, a suspicious stay other than the purpose of transaction in the financial institution booth before and after the transaction by the end user's automatic machine, a voyeur camera or a counterfeit card in an area not normally used in the financial institution booth Suspicious behavior such as illegal work such as installation and use of leaders, time-saving transactions, and continuous transactions under a different name can be automatically detected and reported to the terminal device. In addition, this makes it possible to prevent false behaviors such as approaching automated machines for good-will end-user transactions and long-term stays due to congestion in financial institution booths from being falsely detected as suspicious behaviors. Become. Furthermore, since the detected end user's suspicious behavior and information on the captured image are reported to the terminal device, the information is displayed on the terminal device and the suspicious person and the suspicious behavior are recognized by the staff involved in monitoring in the financial institution booth. This makes it possible to reduce the variation in judgment results such as oversight of suspicious behavior and overjudgment due to human factors such as suspicious behavior judgment criteria of staff members, monitor monitoring capabilities, and differences in the size of monitoring targets. And real-time or non-real-time status confirmation and monitoring of a specific target (suspicious person or area where suspicious behavior is detected or automatic machine) in the financial institution booth by the first and second monitoring cameras and automatic machines, Or, it is possible to make it easy and quick for the staff to take appropriate measures such as reporting to the security guards or requesting dispatch. In addition, each time a suspicious behavior of an end user is detected, the terminal device is notified of the suspicious behavior and information of the captured image of the end user, so that the characteristics of the suspicious person who frequently performs the suspicious behavior can be grasped. It is possible to take appropriate measures such as marking or reporting to the police.

  According to the present invention, a malicious end user who visits for an unfair reason can be automatically detected in a financial institution booth without misdetecting a natural behavior of a bona fide end user visiting for a legitimate reason. Various suspicious behaviors can be detected automatically before and after trading on the machine and reported to staff involved in monitoring in the financial institution booth. The improvement of the efficiency of early detection and crime prevention can be expected.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a configuration diagram of a financial institution booth monitoring system 10 according to the present embodiment. FIG. 2 is a schematic diagram inside the financial institution booth 1 according to the present embodiment. The financial institution booth monitoring system 10 has been introduced in financial institutions such as banks, and has conventionally been installed an operation monitoring system 20, an automatic machine monitoring system 30, an entrance / exit detection system 40, and a newly installed ATM. (Automated Teller Machine: automatic transaction apparatus) It is comprised from the monitoring camera 51, the monitoring camera server 52, the control apparatus 11, the monitoring server 12 in a booth, and the monitoring terminals 71 and 81.

  The financial institution booth 1 is an unmanned transaction service providing facility that is provided by a financial institution and does not have a bank employee or a guard. In the financial institution booth 1, an operation monitoring camera 21, an ATM 31, an entrance / exit detection sensor 41, and an ATM monitoring camera 51 are installed, and are connected by a LAN or the like. The monitoring center 2 is a manned facility installed by a financial institution at a location different from the financial institution booth 1. The monitoring center 2 includes a staff member (an employee of a financial institution or a monitoring business consignment company) who remotely monitors the financial institution booth 1. The monitoring center 2 includes an operation monitoring server 22, an automatic machine monitoring server 32, an entrance / exit detection server 42, a monitoring camera server 52, a control device 11, a booth monitoring server 12, and a monitoring terminal 71. Each is connected by a LAN or the like. The security company 3 is a company with a security guard entrusted with the security of the financial institution booth 1 by a financial institution. In some cases, the maintenance company entrusted not only to the security of the financial institution booth 1 but also to the financial institution is the security company 3. The security company 3 is provided with a monitoring terminal 81 used by security guards and the like. The monitoring terminal 81 is composed of a personal computer or a portable terminal device. Each device 11, 12, 21, 22, 31, 32, 41, 42, 51, 52, 71 of the monitoring terminal 81 and the financial institution booth monitoring system 10 is connected to the network 61 via a LAN or the like.

  The entrance / exit detection sensor 41 of the entrance / exit detection system 40 includes an infrared sensor or the like. As shown in FIG. 2, the entrance / exit detection sensor 41 is installed at the entrance / exit 4 of the financial institution booth 1, and detects entrance and exit of an end user (general customer) into the booth 1. The entrance / exit detection server 42 receives the detection signal of the entrance / exit detection sensor 41 and records the results of the end user's entrance, exit count, entrance / exit time, etc. detected by the entrance / exit detection sensor 41. In addition, the entry / exit detection server 42 includes a timer that measures the time taken for several actions from when the end user enters the financial institution booth 1 until it exits.

As shown in FIG. 2, a plurality of operation monitoring cameras 21 (first monitoring cameras) of the operation monitoring system 20 are installed near the ceiling in the financial institution booth 1, and the entire inside of the financial institution booth 1 is photographed without blind spots. To do. That is, the operation monitoring camera 21 captures all end users in the financial institution booth 1. The motion monitoring server 22 receives and records an image captured by the motion monitoring camera 21, recognizes the captured image, and tracks and monitors the behavior of the end user with the detected moving object as an end user. . Since a part of the image capturing area is shared by the operation monitoring cameras 21, the operation monitoring server 22 can relay the end users between the operation monitoring cameras 21 so as not to lose sight. Further, the operation monitoring server 22 detects the congestion state by counting the number of end users in the financial institution booth 1 based on the captured image of the operation monitoring camera 21. Further, the operation monitoring server 22 detects the intrusion of the end user into the area 25 that is not normally used, which is indicated by hatching in the vicinity of the ceiling in the financial institution booth 1 in FIG. 2, based on the captured image of the operation monitoring camera 21. The operation monitoring server 22 is provided with a timer that measures the continuation time and the accumulated time that the end user has entered and stagnated in the non-normal use area 25.

