Real-time transaction fraud intelligent monitoring and efficient interception system

Abstract

The invention provides an intelligent monitoring and efficient interception system for real-time transaction fraud, and the system comprises a transaction type determination module which is used for determining the type of real-time transaction; the monitoring strategy calling module is used for calling a monitoring strategy according to the type of the transaction; the execution module is used for executing the monitoring strategy and determining whether to intervene or not according to the monitoring strategy; and the intervention module is used for generating a corresponding intervention strategy according to the trigger item of the monitoring strategy and executing the intervention strategy. The real-time transaction fraud intelligent monitoring and efficient interception system realizes intelligent monitoring and interception of fraud in real-time transaction.

Description

Technical Field

[0001] The present invention relates to the technical field of financial monitoring systems, and in particular to a real-time transaction fraud intelligent monitoring and efficient interception system. Background Art

[0002] Real-time transactions refer to transactions in which transaction information is transmitted and processed in real time during the actual transaction process, and the transaction results take effect immediately. Due to the immediacy and convenience of real-time transactions, they are widely used in people's lives. When fraudulent real-time transactions occur, it is difficult to recover the money due to the real-time transaction model. How to realize intelligent monitoring and interception of fraud in real-time transactions can effectively ensure property safety. Summary of the invention

[0003] One of the purposes of the present invention is to provide a real-time transaction fraud intelligent monitoring and efficient interception system to achieve intelligent monitoring and interception of fraud in real-time transactions.

[0004] An embodiment of the present invention provides a real-time transaction fraud intelligent monitoring and efficient interception system, comprising: A transaction type determination module, used to determine the type of real-time transaction; The monitoring strategy calling module is used to call the monitoring strategy according to the transaction type; An execution module, used to execute the monitoring strategy and determine whether to intervene based on the monitoring strategy; The intervention module is used to generate and execute corresponding intervention strategies according to the trigger items of the monitoring strategy.

[0005] Preferably, the types of real-time transactions include: payment with payee verification first or payment with payee verification later.

[0006] Preferably, when the type of real-time transaction is a payment verified by the payer in advance, the monitoring strategy includes: Determine the type of payee; When the payee is a fixed merchant, determine the distance between the payee and the fixed merchant; when the distance is less than or equal to the preset distance threshold, determine the first limit parameter from the pre-configured type-limit correspondence table based on the merchant type of the fixed merchant, and determine the second limit parameter by analyzing the historical payment records of the payee at merchants of the same merchant type; When the payment amount is greater than or equal to the first limit parameter and / or greater than or equal to the second limit parameter, intervention is triggered.

[0007] Preferably, when the payment amount is greater than or equal to the first limit parameter, the intervention strategy includes: outputting a prompt message to the payee and / or receiving a limit release verification from the payee; When the payment amount is greater than or equal to the second limit parameter, the intervention strategy includes: outputting a prompt message to the payer and / or receiving the limit release verification of the payee.

[0008] Preferably, when the type of real-time transaction is a payment verified by the payer in advance, the monitoring strategy includes: Determine the type of payee; When the payee is a fixed merchant, determine the distance between the payee and the fixed merchant; when the distance is greater than a preset first distance threshold, trigger intervention; The intervention strategy includes: outputting prompt information to the payer and / or receiving the payer's release verification.

[0009] Preferably, when the type of real-time transaction is a payment verified by the payer in advance, the monitoring strategy includes: Determine the type of payee; When the payee is an individual, determine the payment scenario; When the payment scenario is offline payment, determine whether the payment amount is set during verification; if not, analyze the payer's offline payment history with the individual and the configured limit threshold to determine the third limit parameter; when the payment amount is greater than or equal to the third limit parameter, trigger intervention; The intervention strategy includes: outputting prompt information to the payer and / or receiving the payer's release verification.

