JPH03252861A - Transaction processing system - Google Patents

Abstract

PURPOSE:To refuse and unjust transaction using a stolen personal certification card and unjustly decodes personal identification data even if the personal certification card is stolen and the personal identification data is decoded unjustly and misused by asking a question by selecting one of plural data stored beforehand in a central processing unit side, and executing the personal certification of a user by using the answer for it of the user. CONSTITUTION:The personal certification is executed by using not only the data 21a written on the personal certification card 20 but it is executed by asking the question by selecting one of plural data stored beforehand in the central processing unit 10 side based on the data 21a, and using the answer for it of the user. Thus, even if the personal certification card 20 is stolen, and the personal identification data on the card 20 is decoded unjustly, a certification code to be used for the transaction is never read, and the unjust transaction using these can be refused.

Description

[Detailed Description of the Invention] [Field of Industrial Application] The present invention relates to a transaction processing method in an automatic teller machine used in financial institutions, etc. This relates to a transaction processing method suitable for preventing fraudulent use of a transaction by another person.

[Conventional technology]

Traditionally, a personal identification number has been the only personal authentication method for card transactions, but since the identification number is often a number that is easy for the cardholder to remember, the basic idea is that it is easy for others to guess. There was a problem.

For this reason, in recent years, methods of inputting other passwords in addition to the password have been considered.
As disclosed in Japanese Patent No. 666, a method of writing a plurality of PIN numbers on a personal authentication card and a method of updating the PIN number for each transaction have also been proposed.

[Problem to be solved by the invention]

However, it is clear that these methods of writing a PIN number etc. on the card itself will be ineffective if the card is stolen and the written data is decoded, so it is not sufficient. There wasn't.

In the end, the above-mentioned conventional technology lacks consideration for the possibility that the PIN data on the personal authentication card could be illegally decrypted and used, and the biggest problem is that transactions can be conducted using the decrypted data. Met.

The present invention has been made in view of the above-mentioned circumstances, and its purpose is to solve the above-mentioned problems in the conventional technology, and to solve the problem when a personal authentication card is stolen and the password data on the card is illegally decoded. To provide a transaction processing method in which an authentication code used for a transaction cannot be read even when the authentication code is used in the transaction, and an unauthorized transaction using the same is rejected.

[Means to solve the problem]

The above-mentioned object of the present invention is to provide a specific recording area on a personal authentication card used for a transaction, and check whether the transaction is possible or not by checking the consistency between the data written in the recording area and the data input by the user of the personal authentication card. In a transaction processing system that determines the transaction processing system, the transaction processing system has information regarding the authorized user of the personal authentication card corresponding to the data written in the specific recording area on the personal authentication card, and the system The side reads the data written in the specific recording area on the personal authentication card, outputs a corresponding question requesting information about the authorized user of the personal authentication card, and then reads the data written in the specific recording area on the personal authentication card. This is achieved by a transaction processing method characterized by determining whether or not a transaction is possible by checking the consistency with the user's answer.

[Effect]

In the transaction processing method according to the present invention, instead of performing personal authentication using only the data written on the personal authentication card, multiple pieces of data are stored in advance in the central processing unit based on this data. Since the user selects one of the questions and asks a question, and the user's answer is used for personal authentication, even if the personal authentication card is stolen and the PIN data on the card is illegally decoded, there is no problem. , the authentication code used for transactions cannot be read, and unauthorized transactions using this code can be rejected.

〔Example〕

Embodiments of the present invention will be described in detail below with reference to the drawings.

FIG. 2 is a perspective view showing the appearance of an automated teller machine according to an embodiment of the present invention, and FIG. 3 is a block diagram showing the overall configuration of the automated teller machine.

The automatic teller machine 1 shown in this embodiment includes an operation section 6 consisting of a CRT display and a touch panel, a banknote deposit/withdrawal section 31, a passbook printing section 2. It is composed of a card reader/writer 4 and a control section 5 that controls these. Control unit 5
is also connected to a central processing unit 10 via a communication line 9 via a line control unit 7 . Note that 8 indicates a data buffer for temporarily storing data.

FIG. 4 is a diagram showing an authentication card used in a transaction. In the figure, 20 indicates a card, and 21 indicates a magnetic stripe on the card 20. FIG. FIG. 5 is a diagram showing an example of the contents of data written on the magnetic stripe 21 described above. In the figure, 21a indicates the entire data, and the data 21a includes a PIN number 22, a bank number, a branch number 2
In addition to normally used information such as account number, item code 2
It has 3.