  The ATM 31 of the automatic machine monitoring system 30 is an example of an automatic machine that can perform predetermined transactions such as balance inquiry, payment, deposit, transfer, and transfer of deposit accounts using a card or passbook. A plurality of ATMs 31 are installed in the back of the financial institution booth 1 as shown in FIG. ATM 31 is equipped with a customer sensor for detecting the contact or approach of the end user, such as a touch panel or an infrared sensor. The automatic machine monitoring server 32 receives the transaction information (operation information) from the ATM 31 and the detection signal of the customer sensor, and monitors and records the transaction state (operation state) of the ATM 31 by the end user and the contact or approach to the ATM 31. To do.

As shown in FIG. 2, a plurality of ATM surveillance cameras 51 (second surveillance cameras) are installed from the rear upper side to the front lower side of each ATM 31 in the financial institution booth 1, and the vicinity of each ATM 31 is photographed without blind spots. To do. That is, each ATM monitoring camera 51 captures the vicinity of the front face of each ATM 31 and the end user in the vicinity at a position closer to the operation monitoring camera 21. The monitoring camera server 52 receives and records an image captured by the ATM monitoring camera 51, recognizes the captured image, and monitors the detected moving object as an end user to monitor the behavior of the end user near the ATM 31. To do.

  The control device 11 is composed of a personal computer or the like, and comprehensively controls each device 12, 21, 22, 31, 32, 41, 42, 51, 52, 71 of the financial institution booth monitoring system 10. The control device 11 tracks the behavior of the end user entering the financial institution booth 1 until leaving based on the detection result of the entrance / exit detection sensor 41, the captured images of the monitoring cameras 21 and 51, and the usage state of the ATM 31. And monitoring the suspicious behavior of the end user. Moreover, the control apparatus 11 records the detected suspicious behavior of the end user and information of the captured image in the monitoring server 12 in the booth. Further, the control device 11 notifies the monitoring terminal 71 of the detected suspicious behavior of the end user and information on the captured image.

  The monitoring terminal 71 is composed of a personal computer or the like, and is used by a staff member who remotely monitors the inside of the financial institution booth 1. The monitoring terminal 71 reads out the captured images of the monitoring cameras 21 and 51 and various information recorded in the servers 12, 22, 32, and 42 by an operator operation and displays them on the monitoring monitor. In addition, the monitoring terminal 71 displays the end user's suspicious behavior and the captured image information received from the control device 11 on the monitoring monitor. Further, the monitoring terminal 71 determines the suspicious level in the financial institution booth 1 based on the suspicious behavior of the end user and the information of the captured image, and displays it on the monitoring monitor. Further, the monitoring terminal 71 is notified of the suspicious behavior of the end user, information on the captured image, and the suspicious level to the monitoring terminal 81 of the security company 3. The monitoring terminal 81 displays the suspicious behavior of the end user notified from the monitoring terminal 71, information on the captured image, and the suspicious level on the monitoring monitor.

  FIG. 3 and FIG. 4 are flowcharts showing a procedure for detecting a suspicious behavior of a suspicious stay before and after an end user transaction in the financial institution booth 1. Each step is executed by the control device 11 controlling each device of the financial institution booth monitoring system 10. First, when the entrance / exit detection sensor 41 detects that the end user has entered the financial institution booth 1 (step N1 in FIG. 3), the entrance / exit detection server 42 records the entrance time. Further, the behavior monitoring server 22 starts tracking the behavior of the end user who entered the room based on the captured image of the behavior monitoring camera 21 (step N2). In addition, the measurement of the elapsed time until the end user who entered the room with the timer 1 provided in the entry / exit detection server 42 leaves the financial institution booth 1 is started (step N3). In addition to the timer 1 described above, the entry / exit detection server 42 includes a timer 2 for measuring an elapsed time from when a transaction can be made at the ATM 31, as shown in FIG. And a timer 3 for measuring an elapsed time from the time of leaving to the room.

  In step N4 in FIG. 3, the operation monitoring server 22 and the monitoring camera server 52 detect the congestion state of the financial institution booth 1 and the ATM 31 based on the captured images of the monitoring cameras 21 and 51. And the time limit of the timers 2 and 3 with which the entrance / exit detection server 42 is equipped is set based on the detected congestion state (step N5). Specifically, for example, as information indicating the congestion state, the total number of end users in the financial institution booth 1 and the end users waiting in line at the alignment standby position in the financial institution booth 1 in order to use the ATM 31 in order. Detect the number of people waiting. Then, for example, in accordance with the timer time limit setting table shown in FIG. 6, the time limit of the timer 2 corresponding to the number of end users waiting and the time limit of the timer 3 corresponding to the total number of end users are set. The information of the timer time limit setting table in FIG. 6 is set in advance assuming that two ATMs 31 are installed in the financial institution booth 1. Information of the timer time limit setting table in FIG. 6 and information in the timer setting table in FIG. 5 are recorded in the entrance / exit detection server 42 or the booth monitoring server 12. In the example shown in FIG. 5, the time limits of the timers 2 and 3 are each set to “60 seconds”, and the time limit of the timer 1 is set to “none”. The processes in steps N4 and N5 may be performed before step N1, or may be performed separately from the series of processes in FIGS.