[0010] Preferably, when the type of real-time transaction is a payment verified by the payer in advance, the monitoring strategy includes: Determine the type of payee; When the payee is an individual, determine the payment scenario; When the payment scenario is online payment, determine whether the payment amount is set during verification; if not, trigger intervention; When set, determines whether the payee and the payer are contacts; if not, triggers intervention; If yes, analyze the historical interaction records between the payee and the payer to determine the reference amount; when the reference amount does not match the payment amount, trigger intervention; When the payee is a marked person, intervention is triggered; When historical interaction records trigger pre-configured intervention events, intervention is triggered.

[0011] Preferably, when the type of real-time transaction is a payment verified by the payer in advance, the monitoring strategy further includes: Whether the payer has performed a prior verification within a preset time before the transaction time and whether the distance between the location where the prior verification occurred and the location where the payment occurred is greater than a preset second distance threshold; When no prior verification is performed and / or the distance between the location where the prior verification occurs and the location where the payment occurs is greater than a preset second distance threshold, the intervention is triggered; The intervention strategies include: outputting prompt information to the payer, receiving the payer's verification of release, changing to delayed payment, or one or more combinations thereof.

[0012] Preferably, when the type of real-time transaction is a payment verified by the payer later, the monitoring strategy includes: Determine the type of payee; When the payee is a fixed merchant, determine the payment scenario; When the payment scenario is offline payment, determine the movement trajectory of the payer while staying on the payment interface; When the movement trajectory is far away from the cashier area of ​​a fixed merchant, intervention is triggered; The intervention strategy includes: outputting a prompt message to the payee and / or receiving the release verification of the payee.

[0013] Preferably, the real-time transaction fraud intelligent monitoring and efficient interception system also includes: Image analysis module and payment request query module; The image analysis module analyzes the image captured by the image acquisition unit configured to capture the image of the cashier area of ​​the fixed merchant to identify whether there is a preset payment action; When it exists, the payment request query module determines whether there is a payment request with the fixed merchant as the payment object within a preset time interval; When there is no payment request with a fixed merchant as the payment object, the intervention module issues a reminder through a reminder device associated with the image acquisition unit.

[0014] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description and the accompanying drawings.

[0015] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings: Figure 1 A schematic diagram of a real-time transaction fraud intelligent monitoring and efficient interception system in an embodiment of the present invention; Figure 2Schematic diagram of another real-time transaction fraud intelligent monitoring and efficient interception system in an embodiment of the present invention. DETAILED DESCRIPTION

[0017] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0018] The embodiment of the present invention provides a real-time transaction fraud intelligent monitoring and efficient interception system, such as Figure 1 As shown, including: A transaction type determination module 1, used to determine the type of real-time transaction; Monitoring strategy calling module 2, used to call monitoring strategy according to the type of transaction; An execution module 3 is used to execute the monitoring strategy and determine whether to intervene according to the monitoring strategy; The intervention module 4 is used to generate and execute corresponding intervention strategies according to the triggering items of the monitoring strategies.

[0019] Among them, the types of real-time transactions include: payment verified by the payee first or payment verified by the payee later. Payment verified by the payee first means that the payee first performs the operation to verify the payment password and / or payment amount; and then the payee performs the verification operation, for example: in daily payment, the payee presents the payment code, and the payee scans the payment code with a barcode scanner, etc.; payment verified by the payee later means that the payment is completed after the payee performs the last step of the operation, and the last step includes entering the payment amount and / or inputting the payment password and confirming it; for example: in daily payment, the payee scans the payment code and enters the amount and password on the interface and confirms it, etc.; Among them, when the type of real-time transaction is a payment verified by the payer in advance, the monitoring strategy includes: Determine the type of payee; When the payee is a fixed merchant, determine the distance between the payee and the fixed merchant; when the distance is less than or equal to the preset distance threshold, determine the first limit parameter from the pre-configured type-limit correspondence table based on the merchant type of the fixed merchant, and determine the second limit parameter by analyzing the historical payment records of the payee at merchants of the same merchant type; When the payment amount is greater than or equal to the first limit parameter and / or greater than or equal to the second limit parameter, intervention is triggered.

