JP7241668B2 - Crime sign detection system and crime sign detection method - Google Patents

Description

The present invention relates to a crime sign detection system and a crime sign detection method.

Recently, transaction systems using automatic machines (ATMs) using transaction media such as bankbooks, IC cards, and magnetic cards have become widespread. Along with this spread, problems of fraudulent transactions such as fraudulent withdrawals due to theft of transaction media such as bankbooks, IC cards, magnetic cards, etc., have arisen due to stolen transaction media.

For example, Patent Literature 1 is known as a technique for solving the problem of such fraudulent transactions. In Patent Document 1, in the case of a customer who hides his or her face with sunglasses or a mask, there is a possibility of unauthorized use.

JP-A-4-76690

In Patent Document 1 described above, there is a limit to the accuracy of determining whether or not a person is a criminal based on a specific appearance, such as a mask or sunglasses, when withdrawal or transfer transactions are performed from an automatic machine. In addition, there is concern that complaints from end users in the event of erroneous recognition may result in the loss of the company's brand.

SUMMARY OF THE INVENTION An object of the present invention is to determine a criminal immediately and with high accuracy in a crime sign detection system.

A crime sign detection system according to one aspect of the present invention comprises an automatic machine, a transaction monitoring server connected to the automatic machine via a line, and a transaction monitoring server connected to the automatic machine and connected to the transaction monitoring server via the line. and a connected transaction monitoring terminal, wherein the automatic machine automatically processes transactions in response to a request from a user, and the transaction monitoring server receives the transaction through the line. collecting transaction information from an automatic machine, detecting fraudulent transactions in the automated machine using the transaction information, and transmitting alert information to the transaction monitoring terminal via the line when the fraudulent transaction is detected; It is characterized by

A crime sign detection method according to one aspect of the present invention includes a transaction monitoring server connected to an automatic machine via a line, and a transaction monitoring terminal connected to the automatic machine and to the transaction monitoring server via the line. wherein the automated machine automatically processes a transaction in response to a request from a user, and the transaction monitoring server receives the transaction via the network. collect transaction information from an automatic machine, detect fraudulent transactions in the automated machine using the transaction information, and send the transaction monitoring terminal via the network when the fraudulent transaction is detected in the automated machine; It is characterized by transmitting alert information.

ADVANTAGE OF THE INVENTION According to one aspect of the present invention, in a crime sign detection system, a criminal can be determined immediately and with high accuracy.

BRIEF DESCRIPTION OF THE DRAWINGS It is a figure which shows the whole structure of the crime sign detection system of an Example. It is a figure which shows the internal structure of an automatic machine, a transaction monitoring server, and a transaction monitoring terminal. (a) is a diagram showing the contents of transaction information, and (b) is a diagram showing the contents of transaction model information. (a) is a diagram showing the contents of terminal information, and (b) is a diagram showing the contents of automatic machine information. It is a figure which shows the flow until it detects a fraudulent transaction at the time of transaction.

An embodiment will be described below with reference to the drawings.

The overall configuration of the crime sign detection system of the embodiment will be described with reference to FIG.
The crime sign detection system of the embodiment includes a plurality of automated machines (ATMs) 10, a transaction monitoring server 11 connected to the automated machines 10 via a line (network) 14 and a router 13, connected to the automated machines 10, It also has a transaction monitoring terminal 12 connected to the transaction monitoring server 11 via a line (network) 14 and a router 13 .

The automated machine 10 automatically processes transactions in response to user requests. The transaction monitoring server 11 collects transaction information from the automatic machine 10 via the line (network) 14 and the router 13, and uses the transaction information to detect fraudulent transactions in the automatic machine 10. FIG. When the transaction monitoring server 11 detects an unauthorized transaction, the transaction monitoring server 11 transmits alert information (warning information) to the transaction monitoring terminal 12 via the line (network) 14 and the router 13 .

The internal configurations of the automatic machine 10, the transaction monitoring server 11, and the transaction monitoring terminal 12 will be described with reference to FIG.
The automatic machine 10 is an automatic transaction device that is installed inside or outside a store of a financial institution or the like, and performs transactions such as deposits and withdrawals of cash by customer's operation. 112.

The transaction monitoring server 11 is usually installed in the server center (business center) of each financial institution, and is a terminal that collects and analyzes transaction information from the automatic machine 10. A communication control unit 112 controls communication of the transaction monitoring terminal 12. It is connected with the section 122 .