  Further, in step N6 of FIG. 3, the control device 11 takes the image information of the monitoring cameras 21 and 51 and the transaction information of each ATM 31 notified from the operation monitoring server 22, the monitoring camera server 52, and the automatic machine monitoring server 32. And usage information of each ATM 31 is confirmed based on the operation information (ON / OFF state of customer sensor, information on presence / absence of failure of ATM 31). As a result of the confirmation, if there is an empty ATM 31 that is not used by the end user (step N7: NO) and the empty ATM 31 is in trouble (step N8: YES), there is no ATM 31 that can be traded. Therefore, it waits for another empty ATM 31 to be generated (step N9: NO). On the other hand, if there is an empty ATM 31 (step N7: NO) and the empty ATM 31 is not faulty (step N8: NO), or if an empty ATM 31 occurs after a while (step N9: YES) Since there is an ATM 31 that can be traded, the elapsed time from when the ATM 31 can be traded by the timer 2 of the entry / exit detection server 42 until the end user whose behavior is monitored by the ATM 31 starts trading is measured. Is started (step N10).

  At the time of the above processing, in step N6, what is the order in which the end user who is monitoring the behavior is ready to trade at the ATM 31 without waiting or the end user who is monitoring the behavior becomes ready to trade at the ATM 31? You may make it detect whether it is the second. Based on this detection information, it may be determined in steps N7 and N9 whether there is an empty ATM 31 that the end user who is monitoring the behavior may use from now on, and the process may proceed to step N10.

  When the timer 2 starts measuring, the action monitoring server 22, the monitoring camera server 52, and the automatic machine monitoring server 32 are monitoring the behavior based on the captured images of the monitoring cameras 21 and 51 and the transaction information notified from the ATM 31. It is determined whether or not the end user has started a transaction at the ATM 31 where the transaction can be performed (step N11). If the transaction is not started (step N11: NO), the entry / exit detection server 42 confirms whether or not the timer 2 has timed out, that is, the time limit is exceeded (step N12). If not (step N12: NO), it is determined again whether or not the transaction is started in step N11. Before the timer 2 expires (step N12: NO), when the end user who is monitoring the behavior starts a transaction at the ATM 31 where the transaction is possible (step N11: YES), the automatic machine monitoring server 32 and the entry / exit detection server 42 The transaction start time is recorded in, and the measurement of the timer 2 is ended (step N15).

  On the other hand, when the timer 2 is timed out (step N12: YES) without starting the transaction at the ATM 31 where the end user who is monitoring the behavior can trade (step N11: NO), whether the time over is the second time or more. Is determined (step N13). If the timer 2 is over for the first time (step N13: NO), the end user who is monitoring the behavior stays in the financial institution booth 1 for a certain period of time (time limit of the timer 2) for a purpose other than the transaction at the ATM 31. It is detected that the suspicious behavior before the transaction was performed, and the detection result is recorded in the monitoring server 12 in the booth, and the suspicious behavior of the end user is photographed by the monitoring cameras 21 and 51 and the servers 22 and 52 are captured. The information of the photographed image recorded in is reported to the monitoring terminal 71 of the monitoring center 2 (step N14). After this, the end user who is monitoring the behavior does not yet start a transaction at the ATM 31 where the transaction can be performed (step N11: NO), and when the timer 2 times out before or again (step N12: YES) ), That is, when the measurement time of the timer 2 becomes (N + 1) times or more of the time limit (N is the number of times the timer 2 has already timed out), the time over is the second time or more (step N13: YES). The suspicious behavior before the transaction is detected and the suspicious behavior before the transaction is detected, and the result of detection and the number N of time-overs are recorded in the booth monitoring server 12, and the timer 2 is measured. The process ends (step N15).

  When the timer 2 measurement is finished, it is determined whether or not the end user who is monitoring the behavior has started the transaction at the ATM 31 where the transaction is possible (step N16 in FIG. 4). If the transaction has not been started (step N16: NO) ), It is determined whether or not the end user has left the financial institution booth 1 (step N17). When the motion monitoring server 22 and the entrance / exit detection server 42 detect that the end user who is monitoring the behavior has exited based on the captured image of the motion monitoring camera 21 and the detection result of the entrance / exit detection sensor 41 (step N17). : YES), the measurement of the timer 1 is terminated (step N25), the measurement results of the timers 1, 2, and 3 and the leaving time are recorded and stored in the entry / exit detection server 42 (step N26). 1, 2, and 3 are reset (step N27). In this case, the entry / exit detection server 42 records that the timer 3 has not been measured.

  On the other hand, when it is detected that the end user who is monitoring the behavior has started trading at the ATM 31 that can be traded after the measurement of the timer 2 is finished (step N16: YES), the automatic machine monitoring server 32 and the entry / exit detection server The transaction start time is recorded in 42, and the automatic machine monitoring server 32 determines whether or not the end user has ended the transaction based on the transaction information of the ATM 31 (step N18). When the end user who is monitoring the behavior ends the transaction at the ATM 31 (step N18: YES), the transaction end time is recorded in the automatic machine monitoring server 32 and the entrance / exit detection server 42, and the timer 3 of the entrance / exit detection server 42 is recorded. The measurement of the elapsed time from when the end user ends the transaction at the ATM 31 until the end of the transaction from the financial institution booth 1 is started (step N19). Next, based on the image captured by the motion monitoring camera 21 and the detection result of the entrance / exit detection sensor 41 at the motion monitoring server 22 and the entrance / exit detection server 42, the end user who is monitoring the behavior exits from the financial institution booth 1. It is determined whether or not (step N20). If no exit is detected (step N20: NO), it is checked whether the timer 3 has timed out, that is, whether or not the time limit is exceeded (step N21). If the time has not expired (step N21: NO), It is again determined whether or not the exit from the room is detected in Step N20. Before the timer 3 expires (step N21: NO), if the end user who is monitoring the behavior leaves the financial institution booth 1 (step N20: YES), the measurement of the timer 3 is terminated (step N24). The measurement of timer 1 is terminated (step N25).

