Fraud user identification method, device, electronic device and computer readable medium

Abstract

The present invention discloses a method and device for identifying fraudulent users, and relates to the field of communication technology. The method comprises: in response to a successful purchase operation of a number card, the number card is used as a number card to be identified, the user who purchases the number card to be identified is used as a user to be identified, and the communication behavior of the user to be identified is monitored; according to the communication behavior of the user to be identified, whether the user to be identified is a risk user with fraud risk is determined; if so, the historical number card record of the risk user is obtained, and according to the historical number card record, the risk user is matched with a preset fraud scenario to score the risk user; according to the score of the user to be identified, whether the risk user is a fraud user and whether the risk number card is a fraud number card is determined. The method can monitor the user after the user purchases the number card, and combined with the user's communication behavior and the preset fraud scenario, it can effectively improve the accuracy of fraud user identification and protect user safety.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a fraudulent user identification method, device, electronic device and computer-readable medium. Background Art

[0002] Effectively identifying users involved in fraud and reducing the risk of users being defrauded has become an important topic in telecommunications fraud identification. Summary of the invention

[0003] In order to solve the above technical problems or at least partially solve the above technical problems, embodiments of the present invention provide a fraudulent user identification method, device, electronic device and computer-readable medium.

[0004] In a first aspect, an embodiment of the present invention provides a method for identifying a fraudulent user, comprising:

[0005] In response to a successful purchase operation of the number card, the number card is used as the number card to be identified, the user who purchased the number card to be identified is used as the user to be identified, and the communication behavior of the user to be identified is monitored;

[0006] Determining whether the user to be identified is a risky user with a risk of fraud according to the communication behavior of the user to be identified;

[0007] In the case where it is determined that the user to be identified is a risk user with a risk of fraud, obtaining the historical card number record of the risk user, and matching the risk user with a preset fraud scenario according to the historical card number record to score the risk user;

[0008] According to the score of the user to be identified, it is determined whether the risky user is a fraudulent user and whether the card to be identified is a fraudulent card.

[0009] In an optional embodiment, determining whether the user to be identified is a risky user with a risk of fraud based on the communication behavior of the user to be identified includes: determining whether the activation behavior of the user to be identified activating the card to be identified is monitored within a preset time period; if not, determining that the user to be identified is a risky user with a risk of fraud.

[0010] In an optional embodiment, the method further includes: if the activation behavior of the user to be identified activating the card to be identified is monitored within a preset time period, then obtaining the activation return information of the user to be identified; determining the card insertion location of the card to be identified based on the activation return information; determining whether the card insertion location of the card to be identified, the number location of the card to be identified and the ID card location of the user to be identified belong to the same administrative region; when the card insertion location of the card to be identified, the number location of the card to be identified and the ID card location of the user to be identified all belong to different administrative regions, determining that the user to be identified is a risky user with a risk of fraud.

[0011] In an optional embodiment, the method further includes: if the activation behavior of the user to be identified activating the card to be identified is monitored within a preset time period, determining the usage location of the card to be identified; if there are multiple usage locations of the card to be identified, determining the frequency of change of the usage location of the card to be identified; if the frequency of change of the usage location of the card to be identified is greater than a first threshold, determining that the user to be identified is a risky user with a risk of fraud.

[0012] In an optional embodiment, the method also includes: if the activation behavior of the user to be identified activating the card to be identified is monitored within a preset time period, then the daily call volume and / or text message volume of the user to be identified is monitored; when the daily call volume of the user to be identified is greater than a second threshold, and / or the daily text message volume of the user to be identified is greater than a third threshold, the user to be identified is determined to be a risky user with a risk of fraud.

[0013] In an optional embodiment, the method also includes: if the activation behavior of the user to be identified activating the card to be identified is monitored within a preset time period, then detecting the call content and / or text message content of the user to be identified, and determining whether the call content and / or text message content of the user to be identified contains preset keywords and / or links; if so, counting the number of calls and / or text messages containing the preset keywords and / or links within the target time period, and when the number of calls containing the preset keywords and / or links is greater than a fourth threshold, and / or the number of text messages containing the preset keywords and / or links is greater than a fifth threshold, determining that the user to be identified is a risky user with a risk of fraud.

[0014] In an optional embodiment, the preset fraud-related scenarios include one or more of the following: common Internet card scenarios, no recharge and no pre-deposit scenarios, no network refund scenarios for arrears, no secondary card scenarios, high activation rate scenarios, high purchase frequency scenarios, and concentrated purchase channel scenarios;

[0015] According to the historical card number record, matching the risk user with a preset fraud-related scenario includes one or more of the following:

[0016] Determine the type of the risk user's historical card record according to the historical card record, and determine whether the risk user matches the common Internet card scenario according to the type of the historical card record;

[0017] Determine the recharge record and pre-store record of the historical card number of the risk user according to the historical card number record, and determine whether the risk user matches the no-recharge and no-pre-store scenario according to the recharge record and pre-store record;

[0018] Determine the arrears record of the historical card number of the risk user according to the historical card number record, and determine whether the risk user matches the scenario of not leaving the network due to arrears according to the arrears record;

[0019] Determine the secondary card application record of the historical card of the risk user according to the historical card record, and determine whether the user matches the no secondary card scenario according to the secondary card application record;

[0020] Determine, based on the historical card record, the activation rate of the historical card of the risk user, and determine, based on the activation rate, whether the risk user matches the high activation rate scenario;

[0021] Determine the historical card purchase frequency of the risk user according to the historical card purchase record, and determine whether the risk user matches the high purchase frequency scenario according to the historical card purchase frequency;

[0022] Determine the historical card purchase channels of the risk user according to the historical card purchase records, and determine whether the risk user matches the concentrated scenario of the purchase channels according to the historical card purchase channels;

[0023] Scoring the risky user includes scoring the risky user according to the weight of a preset fraud scenario matching the risky user.

