Method and system for monitoring slow recharging users

Abstract

The present invention discloses a method and system for monitoring slow-recharging users, which belongs to the field of anti-money laundering. The method includes the following steps: collecting transaction information of relevant users and generating a data list of transactions of participating users; collecting transaction information of users on a third-party platform, and generating a data list of target users based on the data list of transactions of the aforementioned users and participating users; collecting transaction information of the aforementioned target users and generating a data list of transactions of the target users; judging whether the aforementioned target users are suspicious users based on the data list of the aforementioned target users and the data list of participating users. The present invention can screen target users by monitoring abnormal transactions on a single platform, and then confirm whether the target users have the possibility of money laundering through the transactions of the target users on all platforms, thereby cooperating with the public security department to carry out anti-money laundering.

Description

Technical Field

[0001] The invention belongs to the field of anti-money laundering. Background Art

[0002] Slow top-up refers to transactions conducted through multiple third-party platforms. Examples include slow top-up for phone bills and platforms offering points. By advertising these slow top-up channels, users can simply wait longer and use a lower amount than regular fast top-up to purchase items of equal value. This facilitates money laundering without the knowledge of the users.

[0003] Prior art, such as Chinese patent application number CN 108629687 A, proposes an anti-money laundering method that collects money laundering characteristics from users and then applies these characteristics to a pre-trained money laundering identification model to analyze the user's money laundering results and types. The model then weights the multiple money laundering types to determine whether the user has engaged in money laundering. However, this method requires user screening before identifying suspicious users, making it difficult to monitor users across the board. Furthermore, this method lacks precision in collecting money laundering characteristics. For example, during a slow top-up process, criminals can collaborate with top-up users to launder money. These characteristics resemble merchant transactions and are difficult to extract.

[0004] To this end, we designed a method to monitor slow recharge users to solve the above problem. Summary of the Invention

[0005] The present application provides a method and system for monitoring slow-recharging users. By screening out target users from the transaction information of a certain platform and then monitoring all transaction flows of the target users, it is possible to identify whether the target users are suspicious users, thereby screening out suspicious users.

[0006] In order to solve the above technical problems, the present invention includes the following technical solutions:

[0007] A method for monitoring slow recharging users, the method comprising the following steps:

[0008] Collect transaction information of relevant users on the trading platform and generate a data list of relevant user transactions;

[0009] Collect transaction information of users on the trading platform, and generate a data list of target users based on the transaction information of the aforementioned users and the data list of transactions of related users;

[0010] Collect the transaction information of the aforementioned target user and generate a data list of the target user's transactions;

[0011] Determine whether the target user is a suspicious user based on the target user's data list and the participating user's data list;

[0012] The relevant users are users who receive transfers or recharges from other users on the platform.

[0013] Among them, a data list of participating users is generated for the relevant users who receive transfers or recharges from the target user.

[0014] Furthermore, the method for generating the target user is:

[0015] Collect transaction information of users on the trading platform;

[0016] Mark users whose number and / or amount of payment-related users reaches a threshold within a preset time, and generate a data list of target users.

[0017] Furthermore, the number of target users on the collection platform is collected, and when the number of the target users reaches a preset value, the platform is marked as a suspicious platform.

[0018] Furthermore, the method for determining the target user further includes:

[0019] Establish a database of sensitive words related to slow recharge;

[0020] Collecting keywords or phrases from user transaction information on the suspicious platform to generate a keyword data list;

[0021] Expand the key word data list with the synonym list and compare it with the sensitive word database to generate a comparison data list;

[0022] Based on the comparison data list, it is determined whether to add the aforementioned user to the target user data list.

[0023] Furthermore, the method for determining participating users further includes:

[0024] For the user added to the target user data list, the transaction information matching the sensitive words in the transaction information is collected, and the other party of the transaction information is added to the data list of the participating users.

[0025] Furthermore, the method for determining the suspicious user is as follows:

[0026] Collecting transaction information of the participating users, including transaction information paid by the target user, and generating a first payment data list;

[0027] Collecting transaction information of the aforementioned participating users, including transaction information of payments made by the aforementioned participating users to other users within a preset period before the target user makes payments to the aforementioned participating users, to generate a second payment data list;

[0028] Compare payment data list 1 and payment data list 2 of the same participating user. When the amount in payment data list 1 is greater than a certain amount in payment data list 2 and the difference does not exceed a preset value, the aforementioned participating user is marked. When the proportion of marked participating users reaches a preset value, the aforementioned target user is judged to be a suspicious user.