  On the other hand, if the end user whose behavior is being monitored does not leave the financial institution booth 1 (step N20: NO) and the timer 3 times out (step N21: YES), whether the time over is the second time or more. Is determined (step N22). If the timer 3 is over for the first time (step N22: NO), the end user who is monitoring the behavior stays in the financial institution booth 1 for a certain period of time (time limit of the timer 3) for a purpose other than the transaction at the ATM 31. It is detected that the suspicious behavior after the transaction has been performed, and the detection result is recorded in the monitoring server 12 in the booth, and the suspicious behavior of the end user is photographed by the monitoring cameras 21 and 51 and the servers 22 and 52 are captured. The information of the photographed image recorded in is reported to the monitoring terminal 71 (step N23). After this, the end user who is monitoring the behavior still does not leave the financial institution booth 1 (step N20: NO), and when the timer 3 times out before or again (step N21: YES). That is, when the timer 3 becomes (N + 1) times or more of the time limit (N is the number of times the timer 3 has already timed out), since the time over is the second time or more (step N22: YES), the dubious suspicious behavior, etc. Is detected, the suspicious behavior after the transaction is detected, and the detection result and the time-over count N are recorded in the in-booth monitoring server 12, and the measurement of the timer 3 is terminated (step S1). N24), the timer 1 measurement is terminated (step N25).

  When the measurement of the timer 1 is completed, the measurement results of the timers 1, 2 and 3 and the exit time are recorded and stored in the entrance / exit detection server 42 (step N26), and the timers 1, 2 and 3 are reset ( Step N27). If there is data such as measured values of timers 1, 2, and 3 stored in the entry / exit detection server 42 for 60 days (step N28: YES), the data is deleted (step N29), and the process ends.

  FIG. 7 is a flowchart showing a procedure for detecting suspicious behavior in the abnormal usage area 25 of the end user in the financial institution booth 1. Each step is executed by the control device 11 controlling each device of the financial institution booth monitoring system 10. First, when the entrance / exit detection sensor 41 detects that the end user has entered the financial institution booth 1 (step N31), the entrance / exit detection server 42 records the entrance time. Further, the behavior monitoring server 22 starts tracking the behavior of the end user who entered the room based on the captured image of the behavior monitoring camera 21 (step N32). Then, it is determined whether or not the end user who is monitoring the behavior is detected in the non-normal use area 25 (step N33). If the end user is not detected in the non-normal use area 25 (step N33: NO), the end user is It is determined whether or not the user leaves the financial institution booth 1 (step N47).

  If the end user is not detected by the entry / exit detection sensor 41 (step N47: NO) and the end user is detected in the non-normal use area 25 (step N33: YES), the action monitoring server 22 is monitored. It is then determined whether the timer 32 is measuring (step N34). As shown in FIG. 8, the operation monitoring server 22 includes a timer 31 that measures the duration time during which the end user has entered the non-normal use area 25 and has been stagnated, and a timer 32 that measures the accumulated time. In the example of FIG. 8, the time limit of the timer 31 is set to “20 seconds”, and the time limit of the timer 32 is set to “120 seconds”. Information of the timer setting table in FIG. 8 is recorded in the operation monitoring server 22. If the timer 32 is not measuring (step N34: NO), the end time and the accumulated time that the end user who is monitoring the behavior in the timers 31 and 32 of the operation monitoring server 22 enters the non-normal use area 25 and stays there. Measurement is started (step N35).

  Then, it is confirmed whether or not the timer 32 has exceeded the time limit, that is, the time limit has been exceeded (step N37). If the timer 32 has not exceeded the time limit (step N37: NO), the end user who is monitoring the behavior is designated as an abnormal use area. It is determined whether or not it is no longer detected at 25 (step N40). If the end user who is monitoring the behavior continues to be detected in the non-normal use area 25 (step N40: NO), it is determined whether or not the timer 31 has timed out (step N44), and the time must be over. If this is the case (step N44: NO), it is determined again in step N40 whether or not the end user has been detected in the non-normal use area 25. If the end user who is monitoring the behavior is not detected in the non-normal use area 25 (step N40: YES) before the timer 31 expires (step N44: NO), the measurement of the timer 31 is terminated (step N41). ) The measurement result of the timer 31 is stored in the operation monitoring server 22 (step N42), and the timer 31 is reset (step N43).

  On the other hand, if the end user who is monitoring the behavior continues to be detected in the non-normal use area 25 (step N40: NO) and the timer 31 times out (step N44: YES), is the time over the second time or more? It is determined whether or not (step N45). If the timer 31 is over for the first time (step N45: NO), the suspicious behavior that the end user who is monitoring the behavior has been stagnating in the non-normal use area 25 for a certain period of time (time limit of the timer 31) or more. And the detection result is recorded in the booth monitoring server 12, and the suspicious behavior of the end user and the information of the captured image captured by the motion monitoring camera 21 and recorded in the motion monitoring server 22 are recorded. To the monitoring terminal 71 (step N46).

  Thereafter, the end user who is monitoring the behavior is still detected in the non-normal use area 25 (step N40: NO), and when the timer 31 has timed out before, the time is further over (step N44: YES), that is, when the timer 31 is equal to or greater than (N + 1) times the time limit (N is the number of times the timer 31 has already timed out), the time over is the second time or more (step N45: YES). It is detected that the suspicious behavior is continued in the non-usual use area 25 without reporting the behavior or the like, and the detection result and the time over frequency N are recorded in the monitoring server 12 in the booth. If the end user who is monitoring the behavior is no longer detected in the non-normal use area 25 (step N40: YES), the measurement of the timer 31 is terminated (step N41), and the measurement result of the timer 31 is stored in the operation monitoring server 22 (Step N42), the timer 31 is reset (Step N43).