[0024] In an optional embodiment, the method further includes: in the case where it is determined that the risk user is a fraudulent user and the card number to be identified is a fraudulent card number, shutting down the card number to be identified.

[0025] In a second aspect, an embodiment of the present invention further provides a fraud user identification device, comprising:

[0026] A monitoring module, for responding to a successful purchase operation of a number card, taking the number card as a number card to be identified, taking a user who purchased the number card to be identified as a user to be identified, and monitoring the communication behavior of the user to be identified;

[0027] A first determination module is used to determine whether the user to be identified is a risky user with a risk of fraud according to the communication behavior of the user to be identified;

[0028] A scoring module is used to obtain the historical card number record of the risky user when it is determined that the user to be identified is a risky user with a risk of fraud, and match the risky user with a preset fraud-related scenario according to the historical card number record to score the risky user;

[0029] The second determination module is used to determine whether the risky user is a fraudulent user and whether the card number to be identified is a fraudulent card number according to the score of the user to be identified.

[0030] In an optional embodiment, the first determination module is further used to: determine whether the activation behavior of the to-be-identified user activating the to-be-identified number card is monitored within a preset time period; if not, determine that the to-be-identified user is a risk user with a fraud risk

[0031] In an optional embodiment, the first determination module is also used for: if the activation behavior of the user to be identified activating the card to be identified is monitored within a preset time period, then obtaining the activation return information of the user to be identified; determining the card insertion location of the card to be identified based on the activation return information; determining whether the card insertion location of the card to be identified, the number location of the card to be identified and the ID card location of the user to be identified belong to the same administrative region; when the card insertion location of the card to be identified, the number location of the card to be identified and the ID card location of the user to be identified all belong to different administrative regions, determining that the user to be identified is a risky user with a risk of fraud.

[0032] In an optional embodiment, the first determination module is further used for: if the activation behavior of the user to be identified activating the card to be identified is monitored within a preset time period, then determining the usage location of the card to be identified; if there are multiple usage locations of the card to be identified, determining the frequency of change of the usage location of the card to be identified; if the frequency of change of the usage location of the card to be identified is greater than a first threshold, determining that the user to be identified is a risky user with a risk of fraud.

[0033] In an optional embodiment, the first determination module is also used for: if the activation behavior of the user to be identified activating the card to be identified is monitored within a preset time period, then monitoring the daily call volume and / or text message volume of the user to be identified; when the daily call volume of the user to be identified is greater than a second threshold, and / or the daily text message volume of the user to be identified is greater than a third threshold, determining that the user to be identified is a risky user with a risk of fraud.

[0034] In an optional embodiment, the first determination module is also used for: if the activation behavior of the user to be identified activating the card to be identified is monitored within a preset time period, then detecting the call content and / or text message content of the user to be identified, and determining whether the call content and / or text message content of the user to be identified contains preset keywords and / or links; if so, counting the number of calls and / or text messages containing the preset keywords and / or links within the target time period, and when the number of calls containing the preset keywords and / or links is greater than a fourth threshold, and / or the number of text messages containing the preset keywords and / or links is greater than a fifth threshold, determining that the user to be identified is a risky user with a risk of fraud.

[0035] In an optional embodiment, the preset fraud-related scenarios include one or more of the following: common Internet card scenarios, no recharge and no pre-deposit scenarios, no network refund scenarios for arrears, no secondary card scenarios, high activation rate scenarios, high purchase frequency scenarios, and concentrated purchase channel scenarios;

[0036] The scoring module is also used to:

[0037] Determine the type of the risk user's historical card record according to the historical card record, and determine whether the risk user matches the common Internet card scenario according to the type of the historical card record;

[0038] Determine the recharge record and pre-store record of the historical card number of the risk user according to the historical card number record, and determine whether the risk user matches the no-recharge and no-pre-store scenario according to the recharge record and pre-store record;

[0039] Determine the arrears record of the historical card number of the risk user according to the historical card number record, and determine whether the risk user matches the scenario of not leaving the network due to arrears according to the arrears record;

[0040] Determine the secondary card application record of the historical card of the risk user according to the historical card record, and determine whether the user matches the no secondary card scenario according to the secondary card application record;

[0041] Determine, based on the historical card record, the activation rate of the historical card of the risk user, and determine, based on the activation rate, whether the risk user matches the high activation rate scenario;

[0042] Determine the historical card purchase frequency of the risk user according to the historical card purchase record, and determine whether the risk user matches the high purchase frequency scenario according to the historical card purchase frequency;

[0043] Determine the historical card purchase channels of the risk user according to the historical card purchase records, and determine whether the risk user matches the concentrated scenario of the purchase channels according to the historical card purchase channels;

[0044] The risky user is scored according to the weight of the preset fraud scenario matching the risky user.