The automatic machine 10 is a device for automatically processing transactions in response to user requests, and includes an operation unit 104, a card mechanism unit/statement slip mechanism unit 103, a passbook mechanism unit 106, a banknote deposit/withdrawal mechanism unit 105, a coin It has a deposit/withdrawal mechanism section 107, a voice guidance guidance section 108, and a control section 101 that controls these sections. The control unit 101 has a hardware configuration such as a CPU and memory, and a software configuration such as programs and data, and controls various processes and transactions.

The operation unit 104 has screen display and key input detection functions. This is the part that accepts the entered key input. The operation unit 104 is preferably an input/display unit (also called an input display unit) configured by a touch panel or the like, displays various information on the display screen, and detects pressing of various items included in the display screen. do.

The card mechanism unit/statement slip mechanism unit 103 has a function of inserting or ejecting a user's card, reading or writing to the magnetic stripe or IC chip of the card, reading the image of the embossed portion of the card, and the like. It also has a statement slip mechanism unit that prints transaction details on a statement slip by a printing unit and discharges it from the device.

The passbook mechanism unit 106 has a function of inserting/ejecting a user's passbook, reading/writing a magnetic stripe, printing a passbook by a printing unit, and the like.

The banknote deposit/withdrawal mechanism unit 105 and the coin deposit/withdrawal mechanism unit 107 have cash deposit/withdrawal functions, cash discrimination/conveyance/storage functions. Then, as described above, the processing of each of these parts is controlled by the control unit 101 .

The transaction monitoring server 11 is connected to the communication control unit 102 of the automatic machine 10 via the communication control unit 112, and has a function of transferring data such as transaction information. The control unit 111 includes a hardware configuration such as a CPU and memory, and a software configuration such as programs and data, and controls various processes.

The display unit 114 has a screen display function. The input operation unit 113 has an input detection function of a mouse, a keyboard, or the like, and is a part where a person who conducts transaction monitoring registers and operates a transaction model. The storage unit 115 stores transaction information 200 , transaction model information 210 , terminal information 220 and automatic machine information 230 .

Here, the contents of the transaction information 200 are shown in FIG. 3(a).
The transaction information 200 is information including the type and date of transaction performed by the user using the automatic machine 10 . As shown in FIG. 3(a), transaction information 200 includes account number, transaction type, and establishment information. In the establishment, if the value is "0", the transaction has been established (transaction established), and if it is "1", the transaction has not been established (transaction failed).

The contents of the transaction model information 210 are shown in FIG. 3(b).
The transaction model information 210 is information including continuity between transactions, threshold values, and the like.
As shown in FIG. 3(b), the transaction model information 210 includes information on a plurality of transactions that may lead to fraudulent transactions if they are executed consecutively, and one of the transactions is a withdrawal transaction. including withdrawal amount threshold information for withdrawal transactions.

For example, in model A, the first transaction is a balance inquiry and the second transaction is a withdrawal. At this time, if the withdrawal amount of the second transaction is 490,000 yen, which is within the range of the threshold value (49≦N<50) as a condition, it is determined that there is a high possibility of fraudulent transactions. .

Also, in the case of model B, the first transaction is a withdrawal and the second transaction is a withdrawal. At this time, if the withdrawal amount of the first transaction and the second transaction is within 100,000 yen, which is within the range of the threshold value (N ≤ 10) as a condition, there is a possibility that fraudulent transactions will be conducted. judged to be high.

The contents of the terminal information 220 are shown in FIG.
The terminal information 220 is information including the name of the store where the transaction monitoring terminal 12 is installed, the store number, the terminal ID, the IP address, and the like.

The contents of the automatic machine information 230 are shown in FIG. 4(b).
The automatic machine information 230 is information including the name of the shop where the automatic machine 10 is installed, the shop number, the host name, and the IP address.

The transaction monitoring terminal 12 has a function of communicating with the transaction monitoring server 11 installed in the server center, receiving information on the presence or absence of fraudulent transactions in the automatic machine 10, and operating the server to transmit a transaction stop instruction to the automatic machine 10. The transaction monitoring terminal 12 has a display section 125, an input operation section 124, a communication control section 122, an audio output section 123, a storage section 126, and a control section 121 that controls these sections. The control unit 121 includes a hardware configuration such as a CPU and memory, and a software configuration such as programs and data, and controls various processes.

The operation of the crime sign detection system of the embodiment will be described with reference to FIG.
The automated machine 10 automatically processes transactions in response to user requests. The transaction monitoring server 11 collects transaction information 200 from the automatic machine 10 via the line (network) 14 and router 13 and uses the transaction information 200 to detect fraudulent transactions in the automatic machine 10 .