  After resetting the timer 31, if the end user is detected again in the non-normal use area 25 (step N33: YES) without detecting the exit of the end user who is monitoring the behavior (step N47: NO), the timer 32 is Since measurement is in progress (step N34: YES), the timer 31 starts measurement again (step N36). Then, it is confirmed whether or not the timer 32 has timed out (step N37), and if it has timed out (step N37: YES), it is determined whether or not the time over is the second time or more (step N38). ). If the timer 32 is over for the first time (step N38: NO), the suspicious behavior that the end user who is monitoring the behavior has been stagnating in the non-usual use area 25 continuously for a certain time (time limit of the timer 32) or more. Or, it is detected that the suspicious behavior that has frequently entered and exited the non-normal use area 25 and stagnated for a certain period of time (time limit of the timer 32) has been performed, and the detection result (to the non-normal use area 25) (Including the number of intrusions by the end user) in the in-booth monitoring server 12, and the monitoring terminal 71 records the suspicious behavior of the end user and the information of the captured image captured by the operation monitoring camera 21 and recorded in the operation monitoring server 22. (Step N39).

  Thereafter, after performing Steps N40 to N46, N47, N33, N34, and N36 as described above, if the timer 32 has timed out before in Step N37, the time will be further over (Step N37: YES). ), That is, when the timer 32 becomes (N + 1) times or more of the time limit (N is the number of times the timer 32 has already timed out), the time over is the second time or more (step N38: YES). The suspicious behavior in the non-usual use area 25 is detected, and the detection result and the time-over count N are recorded in the booth monitoring server 12. Then, after performing Steps N40 to N46 as described above, if the entrance / exit detection sensor 41 detects exit from the financial institution booth 1 during behavior monitoring in Step N47 (Step N47: YES), The measurement of the timer 32 is ended (step N48), the measurement result of the timer 32 is stored in the operation monitoring server 22 (step N49), and the timer 32 is reset (step N50). If there is data such as the measured values of the timers 31 and 32 stored in the operation monitoring server 22 for 60 days (step N51: YES), the data is deleted (step N52), and the process ends.

  FIG. 9 is a flowchart showing a procedure for detecting a suspicious behavior during a transaction at an ATM 31 of an end user in the financial institution booth 1. Each step is executed by the control device 11 controlling each device of the financial institution booth monitoring system 10. First, when an end user whose behavior is being monitored by the monitoring cameras 21 and 51 and the servers 22 and 52 is detected by a customer sensor provided in the ATM 31 (step N61), the servers 22 and 52 and automatic machine monitoring are detected. The server 32 notifies the in-booth monitoring server 12 of the start of the transaction at the ATM 31 by the end user (step N62). Also, transaction information (input operation information, card or passbook record information, etc.) notified from the ATM 31 is confirmed by the automatic machine monitoring server 32 (step N63).

  Then, the customer sensor, the operation monitoring server 22 and the monitoring camera server 52 detect that the same end user is not away from the ATM 31 based on the detection result of the customer sensor and the captured images of the monitoring cameras 21 and 51. On the other hand, if it is detected by the automatic machine monitoring server 32 based on the transaction information of the ATM 31 that the same name user has continuously performed transactions at the ATM 31 (step N64: YES), a predetermined suspicious transaction pattern at the ATM 31 is detected. Is determined (step N65). As a suspicious transaction pattern, for example, as shown in FIG. 10, pattern 1 is a balance inquiry transaction of three or more times by the same name user, pattern 2 is a payment transaction of three or more non-book (does not use a passbook) by the same name user. , Pattern 3 of continuous transfer transactions or transfer transactions to the same name account, Pattern 4 of 3 or more cancel key operations by the same user, and 2 or more balance inquiry transactions and 2 or more non-books by the same name user Pattern 5 of continuous execution of payment transactions is preset. The information of the suspicious transaction pattern setting table in FIG. 10 is recorded in the automatic machine monitoring server 32 or the booth monitoring server 12.

  If it is detected in Step N65 of FIG. 9 that any of the suspicious transaction patterns 1 to 5 is detected (Step N65: YES), if the suspicious behavior has not been reported to the monitoring terminal 71 (Step N68: NO), behavior monitoring is performed. It is detected that the suspicious behavior during the transaction that the end user in the bank executed the transaction pattern at the ATM 31, and the detection result is recorded in the monitoring server 12 in the booth, and the suspicious behavior and monitoring of the end user are recorded. Information on the captured images captured by the cameras 21 and 51 and recorded in the servers 22 and 52 is reported to the monitoring terminal 71 (step N69).

  And it does not detect that the end user who is monitoring the behavior leaves the ATM 31 and ends the transaction (step N70: NO), and further does not detect that the same name user has made a continuous transaction at the ATM 31 (step S70). N64: NO), or it is detected again that the same name user has made a continuous transaction at the ATM 31 (step N64: YES), and if the execution of a suspicious transaction pattern is not detected at the ATM 31 (step N65: NO) ), It is determined whether or not the ATM 31 has been continuously executed by a user with a different name (step N66). When it is detected that the end user who is monitoring the behavior continuously conducts the transaction with the different name user using different cards or the like at the ATM 31 without leaving the ATM 31 (step N66: YES), the password is entered. It is determined whether or not a mistake has been made twice consecutively (step N67). In ATM31, when the input of the PIN number performed at the time of transaction with a card or the like is missed three times in succession, the transaction with the card or the like is automatically prohibited thereafter. In step N67, a suspicious behavior of two consecutive mistakes in inputting a password before prohibiting the transaction is detected. If two consecutive mistakes of PIN number input are detected (step N67: YES), if the suspicious behavior has been reported to the monitoring terminal 71 (step N68: YES), the above suspicious behavior is not reported, and the above-mentioned It is detected that the suspicious behavior during the transaction, that is, twice consecutive mistakes in inputting the personal identification number with the alias user card, is performed, and the detection result is recorded in the monitoring server 12 in the booth.