[0045] In an optional embodiment, the device further includes a processing module for shutting down the card to be identified when it is determined that the risk user is a fraudulent user and the card to be identified is a fraudulent card.

[0046] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the fraudulent user identification method of an embodiment of the present invention.

[0047] In a fourth aspect, an embodiment of the present invention further provides a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the fraudulent user identification method of an embodiment of the present invention.

[0048] One embodiment of the above invention has the following advantages or beneficial effects:

[0049] By monitoring the user after purchasing a SIM card, determining whether the user is a risky user with fraud risk based on the monitored communication behavior, and if the user is determined to be a risky user, scoring the risky user according to preset fraud scenarios, and finally determining whether the risky user is a fraudulent user based on the risk user's score, this technical means can effectively improve the accuracy of fraud identification and effectively protect the user's property safety.

[0050] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0052] Figure 1 A schematic diagram schematically shows the main process of the fraud user identification method according to an embodiment of the present invention;

[0053] Figure 2 A flowchart schematically showing a fraud user identification method according to another embodiment of the present invention

[0054] Figure 3A schematic diagram schematically shows the main modules of the fraud user identification device according to an embodiment of the present invention;

[0055] Figure 4 Schematically shows an exemplary system architecture diagram in which the embodiments of the present invention can be applied;

[0056] Figure 5 The structure diagram of a terminal device or a server computer system suitable for implementing the embodiment of the present invention is schematically shown. DETAILED DESCRIPTION

[0057] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0058] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0059] Fraudulent users fabricate false information through phone calls and text messages to defraud victims. With the development of communication technology, the forms of fraud emerge in an endless stream. However, most fraud judgments are to identify fraudulent users through manual marking or call, text message content and user credit, which is single in form and low in accuracy. In order to solve the above problems or at least partially solve the above problems, an embodiment of the present invention provides a fraudulent user identification method, which can monitor the user after purchasing a number card, and judge whether the user is a risk user with fraud risk according to the monitored communication behavior. In the case of determining that the user is a risk user, the risk user is scored according to the preset fraud scenario, and finally, it is determined whether it is a fraud user according to the score of the risk user, which can efficiently identify fraudulent users according to different user usage scenarios, so as to shut down the number card in time and avoid property losses. In an embodiment of the present invention, a variety of fraud scenarios can be analyzed in advance, and the commonalities of each fraud scenario can be summarized and summarized, and the summarized commonalities can be used as elements matching the fraud scenario, thereby completing the definition of the preset fraud scenario and the definition of the matching element.

[0060] Figure 1 The flowchart schematically shows the main steps of the fraud user identification method according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0061] Step S101: In response to a successful purchase of a number card, the number card is used as a number card to be identified, the user who purchased the number card to be identified is used as a user to be identified, and the communication behavior of the user to be identified is monitored;

[0062] Step S102: determining whether the user to be identified is a risky user with a risk of fraud according to the communication behavior of the user to be identified;

[0063] Step S103: when it is determined that the user to be identified is a risk user with a risk of fraud, the historical card number record of the risk user is obtained, and the risk user is matched with a preset fraud scenario according to the historical card number record to score the risk user;

[0064] Step S104: Determine whether the risky user is a fraudulent user and whether the card to be identified is a fraudulent card based on the score of the user to be identified.

[0065] In this embodiment, after the user successfully purchases the number card, that is, after the order message of the number card is generated, the number card is used as the number card to be identified, the user is used as the user to be identified, and then the number to be identified and the user to be identified are monitored. It is determined whether the user to be identified is a risk user based on the monitored communication behavior. For example, it can be determined whether the user to be identified is a risk user by determining whether the monitored communication behavior belongs to the preset fraud-related behavior. If the monitored communication behavior belongs to the preset fraud-related behavior, it can be determined that the user to be identified is a risk user. Among them, the preset fraud-related behavior can be determined by summarizing various fraud-related scenarios. Exemplarily, considering that some fraud users will fabricate false information to defraud victims by making calls or text messages, therefore, in this embodiment, the preset fraud-related behavior may include but is not limited to the daily outbound call volume greater than the second threshold or the daily text message volume greater than the third threshold, then the communication behavior that needs to be monitored may include but is not limited to the behavior of the user to be identified making calls or sending text messages, and more specifically may include monitoring the number of calls made by the user to be identified and the number of text messages sent daily. Considering that the fraudulent user may not purchase or activate the number card at the location of the ID card, the preset fraud-related behaviors in this embodiment may include but are not limited to the card insertion location for activating the number card to be identified, the number location of the number card to be identified, and the location of the ID card of the user to be identified do not belong to the same administrative region (such as province), so the communication behaviors that need to be monitored may also include but are not limited to monitoring the behavior of activating the number card of the user to be identified. Considering that the fraudulent user may not commit real-time fraud in the same place for a long time, the place where the number card to be identified is used can also be monitored in this embodiment. If at least one of the above communication behaviors of the user to be identified is monitored as a preset fraud-related behavior, the number card to be identified is determined to be a risky number card, and the user to be identified is a risky user.