[0029] Furthermore, the method for determining a suspicious user further includes:

[0030] Marking the users who participated in the user payment in the payment data list 2;

[0031] For users whose marks exceed the threshold, a data list of payment recipients is generated;

[0032] Collect the transaction information of the above-mentioned payment receiving user and the corresponding participating user in the payment data list 2, and generate a data list of the corresponding payment transaction;

[0033] Based on the data list of the payment transaction and the first payment data list, determine whether to add the payment user to the data list of suspicious users.

[0034] A system for monitoring slow-recharging users, the system comprising:

[0035] Sentinel points are used to collect transaction information of users on third-party platforms, mark users whose number and / or payment amount reaches a threshold within a preset time period, and generate a data list of target users; collect transaction information of the aforementioned target users to generate a data list of target users' transactions; and collect transaction information of the aforementioned participating users to generate a data list of participating users' transactions;

[0036] The sentry station determines whether the target user is a suspicious user based on the data list of the target user and the data list of the participating users.

[0037] Furthermore, each of the sentinel points is connected to two third-party platforms, multiple sentinel points are connected to each other, and multiple sentinel points are jointly connected to a sentinel station.

[0038] Furthermore, when a sentinel point fails, the neighboring sentinel points can divert the transaction information collected by the failed sentinel point.

[0039] Due to the adoption of the above technical solution, the present invention has the following advantages and positive effects compared with the prior art: the method and system for monitoring slow recharge users in the present application screen abnormal transactions on a certain platform to find target users with a high degree of suspicion, and then monitor all transaction records of the target users to determine whether the target users are suspicious users; this solution can also screen out users who participate in slow recharge, thereby tracing the user funds, thereby finding money laundering users and combating slow recharge. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 Schematic diagram of the steps of the method for monitoring slow recharging users in this embodiment.

[0041] Figure 2 This is a schematic diagram of the steps of the target user generation method in the method for monitoring slow recharging users in this embodiment, which is an embodiment.

[0042] Figure 3 This is a schematic diagram of the steps of screening target users through a sensitive word database in the method for monitoring slow recharging users in this embodiment, which is an embodiment.

[0043] Figure 4 This is a schematic diagram of the steps of the method for determining suspicious users in the method for monitoring slow recharging users in this embodiment, which is an embodiment.

[0044] Figure 5 This is a schematic diagram of the steps of screening suspicious payment users in the method for monitoring slow recharging users in this embodiment, which is an embodiment.

[0045] Figure 6 Schematic diagram of the system for monitoring slow-recharging users in this embodiment.

[0046] The numbers in the figure are as follows:

[0047] 001-Sentry point; 002-Sentry station. DETAILED DESCRIPTION

[0048] The following is a further detailed description of a method and system for monitoring slow recharge users provided by the present invention in conjunction with the accompanying drawings and specific embodiments. It should be noted that the technical features or combinations of technical features described in the following embodiments should not be considered isolated, and they can be combined with each other to achieve better technical effects. In the drawings of the following embodiments, the same reference numerals appearing in each drawing represent the same features or components, which can be applied to different embodiments. Therefore, once an item is defined in one drawing, it does not need to be further discussed in subsequent drawings.

[0049] It should be noted that the structures, proportions, sizes, etc. illustrated in the drawings of this specification are only used to match the contents disclosed in the specification for people familiar with this technology to understand and read, and are not intended to limit the conditions under which the invention can be implemented. Any structural modification, change in proportional relationship, or adjustment of size should fall within the scope of the technical content disclosed in the invention without affecting the efficacy and purpose of the invention. The scope of the preferred embodiments of the present invention includes alternative implementations, in which the functions can be performed in a non-described or discussed order, including performing the functions in a substantially simultaneous manner or in a reverse order according to the functions involved, which should be understood by those skilled in the art of the art to which the embodiments of the present invention belong.