  Thereafter, the customer sensor, the operation monitoring server 22 and the monitoring camera server 52 detect that the end user who is monitoring the operation is away from the ATM 31 based on the detection result of the customer sensor and the captured images of the monitoring cameras 21 and 51. However, when the automatic machine monitoring server 32 detects that the transaction at the ATM 31 has ended based on the transaction information of the ATM 31 (step N70: YES), the automatic monitoring result of the ATM 31 by the automatic machine monitoring server 32 is automatically displayed. If there is data such as monitoring results stored in the machine monitoring server 32 (step N71) and stored in the automatic machine monitoring server 32 for 60 days (step N72: YES), the data is deleted (step N73), finish.

  FIG. 11 is a flowchart showing a procedure for handling a suspicious behavior of an end user in the financial institution booth 1. Steps N81 to N84 are executed by the monitoring terminal 71 of the monitoring center 2, and steps N85 to N96 are executed by a staff member using the monitoring terminal 71. First, the information on the suspicious behavior of the end user and the photographed image received from the control device 11 at step N14 in FIG. 3, step N23 in FIG. 4, steps N39 and N46 in FIG. 7, or step N69 in FIG. 9 is received. Then (step N81), the monitoring terminal 71 is connected to each of the monitoring cameras 21 and 51 in real time (step N82).

  Based on the received suspicious behavior information of the end user, the suspicious level is determined (step N83). The monitoring terminal 71 records information on a suspicious level determination table as shown in FIG. As the suspicious behavior of the same end user, the above-described pre-transaction start time-over (step N14 in FIG. 3), trade back room time-over (step N23 in FIG. 4), non-normal use area continuation time-over (step in FIG. 7) N46), when any one of the non-normal use area accumulated time-out (step N39 in FIG. 7) or the suspicious transaction pattern during transaction (step N69 in FIG. 9) is reported, or the transaction start time-over before transaction and transaction When both of the retreat room time overs are notified, the suspicious level is determined to be level 1. In this level 1, it is necessary to check the situation in the financial institution booth 1. In addition, as the suspicious behavior of the same end user, at least one of pre-transaction start time over and trade back room time over, non-normal use area continued time over, non-normal use area accumulated time over, or suspicious transaction pattern during trade If any one of the above is reported, or if any two of the non-normal use area continuation time over, the non-normal use area accumulated time over, or the suspicious transaction pattern during trading are reported, the suspicious level is set to level 2. to decide. At level 2, it is necessary to consider the dispatch of security guards into the financial institution booth 1. When the suspicious level is determined, the monitoring terminal 71 sounds an alarm provided, and the received suspicious behavior of the end user and information on the photographed image, etc., the determined suspicious level, and actions to be taken at the suspicious level (status confirmation) , Examination of dispatch of guards), and real-time captured images of the monitoring cameras 21 and 51 are displayed on the monitoring monitor for notification (step N84).

  Then, the staff of the monitoring center 2 confirms the contents of the data notified by the monitoring terminal 71 and the display of the monitoring monitor (steps N85 and N86), and determines whether or not there is a problem in the financial institution booth 1. (Step N87). At this time, if necessary, for example, the captured images of the monitoring cameras 21 and 51 are verified, the congestion state in the financial institution booth 1 is confirmed from the captured images, the transaction state of the ATM 31 is verified, the server 12, 22, 32, 42, 52, the behavior information of the corresponding end user, transaction information at ATM 31, etc. are extracted and verified. If it is determined that there is a problem that may cause a crime from the suspicious behavior or the like confirmed by the monitoring monitor (step N87: YES), the staff or the like operates the monitoring terminal 71, and the servers 12, 22, 32, 42, and 52 are operated. The information in the past database is read out and displayed on the monitoring terminal 71 for confirmation (step N88). Then, the countermeasures are examined (step N89), and if it is determined that a request to the security company 3 is necessary (step N90: YES), if not requested (step N91: NO), the security company 3 A request for dispatch is made (step N92), and the detected suspicious behavior of the end user and data to be used as a reference for security such as the captured image and suspicious level are transmitted (reported) to the monitoring terminal 81 of the security company 3 (step N93). Thereafter, the security guard of the security company 3 confirms the data transmitted from the monitoring terminal 71 with the monitoring monitor of the monitoring terminal 81 and is dispatched into the financial institution booth 1 to check the situation in the booth 1 and the booth 1 Appropriate measures such as removal of the voyeur camera installed inside are taken. Thereby, the problem in the financial institution booth 1 is solved (step N87: NO).

  If it is determined in step N90 that a request to the security company 3 is not necessary (step N90: NO), the situation can be confirmed from the monitoring center 2 that can be performed by a staff member or the like as needed or in the financial institution booth 1. Determine and implement measures. When any countermeasure is implemented (step N94: YES), the contents of the countermeasure, the result of the implementation, and other communication items are reported to a predetermined department of the financial institution (step N95), and the terminal device 71 and the terminal device are reported. 71 is recorded in the booth monitoring server 12 via 71. Thereafter, when there is no countermeasure to be taken (step N96: YES), the process is terminated.