FIG. 6 shows account data 1 stored in the central processing unit 10 as information regarding the authorized user of the personal authentication card, which corresponds to the data 21a on the authentication card 20 described above.
00 is a diagram showing an example. In the diagram, 101 is the PIN number,
111.121.131 is the item code, and 112.
122.132 indicates the item, and 113.123.133 indicates the corresponding data. Items 112, 122, 132 and corresponding data 113, 123, 133 shown here are registered when the authentication card is issued, and their contents include information that only the authorized user of the authentication card can know, such as , date of birth of a family member, telephone number of a company, telephone number of an intruder, etc., and these registration order numbers are used as item codes, content names as items, and actual data as applicable data.

The transaction processing method in this embodiment configured as described above will be explained below based on the above figures and the operation flowchart shown in FIG.

Let us consider a case where a user performs a payment transaction from this automated teller machine (hereinafter also simply referred to as "device J") 1.The user first specifies a payment transaction in step 201, and then uses the card reader in step 202. Card insertion slot 4 of writer 4
Insert the card 20 from 1. The device 1 takes the card 20 into the card reader/writer 4, reads the data 21a on the card 20, and stores this data in the data buffer 8 under the control of the control section 5 (step 203).

Next, when the user inputs the PIN number and payment amount from the operation unit 6 (steps 204 and 205), the device 1 receives the card 20 stored in the data buffer 8.
The item code 23 of the above data 21a is read (step 206), and the necessity of calculating the item code 23 is determined based on the size of the payment amount, the date of latest use on the card 20, etc. (step 207). As a result of the determination in step 207, if the payment amount is large or the date of most recent use is close to the date of use, a calculation is performed (step 208) and a check other than the item code 23 on the card 20 is performed. A new item code is generated (step 209). on the other hand,
As a result of the determination in step 207, if there is no problem with the payment amount, the item code 23 on the card 20 is used as it is as the confirmation item code.

Once the confirmation item code is determined by the above-mentioned procedure, in addition to the PIN number and payment amount input by the user, the data in the data buffer 8 can be edited using the control unit 5 in step 2.
10) The line control unit 7 transmits this information to the central processing unit IO via the communication line 9 (step 211).
.

The central processing unit 10 receives data from the automated teller machine l (step 301), and receives the data 2 on the card 20.
Step 302) to search the database for the above-mentioned individual account data +00 specified from 1a, PIN code +
01, the password entered from the operation unit 6, and the card 2
Other data above 0 is checked (step 303). If the check result is correct, the item code 111, 121, 131 in the individual account data 100 is searched for one (for example, 111) that matches the confirmation item code in the received data (step 304).

Based on this item code Ill, the corresponding item 112
, step 305) of reading out the corresponding data 113), check results of various data such as the password, and the selected item 112. The corresponding data 113 is edited as a transaction permission message (step 306) and transmitted to the automatic teller machine 1 (step 307). If there is a discrepancy as a result of checking various data such as the personal identification number, the transaction rejection message is edited (step 308) and sent to the automatic teller machine 1 (step 307).

When the automatic teller machine 1 receives the data from the central processing unit 10 (step 212), it checks whether the transaction can be continued (step 213). If the received data is a transaction permission message, item data in the received data, for example, "wife's date of birth" is displayed in the form of a question on the CRT of the operation unit 6 (step 214), and the user is asked to send the wife's date of birth as an answer. input the date of birth (step 215). next,
A comparison check is made between this input data and the corresponding data in the data received from the central processing unit 10 (step 21
6) If they match, the banknote dispensing unit 3 is activated to start counting the banknotes in order to perform a payment transaction (step 217).

While counting banknotes, the card data 21a is rewritten by the card reader/writer 4 using the item code newly generated at the start of the transaction (generated in step 209) as the item code 23 on the card 20 (step 219), and the card 20 is used. The card is transported to the card insertion slot 41 in order to be returned to the person (
Step 220). Further, after the banknotes are counted, the banknote deposit and withdrawal shutter (not shown) of the banknote deposit and withdrawal 3 is opened to release the banknotes (step 221).

The user receives the card 20 and banknotes at step 222, completing the payment transaction.

Note that in step 213, if the transaction is not possible or if the corresponding data input for item 112 does not match the received corresponding data 113, the automatic teller machine l
displays a message to that effect, asks the user to return the card 20 (Step 223), and asks the user to remove the card (Step 2).
24), the process is terminated midway.