[0066] After determining that the user to be identified is a risky user, a secondary judgment is performed on the user based on a preset fraud-related scenario to more accurately determine whether the user to be identified is a fraudulent user.

[0067] In the embodiment of the present invention, multiple fraud scenarios can be analyzed in advance, and the commonalities of each fraud scenario can be summarized and summarized, and the summarized commonalities can be used as elements matching the fraud scenario, thereby completing the definition of the preset fraud scenario. Exemplarily, the preset fraud-related scenarios can include but are not limited to: common Internet card scenarios, no recharge and no pre-deposit scenarios, no network refund scenarios for arrears, no secondary card scenarios, high activation rate scenarios, high purchase frequency scenarios, and concentrated purchase channel scenarios.

[0068] After defining the fraud-related scenarios, the risky users are matched with the preset fraud-related scenarios according to their historical card records, including:

[0069] According to the historical card record, determine the type of the historical card of the risk user, and according to the type of the historical card, determine whether the risk user matches the scenario of often using an Internet card; illustratively, the proportion of the number of historical cards of the type of Internet cards to all historical cards can be determined, and if the proportion is greater than a preset first proportion threshold, it can be determined that the risk user matches the scenario of often using an Internet card;

[0070] According to the historical card record, the recharge record and pre-store record of the historical card of the risk user are determined, and according to the recharge record and pre-store record, it is determined whether the risk user matches the no-recharge and no-pre-store scenario; illustratively, according to the historical card record, the proportion of historical cards without recharge and no pre-store to all cards can be counted, and if the proportion is greater than a preset second proportion threshold, it can be determined that the risk user matches the no-recharge and no-pre-store scenario;

[0071] According to the historical card records, the arrears records of the historical card of the risk user are determined, and according to the arrears records, whether the risk user matches the scenario of not withdrawing from the network due to arrears; illustratively, if multiple historical card of the risk user are in the state of withdrawing from the network due to arrears, it is determined that the risk user matches the scenario of not withdrawing from the network due to arrears;

[0072] According to the historical card record, determine the secondary card application record of the historical card of the risk user, and according to the secondary card application record, determine whether the user matches the no secondary card scenario; illustratively, according to the historical card record, the proportion of historical cards without secondary cards to all cards can be counted, and if the proportion is greater than a preset third proportion threshold, it can be determined that the risk user matches the no secondary card scenario;

[0073] According to the historical card record, determine the activation rate of the historical card of the risk user, and according to the activation rate, determine whether the risk user matches the high activation rate scenario; illustratively, the activation rate of the historical card can be compared with a preset activation threshold, and if the activation rate of the historical card is greater than the preset activation threshold, it can be determined that the risk user matches the high activation rate scenario;

[0074] According to the historical card record, determine the historical card purchase frequency of the risk user, and according to the historical card purchase frequency, determine whether the risk user matches the high purchase frequency scenario; illustratively, the purchase frequency of the historical card can be compared with a preset purchase rate threshold, and if the purchase frequency of the historical card is greater than the preset purchase rate threshold, it can be determined that the risk user matches the high purchase frequency scenario;

[0075] Based on the historical card number records, determine the historical card number purchase channels of the risky user, and based on the historical card number purchase channels, determine whether the risky user matches the concentrated scenario of the purchase channels; illustratively, based on the historical card number records, count the proportion of historical card numbers from the same purchase channel to all card numbers, if the proportion is greater than a preset fourth proportion threshold, it can be determined that the risky user matches the concentrated scenario of the purchase channels.

[0076] After determining the fraud scenario that matches the risk user, the risk user can be scored according to the weight of the preset fraud scenario that matches the risk user. If the score of the risk user is greater than the preset risk threshold, the risk user is determined to be a fraud user, and the risk number card corresponding to the risk user is a fraud number card. For example, the weight of each fraud scenario can be shown in the following Table 1:

[0077] Table 1:

[0078]

[0079] For example, assuming that the risk threshold is 60 points, the fraud-related scenarios matched by the risk user include common Internet card scenarios, high activation rate scenarios, high purchase frequency scenarios and concentrated purchase channel scenarios, then the score of the risk user is 100×(30%+5%+10%+20%)=65, and the score of the risk user is greater than the risk threshold, so the risk user is identified as a fraud user and the risk number card of the risk user is identified as a fraud number.

[0080] The fraudulent user identification method of the embodiment of the present invention can monitor the user after the user purchases a SIM card, determine whether the user is a risky user with fraud risk based on the monitored communication behavior, and when the user is determined to be a risky user, score the risky user according to preset fraud scenarios. Finally, the technical means of determining whether the risky user is a fraudulent user based on the risk user's score can effectively improve the accuracy of fraud identification and effectively protect the user's property safety.

[0081] In an optional embodiment, after the risk user is identified as a fraud user and the risk card of the risk user is identified as a fraud card, the fraud card can be shut down. Later, the cardholder can bring his ID card to the operator's business hall to re-open the card.

[0082] Figure 2 The flowchart of the fraud user identification method according to the embodiment of the present invention is schematically shown as follows: Figure 2 As shown, the method includes:

[0083] Step S201: In response to a successful purchase of a number card, the number card is used as a number card to be identified, the user who purchased the number card to be identified is used as a user to be identified, and the communication behavior of the user to be identified is monitored.

