TW201942842A - Fraud detection system for financial transaction and method thereof - Google Patents

Abstract

A fraud detection system for financial transaction comprises a transaction platform, a monitor module, a fraud database, a fraud analysis module and an alert module. The monitor module is configured to get a first operating record and a second operating record during the transaction platform executing a transaction operation. The fraud analysis module is configured to select a first feature set from the first operating record and select a second feature set from the second operating record, to compare the fraud database with the first feature set for outputting a first match set and a first match ratio, to execute a prediction procedure for outputting a predicted behavior when the first match ration is greater than a first threshold, and to compare the predicted behavior with the second feature set for outputting a second match ratio. The alert module is configured to send an alert message when the second match ratio is greater than a second threshold.

Description

Financial transaction fraud detection and prevention system and method

The invention relates to the field of financial services, in particular to a financial fraud detection and prevention system integrating image recognition, voiceprint semantic analysis, behavior analysis, artificial intelligence and deep learning.

At present, there are endless financial fraud incidents in the society, and the general public is often unable to prevent the constantly renewed fraud methods and scams. If the victim personally picks up or transfers to a financial institution, there is still a chance that they will be found and discouraged by service personnel when conducting transactions. However, this method of relying on artificial prevention of fraud is inefficient and has a low success rate. On the other hand, with the increasing popularity of the Internet and mobile communication devices, people are becoming accustomed to conducting online transactions through the Internet. At the same time, a variety of marketing advertisements and financial product investment information are also scattered throughout the Internet. Once a user is a little careless, they may mistrust the fake information distributed by fraud groups and easily transfer money to other people's accounts through automated equipment, online banking or mobile banking, and this type of financial transaction fraud is more difficult. Instant protection.

In view of this, the present invention proposes a financial transaction fraud detection and prevention system. During the operation of a transaction, a possible financial transaction fraud behavior is immediately discovered, and these fraud behaviors are prevented from being realized smoothly.

The financial transaction fraud detection and prevention system according to an embodiment of the present invention includes a transaction platform, a monitoring module, a fraud feature database, a fraud analysis module, and a warning module. The trading platform is used to perform trading operations. The monitoring module is communicatively connected to the trading platform and used to obtain the first operation record and the second operation record during the execution of the transaction operation, wherein the first operation record is earlier than the second operation record. The fraud signature database is used to store a plurality of fraud signatures. The fraud analysis module is communicatively connected to the trading platform, monitoring module and fraud signature database. The fraud analysis module includes an extraction unit, an arithmetic unit and a prediction unit, wherein the extraction unit is configured to retrieve a first operation feature set from a first operation record and a second operation feature set from a second operation record; The operation unit is used to compare multiple fraud features of the fraud feature database according to the first operation feature set to output a first coincidence set and a first coincidence ratio. The prediction unit is used to compare the first coincidence ratio when the first coincidence ratio is greater than the first threshold. The coincidence set is inputted into a prediction program to output a prediction behavior; the arithmetic unit is further configured to compare the predicted behavior and output a second coincidence ratio according to the second operation feature set, and output the first coincidence ratio when the second coincidence ratio exceeds a second threshold. The operation feature set and the second operation feature set are stored in a fraud feature database. The alert module is communicatively connected to the fraud analysis module and is used to send an alert message when the second compliance ratio exceeds a second threshold.

A method for detecting and preventing financial transaction fraud according to an embodiment of the present invention includes: a trading platform executes a trading operation; during the execution of a trading operation, the monitoring module obtains a first operation record and a second operation record, wherein the first operation record is earlier than the first Two operation records; the extraction unit of the fraud analysis module retrieves the first operation feature set from the first operation record; the extraction unit of the fraud analysis module retrieves the second operation feature set from the second operation record; fraud analysis The operation unit of the module compares a plurality of fraud features of the fraud feature database to output a first coincidence set and a first coincidence ratio according to the first operation feature set. When the first coincidence ratio is greater than a first threshold, the fraud analysis module The prediction unit inputs the first matching set into the prediction program to output the predicted behavior; the arithmetic unit of the fraud analysis module compares the predicted behavior and outputs the second matching ratio according to the second operation feature set; when the second matching ratio exceeds the second threshold, The operation unit of the fraud analysis module stores the first operation feature set and the second operation feature set to the fraud feature Library materials; match and when the second ratio exceeds the second threshold value, a warning alert message transmission module.