[0020] When the payment amount is greater than or equal to the first limit parameter, the intervention strategy includes: outputting a prompt message to the payee and / or receiving a limit release verification from the payee; When the payment amount is greater than or equal to the second limit parameter, the intervention strategy includes: outputting a prompt message to the payer and / or receiving the limit release verification of the payee.

[0021] When the payee is a fixed merchant, determine the distance between the payee and the fixed merchant; when the distance is greater than a preset first distance threshold, trigger intervention; at this time, the intervention strategy includes: outputting prompt information to the payer and / or receiving the payment release verification.

[0022] First, the identity of the payee is determined. That is, when the payee is a fixed merchant, the distance between the payer and the payee is determined to determine whether the payee is present (to prevent other people from using the screenshot of the payee's payment code to pay); finally, the payment amount is determined and analyzed based on the first limit parameter corresponding to the merchant type and the second limit parameter corresponding to the payee. The first limit parameter limits the abnormal collection behavior of fixed merchants, and the second limit parameter limits the abnormal payment behavior of the payee; the limit release verification is to continue the transaction by entering a password or other verification means; the prompt information output interface must also be accompanied by option buttons for continuing the transaction and terminating the transaction; the second limit parameter includes: the maximum amount or average amount spent by the payee in such merchants; when there is a pre-configured limit amount, the limit amount is used as the second limit parameter; in addition, for distance judgment, the payee's location used is the positioning location corresponding to the last time the payee requested a payment code from the platform, and the location of a fixed merchant is the pre-configured geographic location of the merchant.

[0023] In addition, when the type of real-time transaction is a payment that is previously verified by the payer, the monitoring strategy includes: Determine the type of payee; When the payee is an individual, determine the payment scenario; When the payment scenario is offline payment, determine whether the payment amount is set during verification; when not set, analyze the payee's offline payment history with the individual and the configured limit threshold to determine the third limit parameter; when the payment amount is greater than or equal to the third limit parameter, trigger intervention; the intervention strategy includes: outputting prompt information to the payee and / or recipient of the limit release verification.

[0024] When the payment scenario is online payment, determine whether the payment amount is set during verification; if not, trigger intervention; When set, determines whether the payee and the payer are contacts; if not, triggers intervention; If yes, analyze the historical interaction records between the payee and the payer to determine the reference amount; when the reference amount does not match the payment amount, trigger intervention; When the payee is a marked person, intervention is triggered; When historical interaction records trigger pre-configured intervention events, intervention is triggered.

[0025] The above payment situation is a real-time payment between individuals (for example, transfers, red envelopes, etc.). In this type of real-time payment, the payment scenario is first determined. The payment scenario can be determined by the distance between the payer and the payee. When the distance is less than or equal to the preset judgment threshold (10 meters), it can be considered an offline payment; otherwise, it is an online payment. When paying online, it is very risky for the payer not to set the payment amount in advance, so intervention is directly triggered. It is also necessary to determine whether the payee and the payee are contacts to avoid fraudulent behavior of other people using the payee to collect money, and when the payee is a marked person and the historical interaction record before the transaction is a fraudulent event, intervention can be made. Among them, the marking rule for marked persons is that if more than a preset number (10) are added within a preset time period (any one from 1 hour to 1 day), the mark will be marked. to 100) persons, and / or, receiving transfers from more than a preset number of people (any from 10 to 100) within a preset time period (any from 1 hour to 1 day), and / or, if the historical interaction records (chats) with a preset number of people (any from 10 to 100) within a preset time period (any from 1 hour to 1 day) involve pre-configured sensitive words (money, amount, payment, price, etc.), the person is marked as a marked person; the historical interaction records between the payee and the payer are analyzed to determine the reference amount, specifically: retrieving the chat records within a preset time period (any from 10 seconds to 1 hour) before payment, taking the last amount appearing in the chat records as the reference amount, or taking all the amounts appearing as the reference amount; when the payment amount matches any one of them, it is judged that the payment amount matches the reference amount.