[0084] Step S202: Determine the activation behavior of the user to be identified. Specifically, the process includes: determining whether the activation behavior of the user to be identified to activate the number card to be identified is monitored within a preset time period. If not, the user to be identified is determined to be a risk user with fraud risk. If so, the card insertion location, number ownership location and ID card location of the user to be identified are determined. Exemplarily, determine whether the activation behavior of the user to be identified to activate the number card is monitored within 7 days after the user to be identified purchases the number card, such as detecting the operation of activating the number card on the operator's client or receiving an activation SMS.

[0085] Step S203: Determine the card insertion location, number location and ID card location of the user to be identified. Specifically, the process includes: obtaining the activation return information of the user to be identified; determining the card insertion location of the card to be identified according to the activation return information; determining whether the card insertion location of the card to be identified, the number location of the card to be identified and the ID card location of the user to be identified belong to the same administrative region; when the card insertion location of the card to be identified, the number location of the card to be identified and the ID card location of the user to be identified all belong to different administrative regions, determine that the user to be identified is a risk user with fraud risk. Exemplarily, after the user to be identified activates the card to be identified (which can also be understood as after the real-name system), the information of the card to be identified and the user to be identified and the information of the number card registration base station will be recorded in the operator's system or database to generate activation return information. From the activation return information, the ID card number, age, gender and card insertion location (i.e., the activation location can be determined according to the location of the number card registration base station) and other information of the user to be identified can be obtained. If the province where the card to be identified is inserted, the province where the number is located, and the province where the ID card of the user to be identified is located (the province can be determined based on the first three digits of the ID card number) are three different provinces, if so, it is determined that the communication behavior of the user to be identified belongs to the preset fraud-related behavior, and the user to be identified is a risky user. On the contrary, the communication behavior of the user to be identified does not belong to the preset fraud-related behavior, and the user to be identified is not a risky user.

[0086] Step S204: Determine the place of use of the card to be identified. Specifically, the process includes: when there are multiple places of use of the card to be identified, determine the change frequency of the place of use of the card to be identified, and the change frequency can be determined according to the number of changes within a preset time period. When the change frequency of the place of use of the card to be identified is greater than the first threshold, it is determined that the communication behavior of the user to be identified belongs to the preset fraud-related behavior. Exemplarily, the preset time period can be 10 days, 15 days, 30 days, etc. Assuming that the first threshold is 1 / 4, if the card to be identified changes three provinces, cities and prefectures of use within 10 days, the change frequency is 3 / 10, or changes 4 provinces, cities and prefectures of use within 15 days, the change frequency is 4 / 15, then the user to be identified is considered to be a risky user with a risk of fraud.

[0087] Step S205: Determine the daily calls and / or text messages of the user to be identified: If the daily call volume of the user to be identified is greater than the second threshold, and / or the daily text message volume of the user to be identified is greater than the third threshold, determine that the user to be identified is a risk user with a risk of fraud. Exemplarily, if the user to be identified makes more than 50 outbound calls to different mobile phone numbers every day, or sends more than 99 text messages to different mobile phone numbers, the user to be identified is determined to be a risk user with a risk of fraud.

[0088] In an optional embodiment, the call content and / or text message content of the user to be identified can also be detected to determine whether the call content and / or text message content of the user to be identified contains preset keywords and / or links; if so, the number of calls and / or text messages containing the preset keywords and / or links within the target time period are counted, and when the number of calls containing the preset keywords and / or links is greater than the fourth threshold, and / or the number of text messages containing the preset keywords and / or links is greater than the fifth threshold, the user to be identified is determined to be a risk user with a risk of fraud. Exemplarily, after the card to be identified of the user to be identified is activated, the frequency of text message sending and the content of the text messages of the user are screened, and the user's monthly calls and text message content are monitored. If the text messages containing sensitive words or links such as public security, court, bank, etc. in the text message content reach a certain threshold within one month, the user to be identified is considered to be a risk user with a risk of fraud.

[0089] Step S206: Obtain the historical account card records of the risky user, match the risky user with a preset fraud-related scenario based on the historical account card records, and score the risky user;

[0090] Step S207: determining whether the risky user is a fraudulent user and whether the card to be identified is a fraudulent card according to the score of the user to be identified;

[0091] Step S208: When it is determined that the risk user is a fraudulent user and the card number to be identified is a fraudulent card number, the card number to be identified is shut down.

[0092] Steps S206-S208 and Figure 1 The embodiments shown are the same, and the present invention will not be repeated here. This embodiment provides an exemplary description of the communication behavior of the user to be identified, and the method of judging whether the user to be identified is a risk user with a risk of fraud based on the communication behavior, but the present invention is not limited to the above-mentioned specific implementation, which is merely illustrative and not restrictive.