As mentioned above, the financial transaction fraud detection and prevention system disclosed in this case uses a monitoring module to collect images, sounds, and operation behavior patterns when an actor conducts financial transactions, and analyzes and compares them through artificial intelligence to instantly determine the problem. Whether the transaction of the secondary actor is a fraudulent transaction. If so, the warning module will suspend the execution of the transaction system and warn to prevent the outflow of fraudulent transactions and notify the actor immediately. The financial transaction fraud detection and prevention system disclosed by the present invention has a modularized feature, which can be directly introduced into an existing financial transaction system, reducing the additional cost of each financial institution's own construction.

The above description of the contents of this disclosure and the description of the following embodiments are used to demonstrate and explain the spirit and principle of the present invention, and provide a further explanation of the scope of the patent application of the present invention.

The detailed features and advantages of the present invention are described in detail in the following embodiments. The content is sufficient for any person skilled in the art to understand and implement the technical contents of the present invention. Anyone skilled in the relevant art can easily understand the related objects and advantages of the present invention. The following examples further illustrate the viewpoints of the present invention in detail, but do not limit the scope of the present invention in any way.

Please refer to FIG. 1, which is a schematic diagram illustrating a structure of a financial transaction fraud detection and prevention system according to an embodiment of the present invention. As shown in Figure 1, the financial transaction fraud detection and prevention system includes: a trading platform 1, a monitoring module 3, a fraud feature database 5, a fraud analysis module 7, and a warning module 9, wherein the fraud analysis module 7 is communicatively connected to The trading platform 1, the monitoring module 3, the fraud feature database 5 and the warning module 9 in order to obtain or send information related to fraud detection.

The trading platform 1 is used to perform trading operations. Specifically, the trading platform 1 is, for example, a computer at the counter of a financial institution, a Point of Sales (POS) system, an automated teller machine (ATM), a smart phone, or a personal computer. Refers to counter transactions, transactions through ATMs, login to mobile banking applications to execute transactions, or login to online banking websites to execute transactions.

The monitoring module 3 is used to obtain a first operation record and a second operation record during the execution of a transaction operation, wherein the first operation record is earlier than the second operation record. In practice, the monitoring module 3 is, for example, a physical closed-circuit camera, a photographic element of a smart phone, a microphone (or a radio device with the same function), a keyboard recording device, or a keyboard recording application. The first operation record and the second operation record basically record various information performed by the user when performing a transaction operation, such as an image, a recording, or a keystroke log file when an actor performs a transaction operation. The first operation record and the second operation record are two consecutive parts of the overall transaction operation record. For example, if the user operates the ATM for 20 minutes, the first operation is recorded as the first 5 minutes of surveillance video and the second operation is recorded as the last 15 minutes of surveillance video. However, the above is not used to limit the division of the first operation record and the second operation record. In practice, the selection range of the first operation record and the second operation record may be adjusted according to circumstances.

The fraud signature database 5 is used to store a plurality of fraud signatures. Specifically, the fraud signature database collects information on human psychological and behavioral patterns and fraud patterns from police agencies or financial industry in advance, and uses deep learning to classify multiple types of fraud signatures, such as from audio files. Key words in common fraud scams identified in the account: "regular account debit", "unpaid installment payment", "ATM operation error", etc .; or the common facial expressions or physical movements of victims, such as: "tension "," Confused "," looking left and right "," shaking limbs ", etc .; or identifying the common outfits of scammers from the image files, such as" masks "and" hard hats ". The fraud feature database 5 can store the fraud features in different categories according to different scenarios (such as counter, ATM, online banking, or mobile banking) in which the transaction occurs, and extract them for comparison by the fraud analysis module 7.

Please refer to FIG. 2, which is a schematic diagram of data transmission when the fraud analysis module 7 performs analysis. The fraud analysis module 7 includes an extraction unit 72, an operation unit 74, and a prediction unit 76.

The extraction unit 72 is configured to retrieve a first operation feature set from a first operation record and a second operation feature set from a second operation record. In detail, each of the first operation feature set and the second operation feature set includes a plurality of operation features. The operation characteristics include the physical movements, eyes, facial expressions, voices, conversational semantics, objects covering the actors, and background sounds and image information when performing trading operations. In another embodiment of the present invention, the first operation feature set and the second operation feature set may further include a transaction data generated by the transaction platform when the transaction operation is performed, and the transaction data includes a transaction place and a transaction type.