[0050] Techniques, methods, and apparatus known to persons of ordinary skill in the relevant art may not be discussed in detail, but where appropriate, such techniques, methods, and apparatus should be considered part of the specification. In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not limiting. Therefore, other examples of the exemplary embodiments may have different values.

[0051] Example

[0052] Reference Figure 1 As shown, the present invention describes a method for monitoring slow recharging users, which includes the following steps:

[0053] S101, collecting transaction information of relevant users on the transaction platform and generating a data list of relevant user transactions.

[0054] S102, collecting transaction information of users on the transaction platform, and generating a data list of target users based on the transaction information of the aforementioned users and a data list of transactions of related users.

[0055] S103, collecting the transaction information of the target user and generating a data list of the target user's transactions.

[0056] S104: Determine whether the target user is a suspicious user based on the target user's data list and the participating user's data list.

[0057] The relevant users are users who receive transfers or recharges from other users on the platform.

[0058] Among them, a data list of participating users is generated for the relevant users who receive transfers or recharges from the target user.

[0059] In this embodiment, a certain trading platform is monitored, abnormal transaction information on the platform is collected, target users are screened, and participating users who participate in slow recharge are confirmed through the target users. Based on the flow of funds between the target users and the participating users, it is confirmed whether the target users are criminals participating in anti-money laundering.

[0060] For example, the account of User A collected on Platform A has an additional recharge amount of 100 yuan. However, this recharge amount of 100 yuan does not come from User A's account, but is recharged by other users for User A. In this case, User A will be marked as a related user.

[0061] After screening, if user B is found to have topped up multiple related users, including user A, user B will be identified as a target user. Based on the transaction information between user A and user B, user B will be judged as a suspicious user. If user B is identified as a target user during the transaction and makes a payment to user A's account, user A will also be marked as a participating user.

[0062] By marking users on the platform as target users, participating users, and related users, and collecting the transaction information of the above users to screen out suspicious users, it is possible to avoid the influence of other transaction information of suspicious users on the screening results and improve the accuracy of judgment.

[0063] Reference Figure 2 As shown, in this embodiment, the method for generating target users is:

[0064] S201, collecting transaction information of users on the transaction platform.

[0065] S202: Mark users whose number and / or payment amount reaches a threshold within a preset time, and generate a data list of target users.

[0066] As a preferred implementation scheme in this embodiment, after the slow recharge user transfers money to the criminals, the criminals will receive the recharge records of the slow recharge user within the next 24 hours or 48 hours. It can be seen that if a user on a certain trading platform recharges or transfers money to a large number of users within a certain period of time, then the possibility that this user is a money laundering user is relatively high. Therefore, the user is marked as a target user and listed as a key screening object.

[0067] For example, on platform A, if it is collected that user B recharges 200 users within 24 hours, and the recharge amount reaches 20,000 yuan, then user A will be marked as the target user.

[0068] Preferably, in this embodiment, the number of target users on the collection platform is collected, and when the number of the target users reaches a preset value, the platform is marked as a suspicious platform.

[0069] In this embodiment, if a platform is determined to have too many target users, it may be a slow-recharge platform frequently used by criminals. Therefore, the platform will be marked as a suspicious platform and targeted for screening of suspicious users. For example, if the number of target users on platform A exceeds 10, platform A will be marked as a suspicious platform.

[0070] Reference Figure 3 As shown, in this embodiment, the method for determining the target user further includes:

[0071] S301, establishing a sensitive word database related to slow recharge.

[0072] S302, collecting keywords or phrases from the user transaction information on the suspicious platform and generating a keyword data list.

[0073] S303: Expand the key word data list through the synonym table and compare it with the sensitive word database to generate a comparison data list.

[0074] S304: Determine whether to add the aforementioned user to the target user data list based on the comparison data list.

[0075] In this embodiment, the target users can be screened more comprehensively. After a certain transaction platform is determined to be a suspicious platform, keywords or phrases in the chat records or notes during the transaction of users on the platform can be collected, and then the keywords and phrases can be expanded through a synonym table and compared with the sensitive word database. The comparison results can be used to determine whether the user can be determined as a suspicious user.