[0093] Figure 3 A fraud user identification device 300 according to an embodiment of the present invention is schematically shown. Figure 3 As shown, the fraud user identification device 300 includes

[0094] The monitoring module 301 is used for responding to the successful purchase operation of the number card, taking the number card as the number card to be identified, taking the user who purchased the number card to be identified as the user to be identified, and monitoring the communication behavior of the user to be identified;

[0095] The first determination module 302 is used to determine whether the user to be identified is a risky user with a risk of fraud according to the communication behavior of the user to be identified;

[0096] The scoring module 303 is used to obtain the historical card number record of the risky user when it is determined that the user to be identified is a risky user with a risk of fraud, and match the risky user with a preset fraud-related scenario according to the historical card number record to score the risky user;

[0097] The second determination module 304 is used to determine whether the risky user is a fraudulent user and whether the card number to be identified is a fraudulent card number according to the score of the user to be identified.

[0098] In an optional embodiment, the first determination module is further used to: determine whether the activation behavior of the to-be-identified user activating the to-be-identified number card is monitored within a preset time period; if not, determine that the to-be-identified user is a risk user with a fraud risk

[0099] In an optional embodiment, the first determination module is also used for: if the activation behavior of the user to be identified activating the card to be identified is monitored within a preset time period, then obtaining the activation return information of the user to be identified; determining the card insertion location of the card to be identified based on the activation return information; determining whether the card insertion location of the card to be identified, the number location of the card to be identified and the ID card location of the user to be identified belong to the same administrative region; when the card insertion location of the card to be identified, the number location of the card to be identified and the ID card location of the user to be identified all belong to different administrative regions, determining that the user to be identified is a risky user with a risk of fraud.

[0100] In an optional embodiment, the first determination module is further used for: if the activation behavior of the user to be identified activating the card to be identified is monitored within a preset time period, then determining the usage location of the card to be identified; if there are multiple usage locations of the card to be identified, determining the frequency of change of the usage location of the card to be identified; if the frequency of change of the usage location of the card to be identified is greater than a first threshold, determining that the user to be identified is a risky user with a risk of fraud.

[0101] In an optional embodiment, the first determination module is also used for: if the activation behavior of the user to be identified activating the card to be identified is monitored within a preset time period, then monitoring the daily call volume and / or text message volume of the user to be identified; when the daily call volume of the user to be identified is greater than a second threshold, and / or the daily text message volume of the user to be identified is greater than a third threshold, determining that the user to be identified is a risky user with a risk of fraud.

[0102] In an optional embodiment, the first determination module is also used for: if the activation behavior of the user to be identified activating the card to be identified is monitored within a preset time period, then detecting the call content and / or text message content of the user to be identified, and determining whether the call content and / or text message content of the user to be identified contains preset keywords and / or links; if so, counting the number of calls and / or text messages containing the preset keywords and / or links within the target time period, and when the number of calls containing the preset keywords and / or links is greater than a fourth threshold, and / or the number of text messages containing the preset keywords and / or links is greater than a fifth threshold, determining that the user to be identified is a risky user with a risk of fraud.

[0103] In an optional embodiment, the preset fraud-related scenarios include one or more of the following: common Internet card scenarios, no recharge and no pre-deposit scenarios, no network refund scenarios for arrears, no secondary card scenarios, high activation rate scenarios, high purchase frequency scenarios, and concentrated purchase channel scenarios;

[0104] The scoring module is also used to:

[0105] Determine the type of the risk user's historical card record according to the historical card record, and determine whether the risk user matches the common Internet card scenario according to the type of the historical card record;

[0106] Determine the recharge record and pre-store record of the historical card number of the risk user according to the historical card number record, and determine whether the risk user matches the no-recharge and no-pre-store scenario according to the recharge record and pre-store record;

[0107] Determine the arrears record of the historical card number of the risk user according to the historical card number record, and determine whether the risk user matches the scenario of not leaving the network due to arrears according to the arrears record;

[0108] Determine the secondary card application record of the historical card of the risk user according to the historical card record, and determine whether the user matches the no secondary card scenario according to the secondary card application record;

[0109] Determine, based on the historical card record, the activation rate of the historical card of the risk user, and determine, based on the activation rate, whether the risk user matches the high activation rate scenario;

[0110] Determine the historical card purchase frequency of the risk user according to the historical card purchase record, and determine whether the risk user matches the high purchase frequency scenario according to the historical card purchase frequency;

[0111] Determine the historical card purchase channels of the risk user according to the historical card purchase records, and determine whether the risk user matches the concentrated scenario of the purchase channels according to the historical card purchase channels;

[0112] The risky user is scored according to the weight of the preset fraud scenario matching the risky user.

[0113] In an optional embodiment, the device further includes a processing module for shutting down the card to be identified when it is determined that the risk user is a fraudulent user and the card to be identified is a fraudulent card.

[0114] The fraud user identification device in the embodiment of the present invention can monitor the user after the user purchases a SIM card, and determine whether the user is a risky user with fraud risk based on the monitored communication behavior. When the user is determined to be a risky user, the risky user is scored according to preset fraud scenarios. Finally, the technical means of determining whether the risky user is a fraudulent user based on the risk user's score can effectively improve the accuracy of fraud identification and effectively protect the user's property safety.

[0115] The above device can execute the method provided by the embodiment of the present invention, and has the functional modules and beneficial effects corresponding to the execution method. For technical details not described in detail in this embodiment, please refer to the method provided by the embodiment of the present invention.

[0116] Figure 4 An exemplary system architecture 400 is shown to which the fraudulent user identification method or the fraudulent user identification device according to the embodiment of the present invention can be applied.