[0026] In one embodiment, when the type of the real-time transaction is a payment that is previously verified by the payer, the monitoring strategy further includes: Whether the payer has performed a prior verification within a preset time before the transaction time and whether the distance between the location where the prior verification occurred and the location where the payment occurred is greater than a preset second distance threshold; When no prior verification is performed and / or the distance between the location where the prior verification occurs and the location where the payment occurs (i.e. the location of the payee during the operation) is greater than a preset second distance threshold, the intervention is triggered; The intervention strategies include: outputting prompt information to the payer, receiving the payer's verification of release, changing to delayed payment, or one or more combinations thereof.

[0027] Since the information obtained by the payee after verification is saved, the payee's operation is performed after a certain period of time; that is, the difference between the verification time and the transaction time, as well as the distance between the verification location and the payment location, is comprehensively judged to intervene; since the payee is traveling and making payments in other places, although no intervention will be made for a certain period of time after the intervention is lifted; during this period of time, the payee may not be able to return to the original place, so the payee needs to authorize at regular intervals, which is extremely inconvenient. Therefore, after two interventions, the next time the judgment is made, it is determined whether the payee's location is the same as the previous two interventions. If the same, no intervention is made to avoid frequent interventions that cause trouble to the payee; In one embodiment, when the type of real-time transaction is a payment verified by the payer later, the monitoring strategy includes: Determine the type of payee; When the payee is a fixed merchant, determine the payment scenario; When the payment scenario is offline payment, determine the movement trajectory of the payer while staying on the payment interface; When the movement trajectory is far away from the cashier area of ​​a fixed merchant, intervention is triggered; The intervention strategy includes: outputting a prompt message to the payee and / or receiving the release verification of the payee.

[0028] This embodiment is aimed at the situation where the payer intends to escape the bill by scanning the merchant's payment code at a fixed merchant but does not enter the amount or other subsequent operations on the interface. By judging whether there is an intention to escape the bill by the movement trajectory on the payment interface, the fixed merchant is reminded to take corresponding measures.

[0029] In one embodiment, Figure 2 As shown, the real-time transaction fraud intelligent monitoring and efficient interception system also includes: Image analysis module 5 and payment request query module 6; The image analysis module 5 analyzes the image captured by the image acquisition unit configured to capture the image of the cashier area of ​​the fixed merchant to identify whether there is a preset payment action; If yes, the payment request query module 6 determines whether there is a payment request with a fixed merchant as the payment object within a preset time interval; When there is no payment request with a fixed merchant as the payment object, the intervention module issues a reminder through a reminder device associated with the image acquisition unit.

[0030] This embodiment is aimed at reminding the merchant when the payee pretends to scan and pays at a fixed merchant, so that the merchant can take corresponding measures.

[0031] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A real-time transaction fraud intelligent monitoring and efficient interception system, characterized in that: include: A transaction type determination module, used to determine the type of real-time transaction; The monitoring strategy calling module is used to call the monitoring strategy according to the transaction type; An execution module, used to execute the monitoring strategy and determine whether to intervene based on the monitoring strategy; The intervention module is used to generate and execute corresponding intervention strategies according to the trigger items of the monitoring strategy.

2. The real-time transaction fraud intelligent monitoring and efficient interception system according to claim 1, characterized in that: The types of real-time transactions include: payment with payee verification first or payment with payee verification later.

3. The real-time transaction fraud intelligent monitoring and efficient interception system as claimed in claim 2, characterized in that: When the type of real-time transaction is a payment that is previously verified by the payer, the monitoring strategy includes: Determine the type of payee; When the payee is a fixed merchant, determine the distance between the payee and the fixed merchant; when the distance is less than or equal to the preset distance threshold, determine the first limit parameter from the pre-configured type-limit correspondence table based on the merchant type of the fixed merchant, and determine the second limit parameter by analyzing the historical payment records of the payee at merchants of the same merchant type; When the payment amount is greater than or equal to the first limit parameter and / or greater than or equal to the second limit parameter, intervention is triggered.