[0076] For example, if the collected keywords and phrases, after expanding the synonym list, show a similarity of 70% or more with the sensitive word list, the user can be added to the target user data list. The target user's transaction flow can then be used to determine whether the target user is a suspicious user. It is worth noting that if the target user's data table already exists, the user can be directly identified as suspicious and crackdowns can be launched against slow recharge behavior.

[0077] Preferably, in this embodiment, the method for determining participating users further includes: for the users added to the target user data list, collecting transaction information that matches sensitive words in the transaction information, and adding the other user of the aforementioned transaction information to the data list of participating users.

[0078] In this embodiment, once a user on the platform is identified as a target user based on keywords, other users who transacted with that user are identified as participating users. The transaction records of participating users are then used to further determine whether the target user is a suspicious user. For example, if user A is identified as a target user and user B uses sensitive terms in their chat history or notes during a transaction with user A, user B will be added to the list of participating users.

[0079] like Figure 4 As shown, in this embodiment, the method for determining the suspicious user is:.

[0080] S401, collecting transaction information of the participating users, including transaction information paid by the target user, and generating a first payment data list.

[0081] S402 , collecting transaction information of the aforementioned participating users, including transaction information of the aforementioned participating users' payments to other users within a preset time period before the target user pays the aforementioned participating users, and generating a second payment data list.

[0082] S403, compare the payment data list 1 and payment data list 2 of the same participating user. When the amount in the payment data list 1 is greater than a certain amount in the payment data list 2 and the difference does not exceed the preset value, mark the aforementioned participating user. When the proportion of marked participating users reaches the preset value, the aforementioned target user is judged to be a suspicious user.

[0083] As a preferred implementation in this embodiment, a characteristic of a slow top-up transaction is that the amount a participating user pays to other users is equal to the amount other users top up their accounts, and the difference in amount is small, for example, within 30 yuan. Therefore, this characteristic can be used to determine whether the target user is a criminal involved in a slow top-up. The transaction data in Payment Data List 1 and Payment Data List 2 in this embodiment represents the transaction data of the user involved across all platforms.

[0084] For example, if user A's account on platform A is topped up by target user B with 100 yuan, and within 48 hours prior to the top-up, user A paid 20 yuan, 40 yuan, and 80 yuan to multiple other users, of which 80 yuan was paid to target user B, then user A's transaction meets the slow top-up feature, and user A will be flagged accordingly. Furthermore, if user C's account is topped up by target user B with 100 yuan, and within 48 hours prior to the top-up, user C paid 50 yuan, 80 yuan, and 100 yuan to other users, respectively, and user C did not pay target user B, but user C had an expenditure of 80 yuan, the difference from the top-up amount of 100 yuan is within 30 yuan, and thus still meets the anti-money laundering feature, the user will still be flagged, because the person who accepts the user's remittance and the person who tops up the user may not be the same person.

[0085] When the proportion of marked participating users accounts for more than 80% of all participating users, it can be determined that the target user B is a slow recharge criminal.

[0086] like Figure 5 As shown, in this embodiment, the method for determining a suspicious user further includes:

[0087] S501, marking the users who participate in user payment in the payment data list 2.

[0088] S502: Generate a data list of payment recipients for users whose marks exceed the threshold.

[0089] S503: Collect the transaction information of the payment receiving user and the corresponding participating user in the payment data list 2, and generate a data list corresponding to the payment receiving transaction.

[0090] S504: Based on the data list of the payment transaction and the first payment data list, determine whether to add the payment user to the data list of suspicious users.

[0091] In this embodiment, during the slow recharge process, the payee and the recharger of the slow recharge user may not be the same person. For example, in online gambling, the money won by user A is supplemented by collecting the recharge amount of slow recharge users, thereby converting it into user A's legal income, while the money lost by user B is used to recharge the slow recharge user's account by the corresponding amount. In the previous judgment of suspicious users, only suspicious users similar to user B were screened out, so suspicious users similar to user A can also be screened.