The transaction monitoring server 11 sends alert information (warning information) to the transaction monitoring terminal 12 via the line (network) 14 and the router 13 when an unauthorized transaction is detected.

The transaction monitoring server 11 registers the transaction model information 210 in advance, and compares the transaction information 200 with the transaction model information 210 each time a transaction is performed by the automatic machine 10 . When the transaction information 200 and the transaction model information 200 match, the fraudulent transaction in the automatic machine 10 is detected and alert information is transmitted to the transaction monitoring terminal 12.例文帳に追加

Further, when alert information is transmitted from the transaction monitoring server 11, the transaction monitoring terminal 12 causes the storage unit 126 to store the alert information. Alternatively, when alert information is transmitted from the transaction monitoring server 11, the transaction monitoring terminal 12 causes the display unit 125 to display the alert information. Alternatively, when alert information is transmitted from the transaction monitoring server 11, the transaction monitoring terminal 12 causes the audio output unit 123 to output the alert information by voice.

In this way, it is confirmed in real time whether or not there is a user who conducts fraudulent transactions using the automatic machine 10.例文帳に追加Furthermore, since the transaction monitoring terminal 12 receives the alert information from the transaction monitoring server 11, it becomes possible for the bank employee or the like to take immediate action. The transaction monitoring server 11 automatically determines whether fraudulent withdrawals have been made based on the details of transactions using the automatic machine 10, the continuity between transactions, etc., and transmits alert information to the transaction monitoring terminal 12 in the store. to prevent unauthorized operations. The transaction monitoring server 11 may transmit to the transaction monitoring terminal 12 an instruction to stop the transaction of the automatic machine 10 as alert information.

Next, with reference to FIG. 5, the flow until fraudulent transaction is detected at the time of transaction will be described.
When the automatic machine 10 starts a transaction, the transaction information 200 is transmitted to the transaction monitoring server 11 . The transaction monitoring server 11 checks whether the transaction information 200 received from the automatic machine 10 matches the transaction model information 210 registered in advance in the transaction monitoring server 11 (S501).

Next, as a result of checking whether the transaction model information 210 and the transaction model information 210 match/do not match (S502), if they match (YES), the transaction is recognized as an unauthorized transaction and alert information is sent to the transaction monitoring terminal 12 ( S503).
Next, the transaction monitoring terminal 12 to which the alert information is sent registers the result of whether or not the person is suspicious (S504).
As a result of checking whether the transaction model information 210 and the transaction model information 210 match/do not match (S502), if they do not match (NO), the transaction is continued (S505).

In this way, the transaction monitoring server 11 installed in the server center checks the transaction information 200 transmitted from the automatic machine 10 and the pre-registered transaction model information 220 each time a transaction is made, and the conditions are met. In this case, the suspicious person can be quickly detected by automatically transmitting alert information to the transaction monitoring terminal 12 in the store.

According to the above-described embodiment, it is possible to confirm in real time whether or not there is a user who conducts fraudulent transactions using the automatic machine 10 . Furthermore, by providing the transaction monitoring terminal 12 in the store, bank employees can immediately respond to the alert information received from the transaction monitoring server 11 . Fraudulent transactions can be determined immediately from the operation of the automatic machine 10, and signs/operations such as fraudulent withdrawals by stolen cards and bank transfer fraud can be detected.

The present invention is not limited to the above-described embodiments. For example, a camera for photographing the appearance of the user is installed in the automatic machine 10, and the transaction monitoring server 11 automatically Appearance information of the user photographed by a camera from the machine 10 may be collected, and fraudulent transactions with the automatic machine 10 may be detected using the transaction information and the appearance information. In this way, by using the user's appearance information, it is possible to determine a criminal with a higher degree of accuracy. Here, the user's appearance information is, for example, appearance such as a mask and sunglasses.

In addition, the transaction history may be registered as transaction history information in the transaction monitoring server 11, and the transaction model information 220 may be optimized using this transaction history information to optimize extraction conditions for unauthorized operations. .