The operation unit 74 is configured to compare a plurality of fraud features of the fraud feature database 5 according to the first operation feature set to output a first coincidence set and a first coincidence ratio. The first matching set refers to one or more operating features that are consistent with the fraud features stored in the fraud feature database 5 in the first operating feature set, and the fraud features provided by the fraud feature database 5 will vary according to different transaction scenarios. Adaptive adjustment. For example, when the transaction location is a business counter, the corresponding fraud characteristics are: "the area covered by the face exceeds 33%", "panic movements", "quick tone", etc .; when the transaction location is an ATM automated equipment, the corresponding fraud characteristics For: "eye movements", "actual voices containing specific keywords", etc .; when the transaction location is online banking, the corresponding fraud feature is: "mouse or keyboard keys were clicked or pressed multiple times", "Field data input pause is too long", "Transaction screen is constantly switched", etc. The first match ratio is the number of operation features in the first match set divided by the number of operation features in the first set of operation features. If the first coincidence ratio is less than or equal to the first threshold preset by the system (for example: 50%), a part of the second operation record is selected as the new first operation record, and the first coincidence ratio is recalculated; If the first coincidence ratio is greater than the first threshold, the prediction process of the prediction unit 76 is started.

The prediction unit 76 is configured to input a first coincidence set into a prediction program to output a prediction behavior when the first coincidence ratio is greater than a first threshold. In practice, the prediction program can use Convolutional Neural Networks (CNN) for image recognition, Recurrent / Recursive Neural Network (RNN) for long-term and short-term memory for text analysis or speech recognition. (Long Short-Term Memory, LSTM) neural network, like the construction method of fraud identification database 5, the one or more neural networks used in the prediction process also collect human psychology and behavior from police agencies or financial industry in advance Model information and scam-like information are used as training data for neuron perception elements (Perception) to establish a preliminary prediction process. The prediction unit 76 uses the plurality of operation features in the first matching set as input variables of the input layer of the neural network, and the prediction behavior output by the output layer includes one or more fraud features.

After the prediction unit outputs the prediction behavior, the operation unit 74 compares the plurality of operation features in the second operation feature set output by the extraction unit 72 with the plurality of fraud features in the prediction behavior, and outputs a second coincidence ratio. The calculation method of the second coincidence ratio is, for example, dividing the number of operation features in the second operation feature set that can be matched to the fraud feature in the predicted behavior by the number of operation features in the second operation feature set. If the second coincidence ratio exceeds a second threshold (eg, 80%) preset by the system, the arithmetic unit 74 stores the first operation feature set and the second operation feature set to the fraud feature database 5 to accumulate more The fraudulent appearance also helps to improve the accuracy of artificial intelligence judgment and identification.

In practice, the arithmetic unit 74 adjusts the first threshold and the preset value of the second threshold according to the transaction location, which adjusts the sensitivity of the financial transaction fraud detection and prevention system according to an embodiment of the present invention according to the characteristics of the transaction field. degree.

On the whole, the fraud analysis module 7 continuously collects and collects information such as images, sounds, semantics, scenes, and actions on the transaction operations by a computer to predict and predict subsequent behaviors or semantics, and compares them with the fraud feature database 5 The stored multiple fraud features are cross-matched, and the second matching ratio is output after comparison. Therefore, it can be judged whether the transaction is a fraudulent transaction based on the second matching ratio and a second threshold set based on the transaction location. .

As mentioned above, when the second compliance ratio exceeds the second threshold, it means that fraud is taking place, so the warning module 9 sends a warning message to notify relevant personnel to go to process or connect to the financial transaction server to intercept the transaction. operating.

Please refer to FIG. 3, which is a flowchart illustrating a method for detecting and preventing financial transaction fraud according to an embodiment of the present invention. According to the aforementioned main components of the system for detecting and preventing financial transaction fraud, the respective execution processes are presented. The following and Please refer to the time sequence shown in Figure 3 for the order of execution between the steps.

Please refer to step S0: trading platform 1 executes trading operations. For example, an actor performs a transfer transaction through an ATM.