[0092] For example, user A transfers 50, 60, and 80 yuan to users B, C, and D, respectively. Within the next 48 hours, user E tops up user A's account on a certain platform with 100 yuan. At this point, the transaction record for the 100 yuan top-up is extracted into payment data list one, and users B, C, and D are marked. The corresponding transaction records for 50, 60, and 80 yuan are extracted into payment data list two. For each participating user, users similar to B, C, and D are marked. If the number of times user D is marked exceeds 80% of the total number of participating users, user D can be determined to be the recipient. The transaction records between user D and the participating users are then collected. For example, if user D receives a transfer of 80 yuan from user A, this transaction meets the characteristics of slow top-up. If the number of transactions meeting the slow top-up characteristics accounts for more than 80% of the total number of transactions between user D and the participating users, user D will be added to the suspicious user list.

[0093] Reference Figure 6 As shown, a system for monitoring slow recharging users includes:

[0094] Sentinel Point 001 is used to collect transaction information of users on the third-party platform, mark users whose number and / or payment amount reaches a threshold within a preset time, and generate a data list of target users; collect transaction information of the aforementioned target users to generate a data list of target user transactions; and collect transaction information of the aforementioned participating users to generate a data list of participating user transactions;

[0095] The sentry station 002 determines whether the target user is a suspicious user based on the target user's data list and the participating user's data list.

[0096] In this embodiment, a large network can be established through Sentinel Point 001 to connect various trading platforms, which is convenient for collecting transaction information on various trading platforms, thereby providing sufficient data sources for combating slow recharge behavior; after Sentinel Point 001 collects transaction information on various platforms, the transaction information is packaged and transmitted to Sentinel Station 002. Sentinel Station 002 analyzes and processes relevant transaction information to screen out suspicious users who recharge slowly. The screening range is comprehensive and suitable for screening general users.

[0097] For example, if a sentinel point 001 collects payment or recharge amounts from target user A to multiple participating users on platform A, then the transaction information of target user A on all platforms can be collected through each sentinel point 001 and packaged to sentinel station 002. Sentinel station 002 will analyze whether target user A is the initiator of slow recharge based on the transaction information of target user A, thereby cracking down on slow recharge behavior.

[0098] Preferably, each of the sentinel points 001 is connected to two third-party platforms, multiple sentinel points 001 are connected to each other, and multiple sentinel points 001 are jointly connected to a sentinel station 002.

[0099] In this embodiment, a connection node is set up for every two trading platforms, and the sentinel point 001 is set up on the connection node. Multiple sentinel points 001 are connected to each other, and multiple sentinel points 001 are commonly connected to the sentinel station 002.

[0100] Preferably, when a sentinel point 001 fails, the adjacent sentinel points 001 can divert the transaction information collected by the failed sentinel point 001.

[0101] In this embodiment, since the Sentinel Points 001 are interconnected, if a Sentinel Point 001 fails, the transaction flow of the two connected trading platforms can be diverted to the adjacent Sentinel Point 001, thereby ensuring the stability of transaction information collected by Sentinel Point 001. It is worth mentioning that two Sentinel Stations 002 can also be set up for ready replacement to prevent Sentinel Station 002 failure from paralyzing the entire system.

[0102] Other technical features are described in the previous embodiments and will not be repeated here.

[0103] In the above description, the components may be selectively and operatively combined in any number within the scope of the intended protection of the present disclosure. In addition, terms such as "include," "encompass," and "have" should be interpreted as inclusive or open-ended rather than exclusive or closed by default, unless expressly defined to the contrary. All technical, technological, or other terms have the meanings understood by those skilled in the art, unless they are defined to the contrary. Common terms found in dictionaries should not be interpreted in an overly idealized or unrealistic manner in the context of the relevant technical documentation, unless expressly defined to that extent by the present disclosure.

[0104] Although example aspects of the present disclosure have been described for illustrative purposes, those skilled in the art will appreciate that the foregoing description is merely a description of preferred embodiments of the present invention and does not limit the scope of the present invention in any way. The scope of the preferred embodiments of the present invention includes alternative implementations in which functions may be performed out of the order in which they appear or are discussed. Any changes or modifications made by those skilled in the art based on the foregoing disclosure are intended to fall within the scope of the claims.