[0117] like Figure 4 As shown, system architecture 400 may include terminal devices 401, 402, 403, network 404 and server 405. Network 404 is used to provide a medium for communication links between terminal devices 401, 402, 403 and server 405. Network 404 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0118] Users can use terminal devices 401, 402, 403 to interact with server 405 through network 404 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 401, 402, 403, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0119] The terminal devices 401 , 402 , and 403 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0120] Server 405 may be a server that provides various services, such as a backend management server that provides support for shopping websites browsed by users using terminal devices 401, 402, and 403. The backend management server may analyze and process received data such as product information query requests, and feed back processing results (such as target push information and product information) to the terminal device.

[0121] It should be noted that the fraudulent user identification method provided in the embodiment of the present invention is generally executed by the server 405 , and accordingly, the fraudulent user identification device is generally disposed in the server 405 .

[0122] It should be understood that Figure 4 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0123] Reference below Figure 5 , which shows a schematic diagram of the structure of a computer system 500 of a terminal device suitable for implementing an embodiment of the present invention. Figure 5The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0124] like Figure 5 As shown, the computer system 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage part 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the system 500 are also stored. The CPU 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0125] The following components are connected to the I / O interface 505: an input section 506 including a keyboard, a mouse, etc.; an output section 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, a modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage section 508 as needed.

[0126] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the central processing unit (CPU) 501, the above-mentioned functions defined in the system of the present invention are executed.

[0127] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0128] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0129] The modules involved in the embodiments of the present invention may be implemented in software or hardware. The modules described may also be set in a processor. For example, they may be described as: a processor includes a sending module, an acquisition module, a determination module, and a first processing module. The names of these modules do not, in some cases, constitute a limitation on the unit itself. For example, the sending module may also be described as a "module for sending a picture acquisition request to the connected server."

[0130] As another aspect, the present invention further provides a computer-readable medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device:

[0131] In response to a successful purchase operation of the number card, the number card is used as the number card to be identified, the user who purchased the number card to be identified is used as the user to be identified, and the communication behavior of the user to be identified is monitored;

[0132] Determining whether the user to be identified is a risky user with a risk of fraud according to the communication behavior of the user to be identified;

[0133] In the case where it is determined that the user to be identified is a risk user with a risk of fraud, obtaining the historical card number record of the risk user, and matching the risk user with a preset fraud scenario according to the historical card number record to score the risk user;

[0134] According to the score of the user to be identified, it is determined whether the risky user is a fraudulent user and whether the card to be identified is a fraudulent card.

[0135] The technical solution of the embodiment of the present invention can monitor the user after purchasing a SIM card, determine whether the user is a risky user with fraud risk based on the monitored communication behavior, and when it is determined that the user is a risky user, score the risky user according to preset fraud scenarios. Finally, the technical solution determines whether the risky user is a fraudulent user based on the risk user's score. This technical solution can effectively improve the accuracy of fraud identification and effectively protect the property safety of users.

[0136] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for identifying fraudulent users, characterized in that: include: In response to a successful purchase operation of the number card, the number card is used as the number card to be identified, the user who purchased the number card to be identified is used as the user to be identified, and the communication behavior of the user to be identified is monitored; Determining whether the user to be identified is a risky user with a risk of fraud according to the communication behavior of the user to be identified; In the case where it is determined that the user to be identified is a risk user with a risk of fraud, obtaining the historical card number record of the risk user, and matching the risk user with a preset fraud scenario according to the historical card number record to score the risk user; The preset fraud-related scenarios include one or more of the following: common Internet card scenarios, no recharge and no pre-deposit scenarios, no refund for arrears, no secondary card scenarios, high activation rate scenarios, high purchase frequency scenarios, and concentrated purchase channel scenarios; According to the score of the user to be identified, determining whether the risky user is a fraudulent user and whether the card to be identified is a fraudulent card; Wherein, according to the communication behavior of the user to be identified, determining whether the user to be identified is a risk user with a risk of fraud includes: determining whether the activation behavior of the user to be identified activating the card to be identified is monitored within a preset time period; if not, determining that the user to be identified is a risk user with a risk of fraud; According to the historical card number record, matching the risk user with a preset fraud-related scenario includes one or more of the following: Determine the type of the risk user's historical card record according to the historical card record, and determine whether the risk user matches the common Internet card scenario according to the type of the historical card record; Determine the recharge record and pre-store record of the historical card number of the risk user according to the historical card number record, and determine whether the risk user matches the no-recharge and no-pre-store scenario according to the recharge record and pre-store record; Determine the arrears record of the historical card number of the risk user according to the historical card number record, and determine whether the risk user matches the scenario of not leaving the network due to arrears according to the arrears record; Determine the secondary card handling record of the historical card of the risk user according to the historical card record, and determine whether the risk user matches the no secondary card scenario according to the secondary card handling record; Determine, based on the historical card record, the activation rate of the historical card of the risk user, and determine, based on the activation rate, whether the risk user matches the high activation rate scenario; Determine the historical card purchase frequency of the risk user according to the historical card purchase record, and determine whether the risk user matches the high purchase frequency scenario according to the historical card purchase frequency; Determine the historical card purchase channels of the risk user according to the historical card purchase records, and determine whether the risk user matches the concentrated scenario of the purchase channels according to the historical card purchase channels; Scoring the risky user includes: scoring the risky user according to the weight of a preset fraud scenario matching the risky user; According to the score of the user to be identified, determining whether the risky user is a fraudulent user and whether the card to be identified is a fraudulent card includes: if the score of the risky user is greater than a preset risk threshold, determining that the risky user is a fraudulent user and the card to be identified is a fraudulent card.