10 Automatic Machine 11 Transaction Monitoring Server 12 Transaction Monitoring Terminal 13 Router 14 Network 101 Control Unit 102 Communication Control Unit 103 Card Mechanism Unit/Detail Slip Mechanism Unit 104 Operation Unit (Input and Display Unit)
105 banknote deposit/withdrawal mechanism unit 106 bankbook mechanism unit 107 coin deposit/withdrawal mechanism unit 108 voice guidance guidance unit 111 control unit 112 communication control unit 113 input operation unit 114 display unit 115 storage unit 121 control unit 122 communication control unit 123 voice output unit 124 Input operation unit 125 Display unit 126 Storage unit 200 Transaction information 210 Transaction model information 220 Terminal information 230 Automatic machine information

Claims (7)

automatic machine and
a transaction monitoring server connected to the automatic machine via a line;
a transaction monitoring terminal connected to the automatic machine and connected to the transaction monitoring server via the line, wherein
The automatic machine
automatically process transactions at your request;
The transaction monitoring server
Collecting transaction information from the automatic machine via the line,
using the transaction information to detect fraudulent transactions with the automatic machine;
when the fraudulent transaction is detected, sending alert information to the transaction monitoring terminal via the line;
The transaction monitoring server
Register trading model information in advance,
comparing the transaction information with the transaction model information each time a transaction is made on the automated machine;
when the transaction information and the transaction model information match, detecting the fraudulent transaction in the automatic machine and transmitting the alert information to the transaction monitoring terminal;
The transaction information is
including information on the type of transaction performed by the user on said automated machine;
The transaction model information is
Information on a plurality of transactions that may cause the fraudulent transaction if they are executed consecutively, and information on a withdrawal amount threshold for the withdrawal transaction when one of the plurality of transactions is a withdrawal transaction. including
Among the plurality of transactions, when the withdrawal transaction is performed after the balance inquiry transaction is performed, the possibility of the fraudulent transaction being performed when the withdrawal amount of the withdrawal transaction is within the threshold range. is high,
As for the plurality of transactions, if the withdrawal transactions are continuously performed, and if the withdrawal amount of the consecutively performed withdrawal transactions is within the range of the threshold value, the fraudulent transaction may be performed. judged to be of high quality,
A crime characterized in that the threshold range when the withdrawal transaction is performed after the balance inquiry transaction is performed is different from the threshold range when the withdrawal transaction is performed continuously. Premonitory detection system. The transaction monitoring terminal has a storage unit,
2. The crime sign detection system according to claim 1, wherein when the alert information is transmitted from the transaction monitoring server, the alert information is stored in the storage unit. The transaction monitoring terminal has a display unit,
2. The crime sign detection system according to claim 1, wherein when the alert information is transmitted from the transaction monitoring server, the alert information is displayed on the display unit. The transaction monitoring terminal has an audio output unit,
2. The crime sign detection system according to claim 1, wherein when the alert information is transmitted from the transaction monitoring server, the alert information is output by voice to the voice output unit. The transaction monitoring server
2. A crime sign detection system according to claim 1, wherein an instruction to suspend transactions of said automatic machine is transmitted as said alert information to said transaction monitoring terminal. A sign of crime using a crime sign detection system having a transaction monitoring server connected to an automatic machine via a line, and a transaction monitoring terminal connected to the automatic machine and to the transaction monitoring server via the line A detection method comprising:
The automatic machine
automatically process transactions at your request;
The transaction monitoring server
Collecting transaction information from the automatic machine via the line ,
using the transaction information to detect fraudulent transactions with the automatic machine;
sending alert information to the transaction monitoring terminal via the line when the fraudulent transaction is detected by the automatic machine ;
The transaction monitoring server
Register trading model information in advance,
comparing the transaction information with the transaction model information each time a transaction is made on the automated machine;
detecting the fraudulent transaction in the automatic machine when the transaction information and the transaction model information match;
The transaction information is
including information on the type of transaction performed by the user on said automated machine;
The transaction model information is
Information on a plurality of transactions that may cause the fraudulent transaction if they are executed consecutively, and information on a withdrawal amount threshold for the withdrawal transaction when one of the plurality of transactions is a withdrawal transaction. including
Among the plurality of transactions, when the withdrawal transaction is performed after the balance inquiry transaction is performed, the possibility of the fraudulent transaction being performed when the withdrawal amount of the withdrawal transaction is within the threshold range. is high,
As for the plurality of transactions, if the withdrawal transactions are continuously performed, and if the withdrawal amount of the consecutively performed withdrawal transactions is within the range of the threshold value, the fraudulent transaction may be performed. judged to be of high quality,
A crime characterized in that the threshold range when the withdrawal transaction is performed after the balance inquiry transaction is performed is different from the threshold range when the withdrawal transaction is performed continuously. Premonitor detection method. The transaction monitoring terminal
7. The method of detecting signs of crime according to claim 6 , wherein when the alert information is transmitted from the transaction monitoring server, a result of whether or not the transactor is a fraudulent person is registered.

Images