Claims

1. A method for monitoring slow recharging users, characterized by: The method comprises the following steps: Collect transaction information of relevant users on the trading platform and generate a data list of relevant user transactions; Collect transaction information of users on the trading platform, and generate a data list of target users based on the transaction information of the aforementioned users and the data list of transactions of related users; the target users are those who need to be screened in detail; Collect the transaction information of the aforementioned target user and generate a data list of the target user's transactions; Determine whether the target user is a suspicious user based on the target user's data list and the participating user's data list; wherein, the method for determining the suspicious user is as follows: collect transaction information of the participating users, including payment information of the target user for the participating users, to generate a first payment data list; collect transaction information of the participating users, including payment information of the participating users made to other users within a preset time before the target user made payment to the participating users, to generate a second payment data list; compare the first payment data list and the second payment data list of the same participating user; when the amount in the first payment data list is greater than a certain amount in the second payment data list and the difference does not exceed a preset value, mark the participating user; and when the proportion of marked participating users reaches a preset value, determine that the target user is a suspicious user; The relevant users are: users who receive transfers or top-ups from other users on the platform; Among them, for the users who receive transfers or recharges from the target user, a data list of participating users is generated; the participating users are the users who receive transfers or recharges from the target user.

2. The method for monitoring slow recharge users according to claim 1, characterized in that: The method for generating the target user is: Collect transaction information of users on the trading platform; Mark users whose number and / or amount of payment-related users reaches a threshold within a preset time, and generate a data list of target users.

3. The method for monitoring slow recharging users according to claim 1, characterized in that: The number of target users on the collection platform is determined, and when the number of target users reaches a preset value, the platform is marked as a suspicious platform.

4. The method for monitoring slow recharge users according to claim 3, characterized in that: The method for determining the target user further includes: Establish a database of sensitive words related to slow recharge; Collecting keywords or phrases from user transaction information on the suspicious platform to generate a keyword data list; Expand the key word data list with the synonym list and compare it with the sensitive word database to generate a comparison data list; Based on the comparison data list, it is determined whether to add the aforementioned user to the target user data list.

5. The method for monitoring slow recharge users according to claim 4, characterized in that: The method for determining participating users further includes: For users added to the target user data list, the transaction information matching the sensitive words in the transaction information is collected, and the other party of the aforementioned transaction information is added to the data list of participating users.

6. The method for monitoring slow recharging users according to claim 1, characterized in that: The method for determining the suspicious user further includes: Marking the users who participated in the user payment in the payment data list 2; For users whose marks exceed the threshold, a data list of payment recipients is generated; Collect the transaction information of the above-mentioned payment receiving user and the corresponding participating user in the payment data list 2, and generate a data list of the corresponding payment transaction; Based on the data list of the payment transaction and the first payment data list, determine whether to add the payment user to the data list of suspicious users.

7. A system for monitoring slow-recharging users, characterized by: The system includes, Sentinel points are used to collect transaction information of users on third-party platforms, mark users whose number and / or payment amounts reach a threshold within a preset time period, and generate a data list of target users; the target users are those who require key screening; collect transaction information of the aforementioned target users to generate a data list of target user transactions; and collect transaction information of the aforementioned participating users to generate a data list of participating user transactions; the participating users are users who receive transfers or top-ups from target users; The sentry station determines whether the aforementioned target user is a suspicious user based on the data list of the aforementioned target user and the data list of the participating users; wherein, the method for determining the suspicious user is as follows: collecting the transaction information of the participating users, including the transaction information of the target user paying for the aforementioned participating users, to generate a payment data list one; collecting the transaction information of the aforementioned participating users, including the transaction information of the aforementioned participating users spending money on other users within a preset time before the target user pays the aforementioned participating users, to generate a payment data list two; comparing the payment data list one and the payment data list two of the same participating user, and when the amount in the payment data list one is greater than a certain amount in the payment data list two and the difference does not exceed a preset value, the aforementioned participating user is marked, and when the proportion of marked participating users reaches a preset value, the target user is judged to be a suspicious user.

8. The system for monitoring slow recharge users according to claim 7, characterized in that: Each of the sentinel points is connected to two third-party platforms, multiple sentinel points are connected to each other, and multiple sentinel points are jointly connected to a sentinel station.

9. The system for monitoring slow-recharging users according to claim 7, characterized in that: When a sentinel point fails, the neighboring sentinel points can divert the transaction information collected by the failed sentinel point.

Images