2. The method according to claim 1, characterized in that: The method further comprises: If the activation behavior of the to-be-identified user activating the to-be-identified number card is monitored within the preset time period, the activation return information of the to-be-identified user is obtained; Determine the card insertion location of the card to be identified according to the activation return information; Determine whether the insertion location of the card to be identified, the location of the number of the card to be identified, and the location of the ID card of the user to be identified belong to the same administrative region; When the card insertion location of the card to be identified, the location of the number of the card to be identified and the location of the ID card of the user to be identified all belong to different administrative regions, the user to be identified is determined to be a risky user with fraud risk.

3. The method according to claim 1, characterized in that The method further comprises: If the activation behavior of the to-be-identified user activating the to-be-identified card is monitored within a preset time period, the usage location of the to-be-identified card is determined; If there are multiple usage locations of the card to be identified, determining the frequency of changes in the usage location of the card to be identified; When the change frequency of the usage location of the card to be identified is greater than a first threshold, the user to be identified is determined to be a risky user with a risk of fraud.

4. The method according to claim 1, characterized in that: The method further comprises: If the activation behavior of the to-be-identified user activating the to-be-identified card is monitored within a preset time period, the daily call volume and / or SMS volume of the to-be-identified user is monitored; When the daily call volume of the user to be identified is greater than a second threshold, and / or the daily text message volume of the user to be identified is greater than a third threshold, the user to be identified is determined to be a risky user with a risk of fraud.

5. The method according to claim 1, characterized in that The method further comprises: If the activation behavior of the to-be-identified user activating the to-be-identified number card is monitored within a preset time period, the call content and / or text message content of the to-be-identified user is detected to determine whether the call content and / or text message content of the to-be-identified user contains preset keywords and / or links; If so, the number of calls and / or text messages containing the preset keywords and / or links within the target time period is counted. When the number of calls containing the preset keywords and / or links is greater than the fourth threshold, and / or the number of text messages containing the preset keywords and / or links is greater than the fifth threshold, the user to be identified is determined to be a risky user with a risk of fraud.

6. The method according to claim 1, characterized in that The method further comprises: When it is determined that the risk user is a fraud user and the card number to be identified is a fraud card number, the card number to be identified is shut down.

7. A fraud user identification device, characterized in that: include: A monitoring module, for responding to a successful purchase operation of a number card, taking the number card as a number card to be identified, taking a user who purchased the number card to be identified as a user to be identified, and monitoring the communication behavior of the user to be identified; A first determination module is used to determine whether the user to be identified is a risky user with a risk of fraud according to the communication behavior of the user to be identified; A scoring module is used to obtain the historical card number record of the risky user when it is determined that the user to be identified is a risky user with a risk of fraud, and match the risky user with a preset fraud-related scenario according to the historical card number record to score the risky user; The preset fraud-related scenarios include one or more of the following: common Internet card scenarios, no recharge and no pre-deposit scenarios, no refund for arrears, no secondary card scenarios, high activation rate scenarios, high purchase frequency scenarios, and concentrated purchase channel scenarios; A second determination module is used to determine whether the risk user is a fraud user and whether the card to be identified is a fraud card according to the score of the user to be identified; The first determination module is further used to: determine whether the activation behavior of the to-be-identified user activating the to-be-identified number card is monitored within a preset time period; if not, determine that the to-be-identified user is a risk user with a fraud risk; The scoring module is also used to: Determine the type of the risk user's historical card record according to the historical card record, and determine whether the risk user matches the common Internet card scenario according to the type of the historical card record; Determine the recharge record and pre-store record of the historical card number of the risk user according to the historical card number record, and determine whether the risk user matches the no-recharge and no-pre-store scenario according to the recharge record and pre-store record; Determine the arrears record of the historical card number of the risk user according to the historical card number record, and determine whether the risk user matches the scenario of not leaving the network due to arrears according to the arrears record; Determine the secondary card handling record of the historical card of the risk user according to the historical card record, and determine whether the risk user matches the no secondary card scenario according to the secondary card handling record; Determine, based on the historical card record, the activation rate of the historical card of the risk user, and determine, based on the activation rate, whether the risk user matches the high activation rate scenario; Determine the historical card purchase frequency of the risk user according to the historical card purchase record, and determine whether the risk user matches the high purchase frequency scenario according to the historical card purchase frequency; Determine the historical card purchase channels of the risk user according to the historical card purchase records, and determine whether the risk user matches the concentrated scenario of the purchase channels according to the historical card purchase channels; Scoring the risky user according to the weight of the preset fraud scenario matching the risky user; The second determination module is also used to: if the score of the risky user is greater than a preset risk threshold, determine that the risky user is a fraudulent user and the card number to be identified is a fraudulent card number.

8. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 6.

9. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images