4. The real-time transaction fraud intelligent monitoring and efficient interception system as claimed in claim 3, characterized in that: When the payment amount is greater than or equal to the first limit parameter, the intervention strategy includes: outputting a prompt message to the payee and / or receiving a limit release verification from the payee; When the payment amount is greater than or equal to the second limit parameter, the intervention strategy includes: outputting a prompt message to the payer and / or receiving the limit release verification of the payee.

5. The real-time transaction fraud intelligent monitoring and efficient interception system as claimed in claim 2, characterized in that: When the type of real-time transaction is a payment that is previously verified by the payer, the monitoring strategy includes: Determine the type of payee; When the payee is a fixed merchant, determine the distance between the payee and the fixed merchant; when the distance is greater than a preset first distance threshold, trigger intervention; The intervention strategy includes: outputting prompt information to the payer and / or receiving the payer's release verification.

6. The real-time transaction fraud intelligent monitoring and efficient interception system as claimed in claim 2, characterized in that: When the type of real-time transaction is a payment that is previously verified by the payer, the monitoring strategy includes: Determine the type of payee; When the payee is an individual, determine the payment scenario; When the payment scenario is offline payment, determine whether the payment amount is set during verification; if not, analyze the payer's offline payment history with the individual and the configured limit threshold to determine the third limit parameter; when the payment amount is greater than or equal to the third limit parameter, trigger intervention; The intervention strategy includes: outputting prompt information to the payer and / or receiving the payer's release verification.

7. The real-time transaction fraud intelligent monitoring and efficient interception system according to claim 2, characterized in that: When the type of real-time transaction is a payment that is previously verified by the payer, the monitoring strategy includes: Determine the type of payee; When the payee is an individual, determine the payment scenario; When the payment scenario is online payment, determine whether the payment amount is set during verification; if not, trigger intervention; When set, determines whether the payee and the payer are contacts; if not, triggers intervention; If yes, analyze the historical interaction records between the payee and the payer to determine the reference amount; when the reference amount does not match the payment amount, trigger intervention; When the payee is a marked person, intervention is triggered; When historical interaction records trigger pre-configured intervention events, intervention is triggered.

8. The real-time transaction fraud intelligent monitoring and efficient interception system according to claim 2, characterized in that: When the type of real-time transaction is a payment that is previously verified by the payer, the monitoring strategy also includes: Whether the payer has performed a prior verification within a preset time before the transaction time and whether the distance between the location where the prior verification occurred and the location where the payment occurred is greater than a preset second distance threshold; When no prior verification is performed and / or the distance between the location where the prior verification occurs and the location where the payment occurs is greater than a preset second distance threshold, the intervention is triggered; The intervention strategies include: outputting prompt information to the payer, receiving the payer's verification of release, changing to delayed payment, or one or more combinations thereof.

9. The real-time transaction fraud intelligent monitoring and efficient interception system according to claim 2, characterized in that: When the type of real-time transaction is a payment verified by the payer later, the monitoring strategy includes: Determine the type of payee; When the payee is a fixed merchant, determine the payment scenario; When the payment scenario is offline payment, determine the movement trajectory of the payer while staying on the payment interface; When the movement trajectory is far away from the cashier area of ​​a fixed merchant, intervention is triggered; The intervention strategy includes: outputting a prompt message to the payee and / or receiving the release verification of the payee.

10. The real-time transaction fraud intelligent monitoring and efficient interception system according to claim 1, characterized in that: Also includes: Image analysis module and payment request query module; The image analysis module identifies whether there is a preset payment action by analyzing the image captured by the image acquisition unit configured to capture the image of the cashier area of ​​the fixed merchant; When it exists, the payment request query module determines whether there is a payment request with the fixed merchant as the payment object within a preset time interval; When there is no payment request with a fixed merchant as the payment object, the intervention module issues a reminder through a reminder device associated with the image acquisition unit.

Images