  According to the above, based on the detection result of the entrance / exit detection sensor 41, the captured images of the monitoring cameras 21 and 51, and the usage state of the ATM 31, the behavior of the end user in the financial institution booth 1 is tracked and monitored. Since the behavior is detected, the suspicious stay other than the transaction purpose in the financial institution booth 1 before, during and after the transaction at the ATM 31 of the end user, the voyeur camera or the forgery in the non-normal use area 25 in the financial institution booth 1 Suspicious behavior such as unauthorized work such as installation and use of a card reader, time-saving transactions, and continuous transactions under the name of a different user can be automatically detected and reported to the monitoring terminal 71. In addition, this makes it possible to prevent erroneous detection of suspicious behavior such as approaching the ATM 31 for good faith end-user transactions and long stays due to congestion in the financial institution booth 1. Become. Further, since the detected end user's suspicious behavior and the information of the captured image are reported to the monitoring terminal 71, the information can be displayed on the monitoring terminal 71 so that the clerk or the like can recognize the suspicious person and the suspicious behavior. It is possible to reduce variations in judgment results such as oversight of suspicious behavior and overjudgment due to human factors such as suspicious behavior judgment criteria such as differences in monitor monitoring ability and monitoring target scale. In addition, since the monitoring terminal 71 notifies the monitoring terminal 81 of the security company 3 of the suspicious behavior and the image of the suspicious person, the security staff of the security company 3 can recognize the suspicious person and the suspicious behavior.

  As a result, real-time or non-real-time status confirmation or monitoring of a specific target (such as a suspicious person or an area where suspicious behavior is detected or ATM 31) in the financial institution booth 1 by a monitoring camera 21, 51 or ATM 31, or a security guard It is possible to make it easier and faster for staff members to take appropriate measures such as reporting to the public and requesting dispatch. In addition, it is possible for the security guard to easily and quickly take appropriate measures such as checking the situation in the financial institution booth 1 and determining and eliminating the presence or absence of problems. In addition, every time the suspicious behavior of the end user is detected, the monitoring terminal 71 is notified of the suspicious behavior and information of the captured image of the end user, so that the characteristics of the suspicious person who frequently performs the suspicious behavior can be grasped. Appropriate measures such as marking or reporting to the police.

  In addition, since the operation monitoring camera 21 that captures the entire inside of the financial institution booth 1 and the ATM surveillance camera 51 that captures the vicinity of the ATM 31 are installed, a position away from the ATM 31 in the financial institution booth 1 and a position in the vicinity of the ATM 31 The end user's behavior at can be reliably tracked and monitored. In addition, since a plurality of operation monitoring cameras 21 are installed, the inside of the financial institution booth 1 can be photographed and monitored without blind spots. In addition, since a part of the shooting area is shared by the operation monitoring cameras 21, it is possible to relay end users between the operation monitoring cameras 21 so as not to lose sight. Furthermore, since the ATM monitoring camera 51 is installed for each ATM 31, it is possible to capture and monitor the end users in the vicinity of each ATM 31 in more detail, and to obtain the external features of the end users. it can. In addition, the usage state and congestion state of each ATM 31 can be photographed and monitored.

  Further, since the end user detects the suspicious behavior of the end user based on the elapsed time from when the ATM 31 becomes transactable until the end user whose behavior is being monitored by the ATM 31 starts trading, Suspicious behavior before the transaction that has been performed without entering the ATM 31 after entering the booth 1 can be detected.

  In addition, based on the usage state of the ATM 31 and the captured images of the monitoring cameras 21 and 51, the end user who is monitoring the behavior is detected by detecting when the end user who is monitoring the behavior becomes able to trade at the ATM 31 (time). It is possible to accurately measure the elapsed time from when the transaction can be made at ATM 31 until the transaction is started at ATM 31. For this reason, since ATM31 which other end users can trade is used, even if the end user under action monitoring cannot start dealing with ATM31, it can prevent detecting it erroneously as suspicious behavior.

  Further, the congestion state in the financial institution booth 1 is detected based on the images taken by the monitoring cameras 21 and 51, and the elapsed time until the congestion state and the ATM 31 that can be traded by the end user who is monitoring the behavior start trading. Since the suspicious behavior of the end user before the transaction is detected based on the above, since the inside of the financial institution booth 1 is congested, it takes time until the end user who is monitoring the behavior starts the transaction at the ATM 31. Even if it takes, it can be prevented that it is erroneously detected as suspicious behavior. In addition, by notifying the monitoring terminal 71 of the congestion state in the financial institution booth 1, the congestion state can be grasped by a staff member or the like, and it can be used as a material for determining whether there is a problem with suspicious behavior.

  Further, since the end user who is monitoring the behavior detects the suspicious behavior of the end user based on the elapsed time from the end of the transaction at the ATM 31 to the exit from the financial institution booth 1, the end user It is possible to detect a suspicious behavior after a transaction that has been made without exiting from the financial institution booth 1 after ending the process.

  Further, since the end user who is monitoring the behavior detects the suspicious behavior of the end user based on the continuation time or accumulated time in which the end user has entered the non-normal use area 25 in the financial institution booth 1 and stagnated, the end user However, it is possible to detect suspicious behavior such as installation of a voyeur camera that has been invaded and stagnated in the non-normal use area 25 continuously or divided into several times. In particular, by setting the time limit of the timers 31 and 32 for measuring the duration time or the integration time to be small, the end user is performing suspicious behavior in the non-usual use area 25 within a short time, or divided into multiple times. Even if the person enters the financial institution booth 1 and enters the non-usual use area 25 and performs suspicious behavior sequentially in a short time, the suspicious behavior can be detected.