Please refer to step S1 and step S2: during the execution of the transaction operation, the monitoring module 3 obtains the first operation record and the second operation record, wherein the first operation record is earlier than the second operation record. For example, during the 20-minute operation of the ATM by the actor, the surveillance camera continuously shoots the actor, and the first 5 minutes of the image is used as the first operation record, and the second 15 minutes of the image is used as the second operation record.

Please refer to step S3: while the monitoring module 3 obtains the first operation record, the extraction unit 72 of the fraud analysis module 7 immediately retrieves the first operation feature set from the first operation record. For example, the eyes and facial expressions of the actors are identified from the videos, the words in the actors' speeches are identified from the recordings, and multiple operating characteristics are obtained from them.

Please refer to step S4: while the monitoring module 3 obtains the first operation record, the extraction unit 72 of the fraud analysis module 7 immediately retrieves the second operation feature set from the second operation record. The specific method is as described in step S3.

Please refer to step S5 and step S6: while the extraction unit 72 inputs the first set of operational features, the operation unit 74 of the fraud analysis module 7 instantly instantiates multiple operation features in the first set of operational features one by one with the fraud features The plurality of fraud feature comparisons stored in the database 5 are compared, as shown in step S5. Thereby, the operation unit 74 finds one or more operation features that are consistent with the fraud feature as the first matching set, and calculates the number of operation features in the first matching set and the number of operation features in the first operating feature set. The ratio is used as the first coincidence ratio, as shown in step S6.

Please refer to step S7: after the first coincidence ratio is output by the computing unit, if the first coincidence ratio is greater than the first threshold value, the prediction unit 76 of the fraud analysis module 7 inputs one or more operating characteristics of the first coincidence set into the prediction program , The prediction program outputs prediction behavior, and the prediction behavior includes one or several operational characteristics.

Please refer to step S8 and step S9: similar to the implementation methods of step S5 and step S6, after the prediction unit 76 outputs the predicted behavior, the operation unit 74 of the fraud analysis module 7 combines multiple operation features in the second operation feature set , And compare them one by one with multiple operation features in the predicted behavior, as shown in step S8. Thereby, the operation unit 74 finds the operating features that match on both sides as the second matching set, and calculates the ratio of the number of operating features in the second matching set and the number of operating features in the second operating feature set as the second matching ratio. , As shown in step S9.

Please refer to step S10: when the second coincidence ratio exceeds the second threshold, it should be regarded as suspected fraud. Therefore, the operation unit 74 of the fraud analysis module 7 stores the first operation feature set and the second operation feature set to the fraud feature data. Library 5. Through the feedback of the analysis results of various transaction behaviors, the fraud feature database 5 is recorded to discover the latest types of fraud features, and the accuracy of the prediction unit of the fraud analysis module 7 is judged by artificial intelligence.

Please refer to step S11: when the second compliance ratio exceeds the second threshold, the warning module 9 sends a warning message, for example, the warning message is used to notify relevant personnel to go to process, or used to connect to the financial transaction server to intercept the suspected as Scam trading operations.

To sum up, the financial transaction fraud detection and prevention system and method of the present invention, when an actor conducts financial transactions, collects images, sounds, and operation behavior patterns through the use of a monitoring module, and analyzes and compares them through artificial intelligence, real-time Judgment whether the actor's transaction operation is a fraudulent transaction. If so, the warning module will suspend the execution of the transaction system and warn to prevent the outflow of fraudulent transactions and immediately notify the actor. The financial transaction fraud system disclosed by the present invention has the characteristics of modularization, which can be directly introduced into the existing financial transaction system, thereby reducing the additional cost of each financial institution's own construction.

Although the present invention is disclosed in the foregoing embodiments, it is not intended to limit the present invention. Changes and modifications made without departing from the spirit and scope of the present invention belong to the patent protection scope of the present invention. For the protection scope defined by the present invention, please refer to the attached patent application scope.