According to the embodiment described above, personal authentication is not performed using only the data written on the personal authentication card, but based on this data, one of a plurality of pieces of data is stored in the central processing unit in advance. Since the personal authentication card is stolen and the PIN data on the card is illegally decoded and misused, the user's answer is used to authenticate the user. , which has the effect of rejecting fraudulent transactions using this.

Note that the above-mentioned embodiment is shown as an example of the present invention, and the present invention should not be limited thereto.

For example, implementation is possible in various forms as described below.

(1) In the above embodiment, the automatic teller machine 1 performs the calculation of the necessity of calculating the item code (step 207) to the generation of the confirmation item code (step 209). It can also be used as processing.

(2) Confirmation item code generation (step 209) is 1
Multiple items may be generated depending on not only the species but also the transaction amount and date of latest use.

(3) In the above embodiment, in steps 218 to 219, the item code 23 on the card 20 is rewritten for each transaction, but the item code 23 on the card 20 is not rewritten and is sent to the central processing unit IO. , central processing unit lO
It is also possible to select an item code different from the item code used last time.

(4) The method of calculating the item code 23 in step 208 is not particularly determined, but depends on the purpose of the calculation. It is sufficient if the item code 23 on the card 20 and the item data asked are not always the same. The simplest calculation method is to add “1” to the item code on the card.
This is a method of adding ``.

In addition to recording the item code on the card 20 shown in the above embodiment in a specific area, it is also possible to use a PIN code area that is unnecessary in the so-called "O" PIN system. .

〔Effect of the invention〕

As explained above in detail, according to the present invention, personal authentication is not performed using only the data written on the personal authentication card, but is based on this data and stored in advance in the central processing unit. Since personal authentication is performed by selecting one of multiple pieces of data and asking a question, and using the user's answer to the question, there is no possibility that the personal authentication card will be stolen and the PIN data on the card will be illegally stolen. Even if it is decrypted and misused, it is effective in denying fraudulent transactions using it.

[BRIEF DESCRIPTION OF THE DRAWINGS] Fig. 1 is an operation flowchart showing details of a transaction processing method in an embodiment of the present invention, Fig. 2 is a perspective view showing the external appearance of an automated teller machine of the embodiment, and Fig. 3 is a FIG. 4 is a block diagram showing the overall configuration of the automated teller machine, FIG. 4 is a diagram showing an authentication card used for transactions, FIG. 5 is a diagram showing an example of the content of data written on the authentication card, and FIG. The figure is a diagram showing an example of account data stored in the central processing unit. 1: Automatic teller machine, 2 Bankbook printing section, 3: Banknote withdrawal section, 4: Card reader/writer, GI: Control section, 6: Operation section, 7: Line control section, 8: Data buffer, 9: Communication line, IO: central processing unit, 20: card, 21a: entire data, 22: password, 23: item code, 100:
Account data, item code 111.121.13, 11
2.122. ! 32: Item, 113.123°133
: Applicable data. Figure (Part 2) 1 Figure z Figure 1a 〆3

Claims (1)

[Claims] 1. A specific recording area is provided on the personal authentication card used for transactions, and whether or not the transaction is possible is determined by checking the consistency between the data written in the recording area and the data input by the user of the personal authentication card. In a transaction processing system that determines the transaction processing system, the transaction processing system has information regarding the authorized user of the personal authentication card corresponding to the data written in the specific recording area on the personal authentication card, and the system The side reads the data written in the specific recording area on the personal authentication card, outputs a corresponding question requesting information about the authorized user of the personal authentication card, and then reads the data written in the specific recording area on the personal authentication card. A transaction processing method that determines whether or not a transaction is possible by checking the consistency with the user's answer. 2. Only when the transaction amount is a predetermined amount or more, execute the transaction processing method according to claim 1, and when the transaction amount is less than the predetermined amount, determine whether or not the transaction is possible based on personal authentication using a normal PIN number. A transaction processing method characterized by: 3. When issuing a personal authentication card, as personal information registered by the user, a plurality of item codes and corresponding data are stored in the central processing unit of the system in correspondence with a PIN number, and the personal authentication card includes the plurality of One of the item codes is recorded and issued, and at the time of a transaction using the personal authentication card, the central processing unit records and issues the personal information based on the PIN and item code read from the personal authentication card. , the corresponding data is sent to the transaction terminal, the transaction terminal requests the user to input data corresponding to the item code, and compares this with the data sent from the central processing unit. transaction processing method. 4. When returning the personal authentication card upon completion of the transaction,
4. The transaction processing method according to claim 3, wherein the item code used in the transaction is recorded on the personal authentication card, and the item code used this time is not used in the next transaction.