  In addition, since the transaction status of the ATM 31 is monitored and the end user who is monitoring the behavior of the ATM 31 detects a suspicious behavior of the end user based on the execution of a predetermined suspicious transaction pattern, the same end It is possible to detect suspicious behavior such as time-saving transactions in which the user repeatedly performs the same transaction and fraudulent transactions in which the same end user performs transactions with a card with a different user name.

  Further, each time when each suspicious behavior is detected, the monitoring terminal 71 is notified of the information on the suspicious behavior and the captured image of the end user who has performed the suspicious behavior, and the monitoring terminal 71 determines the suspicious level based on the information. Since the information is displayed on the monitoring monitor, it is possible to make a staff member or the like recognize the suspicious person, the suspicious behavior, and the suspicious level, and to take a more appropriate countermeasure easily and quickly.

It is a block diagram of the monitoring system in a financial institution booth. It is the schematic in a financial institution booth. It is a flowchart which shows the detection procedure of the suspicious action before and after a transaction. FIG. 4 is a continuation flowchart of FIG. 3. It is a figure which shows a timer setting table. It is a figure which shows a timer time limit setting table. It is a flowchart which shows the detection procedure of suspicious action in a non-normal use area | region. It is a figure which shows a timer setting table. It is a flowchart which shows the detection procedure of the suspicious action during transaction. It is a figure which shows a suspicious transaction pattern setting table. It is a flowchart which shows the procedure at the time of detection of suspicious behavior. It is a figure which shows a suspicious level judgment table.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Financial institution booth 10 Financial institution booth monitoring system 11 Controller 12 Booth monitoring server 20 Operation monitoring system 21 Operation monitoring camera 22 Operation monitoring server 30 Automatic machine monitoring system 31 ATM
32 Automatic machine monitoring server 40 Entry / exit detection system 41 Entry / exit detection sensor 42 Entry / exit detection server 51 ATM monitoring camera 52 Monitoring camera server 71 Monitoring terminal 81 Monitoring terminal

Claims (8)

An entrance / exit detection sensor for detecting the entrance / exit of an end user in a financial institution booth installed by a financial institution,
An automatic machine installed in the financial institution booth and capable of performing a predetermined transaction;
A first surveillance camera for photographing the entire inside of the financial institution booth;
A second surveillance camera for photographing the vicinity of the automatic machine;
A terminal device for displaying images taken by the first and second monitoring cameras and a state in the financial institution booth;
A detection result of the entrance / exit detection sensor, a captured image of the first and second monitoring cameras, and a monitoring device that monitors and records the use state of the automatic machine,
The monitoring device determines an end user's behavior in the financial institution booth based on the detection result of the entrance / exit detection sensor, the captured images of the first and second monitoring cameras, and the use state of the automatic machine. A financial institution booth monitoring system characterized by tracking and monitoring, detecting the suspicious behavior of the end user, and reporting the detected suspicious behavior of the end user and information of a captured image to the terminal device. In the financial institution booth monitoring system according to claim 1 ,
The monitoring device includes means for measuring an elapsed time from when the automatic machine becomes transactable until an end user whose behavior is monitored by the automatic machine starts a transaction, and based on the elapsed time, the end user's And a means for detecting suspicious behavior before a transaction. In the financial institution booth monitoring system according to claim 2 ,
The monitoring device includes means for detecting when the automatic machine becomes available for trading based on a use state of the automatic machine and images taken by the first and second monitoring cameras. A financial institution booth monitoring system. In the financial institution booth monitoring system according to claim 2 or claim 3 ,
The monitoring device includes means for detecting a congestion state in the financial institution booth based on images taken by the first and second monitoring cameras,
The financial institution booth monitoring system characterized in that the means for detecting the suspicious behavior before the transaction detects the suspicious behavior before the transaction of the end user who is monitoring the behavior based on the congestion state and the elapsed time. In the financial institution booth monitoring system according to any one of claims 1 to 4 ,
The monitoring device is configured to measure an elapsed time from when the end user who is monitoring the behavior ends the transaction with the automatic machine until leaving the financial institution booth, and based on the elapsed time, the end user's And a means for detecting suspicious behavior after the transaction. In the financial institution booth monitoring system according to any one of claims 1 to 5 ,
The monitoring device is configured to measure a continuation time and an accumulated time during which an end user who is monitoring an action enters an area not normally used in the financial institution booth and stagnates, and based on the continuation time or the accumulated time, And a means for detecting suspicious behavior of the end user in the area. In the financial institution booth monitoring system according to any one of claims 1 to 6 ,
The monitoring device monitors a transaction state of the automatic machine, and based on the fact that the end user who is monitoring the behavior of the automatic machine performs a predetermined suspicious transaction pattern, A financial institution booth monitoring system characterized by comprising means for detecting. In the financial institution booth monitoring system according to claim 1 ,
The monitoring device
The suspicious behavior of the end user is determined based on the elapsed time until the end user whose behavior is being monitored starts trading with the automatic machine that can trade or the elapsed time until the exit from the financial institution booth after the end of the transaction. Means for detecting;
A means for detecting the suspicious behavior of the end user based on the duration or accumulated time during which the end user who is monitoring the behavior has entered and stagnated in an area not normally used;
Means for detecting suspicious behavior of the end user based on the fact that the end user who is monitoring the behavior has implemented a predetermined suspicious transaction pattern with the automatic machine;
Each time the suspicious behavior of the end user is detected by the means, means for reporting the suspicious behavior of the end user and information of the captured image to the terminal device,
The terminal device includes a means for judging and notifying a suspicious level based on information on the suspicious behavior of the end user and a photographed image notified from the monitoring device, and monitoring in a financial institution booth system.

Images