1‧‧‧Trading platform

3‧‧‧ Surveillance Module

5‧‧‧ Fraud signature database

7‧‧‧ Fraud Analysis Module

72‧‧‧ Capture Unit

74‧‧‧ Computing Unit

76‧‧‧ Forecast Unit

9‧‧‧Warning Module

S0 ~ S11‧‧‧step

FIG. 1 is a schematic structural diagram of a financial transaction fraud detection and prevention system according to an embodiment of the present invention. FIG. 2 is a schematic diagram of data transmission of a fraud analysis module according to an embodiment of the present invention. FIG. 3 is a schematic flowchart of a financial transaction fraud detection and prevention method according to an embodiment of the present invention.

Claims (10)

A financial transaction fraud detection and prevention system includes: a transaction platform for performing a transaction operation; a monitoring module for communication connection to the transaction platform; the monitoring module for obtaining a first period during the execution of the transaction operation; An operation record and a second operation record, wherein the first operation record is earlier than the second operation record; a fraud feature database for storing a plurality of fraud features; a fraud analysis module for communication connection to the trading platform , The monitoring module and the fraud feature database, the fraud analysis module includes an extraction unit, an operation unit and a prediction unit, wherein the extraction unit is used to retrieve a first operation record from the first operation record; An operation feature set and extracting a second operation feature set from the second operation record; the operation unit is configured to compare the fraud features of the fraud feature database with the first operation feature set to output a first A matching set and a first matching ratio, the prediction unit is configured to input the first matching set into a prediction process when the first matching ratio is greater than a first threshold; To output a predicted behavior; the operation unit is further configured to output a second coincidence ratio to the predicted behavior according to the second operation feature set ratio, and to perform the first operation when the second coincidence ratio exceeds a second threshold The feature set and the second operational feature set are stored in the fraud feature database; and an alert module is communicatively connected to the fraud analysis module to send an alert message when the second compliance ratio exceeds the second threshold. The financial transaction fraud detection and prevention system according to claim 1, wherein the first operation feature set and the second operation feature set further include a transaction data generated by the transaction platform when the transaction operation is performed, and the transaction data includes a Transaction location and a transaction type. The financial transaction fraud detection and prevention system according to claim 2, wherein the operation unit adjusts the first threshold and the second threshold according to the transaction location. The financial transaction fraud detection and prevention system according to claim 1, wherein the transaction platform is a computer at the counter of a financial institution, a point-of-sale information system, an ATM, a smart phone or a personal computer, and the transaction operation is a counter transaction, Transaction through ATM, login to mobile banking application and execute transaction or login to online banking website and execute transaction. The financial transaction fraud detection and prevention system according to claim 1, wherein the surveillance module is a closed circuit camera, a photographic element of a smart phone, a microphone, a keyboard recording device or a keyboard recording application. The financial transaction fraud detection and prevention system according to claim 1, wherein the first operation record and the second operation record are a video file, a recording file, or a key record log file. The financial transaction fraud detection and prevention system according to claim 1, wherein the prediction process is a convolutional neural network, a recurrent neural network, or a long-term short-term memory neural network. The financial transaction fraud detection and prevention system according to claim 1, wherein the first operation feature set and the second operation feature set include limb movements, eyes, facial expressions, voices, dialogues of an actor performing the transaction operation Semantics, objects obscuring the actor and background sound and image information for performing the transaction operation. The financial transaction fraud detection and prevention system according to claim 1, wherein the fraud characteristic database further includes storing a plurality of personal psychological and behavioral mode information. A financial transaction fraud detection and prevention method includes: performing a transaction operation by a trading platform; and obtaining a first operation record and a second operation record during the execution of the transaction operation by a monitoring module, wherein the first operation record Earlier than the second operation record; a first operation feature set is extracted from the first operation record by an extraction unit of a fraud analysis module; the extraction unit from the fraud analysis module is obtained from the second The second operation feature set is extracted from an operation record; and a computing unit of the fraud analysis module is used to compare a plurality of fraud features of a fraud feature database according to the first operation feature set to output a first matching set and a A first coincidence ratio; when the first coincidence ratio is greater than a first threshold value, using a prediction unit of the fraud analysis module to input the first correspondence set into a prediction program to output a prediction behavior; using the fraud analysis module The arithmetic unit outputs a second coincidence ratio to the predicted behavior according to the second operation feature set ratio; when the second coincidence ratio exceeds a second threshold, The computing unit of the fraud analysis module stores the first operational feature set and the second operational feature set into the fraud feature database; and sends an alert module when the second coincidence ratio exceeds the second threshold value. Warning message.