Payment security identification system of payment terminal

Abstract

The invention relates to the technical field of financial science and technology and information security, in particular to a payment security identification system of a payment terminal, which comprises a transaction data acquisition module used for acquiring transaction request data of a current transaction; the basic risk assessment module is based on the transaction request data and user historical data; the dynamic environment risk assessment module is used for requesting data based on the transaction; the dynamic threshold generation module is used for generating a dynamic environment risk index; according to the system and the method, the user long-term behavior risk and the transaction instantaneous environment risk are decoupled and innovatively combined, the evolution of a user behavior mode can be adapted, novel fraud attacks can be resisted, and interference to normal user transactions is reduced while safety is guaranteed.

Description

Technical Field

[0001] This invention relates to the fields of financial technology and information security technology, specifically to a payment security identification system for a payment terminal. Background Technology

[0002] With the advancement of globalization, cross-border e-commerce and peer-to-peer transfers are becoming increasingly common, exhibiting significant characteristics of small amounts and high frequency. Traditional payment security systems typically rely on fixed rule bases or static risk models when processing such transactions, which has significant drawbacks:

[0003] Traditional models focus primarily on the transaction itself and user history, but they fail to adequately consider dynamic risk factors such as the device and network environment at the time of the transaction. Fraudsters may simulate normal user behavior but launch attacks in a high-risk device environment, making it difficult for traditional methods to effectively detect them.

[0004] Therefore, how to design a payment security identification system that can dynamically adapt to changes in user behavior patterns and transaction environment is a technical problem that urgently needs to be solved in the current cross-border payment field. Summary of the Invention

[0005] The purpose of this invention is to provide a payment security identification system for payment terminals, which solves the problems existing in the background art.

[0006] To address the aforementioned technical problems, this invention provides a payment security identification system for a payment terminal, comprising:

[0007] The transaction data acquisition module is used to acquire the transaction request data of the current transaction and retrieve the user's historical data and preset risk parameters corresponding to the transaction request data;

[0008] The basic risk assessment module is used to generate a basic risk score that characterizes the rationality of user behavior and geographical location based on the transaction request data and the user's historical data.

[0009] The dynamic environmental risk assessment module is used to generate a dynamic environmental risk index based on the transaction request data and a preset environmental risk feature weight.

[0010] The dynamic threshold generation module is used to generate the dynamic decision threshold for the current transaction based on the dynamic environmental risk index, a preset initial benchmark threshold, and a risk adjustment coefficient.

[0011] The security decision module is used to compare the basic risk score with the dynamic decision threshold, and output a payment security decision instruction for the current transaction according to preset decision rules.

[0012] Preferably, the basic risk assessment module includes:

[0013] Calculate the consistency index of users' historical behavior;

[0014] Calculate the geographic location correlation score;

[0015] The basic risk score is generated by combining the user's historical behavior consistency index with the geographic location correlation score.

[0016] Preferably, the calculation of the user's historical behavior consistency index includes:

[0017] Based on the transaction request data and the user's historical data, calculate the amount deviation of the current transaction;

[0018] Based on the transaction request data and the user's historical data, calculate the frequency deviation of the current transaction;

[0019] Calculate the time deviation of the current transaction based on the transaction request data and the user's historical data;

[0020] The amount deviation, frequency deviation, and time deviation are normalized to obtain normalized deviation values.

[0021] The normalized deviation values ​​are weighted and summed according to preset behavioral dimension weights to generate the user's historical behavior consistency index.

[0022] Preferably, the calculation of the geographic location correlation score includes:

[0023] Calculate the shortest distance between the current transaction location and the user's secure geofence;

[0024] Calculate the transfer speed between the current transaction and the previous transaction;

[0025] Based on the transfer speed and a preset speed threshold, a speed anomaly marker is determined;

[0026] By combining the shortest distance with the speed anomaly marker, and based on preset distance parameters, a geographic location correlation score is generated.

[0027] Preferably, the step of generating the basic risk score by combining the user's historical behavior consistency index with the geographic location correlation score includes:

[0028] The geographic location correlation score is converted into a geographic location risk metric.

[0029] Based on preset weighting coefficients, the user's historical behavior consistency index and the geographic location risk measure are weighted and summed to generate the basic risk score.

[0030] Preferably, the dynamic environmental risk assessment module includes:

[0031] For each of the preset environmental risk types, the corresponding environmental risk feature flags are extracted from the transaction request data.

[0032] The multiple environmental risk feature flags are weighted and summed according to their respective preset risk weights to generate the dynamic environmental risk index.

[0033] Preferably, the dynamic threshold generation module includes:

[0034] An exponential decay function is used to calculate the decay of the initial benchmark threshold based on the dynamic environmental risk index and the risk adjustment coefficient, thereby generating the dynamic decision threshold.

[0035] Preferably, the security decision module includes:

[0036] If the basic risk score is not greater than the dynamic decision threshold, then an instruction to accept the transaction is output.

[0037] If the basic risk score is greater than the dynamic decision threshold but less than the initial benchmark threshold, then a decision instruction for manual review is output.

[0038] If the basic risk score is greater than or equal to the initial benchmark threshold, a decision instruction to reject the transaction is output.

[0039] This invention provides a payment security identification system for payment terminals, which has the following advantages:

[0040] (1) It achieves more precise and personalized risk assessment, significantly reducing the misjudgment rate of normal transactions. The basic risk assessment module in this solution calculates the consistency index of users' historical behavior and establishes a personalized behavioral baseline based on the user's own historical data. This design makes risk assessment no longer based on a general template, but on individual profiles, which improves the tolerance for complex behavioral patterns of normal users and significantly reduces misjudgment.

[0041] (2) A dynamic perception and adaptive decision-making capability for the trading environment has been constructed. This solution introduces a dynamic environmental risk assessment module to independently assess the security of the trading environment and generate a dynamic environmental risk index. This enables the system's defense capability to change dynamically with environmental risks, being lenient when the environment is safe and strict when the environment is harsh, achieving adaptability and security that static models cannot match.

[0042] (3) It opens up a completely new dimension of confrontation, and has a strong resistance to new fraud attacks that use technical means to disguise themselves. By introducing a dynamic environmental risk assessment module, this solution essentially adds a new dimension of confrontation, namely the device and network environment, which is difficult for fraudsters to perfectly forge. This solution can accurately capture abnormal signals at these environmental levels and directly affect the final decision threshold, accurately isolate transactions that have been upgraded due to environmental risks, effectively intercept potential fraud, and give legitimate users the opportunity to clarify and complete transactions, thus achieving a better balance between security control and user experience. Attached Figure Description

[0043] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 This is a logic block diagram of the system of the present invention;

[0045] Figure 2 This is a logic block diagram of the basic risk assessment module of the present invention;

[0046] Figure 3 This is a logic block diagram for calculating the consistency index of user historical behavior in this invention;

[0047] Figure 4 This is a logic diagram for calculating the geographic location correlation score in this invention. Detailed Implementation

[0048] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0049] Example 1

[0050] Please see Figure 1 This invention provides a payment security identification system for a payment terminal, comprising:

[0051] The transaction data acquisition module is used to acquire the transaction request data of the current transaction, and retrieve the user's historical data and preset risk parameters corresponding to the transaction request data;

[0052] The basic risk assessment module is used to generate a basic risk score that represents the rationality of user behavior and geographical location based on transaction request data and user historical data.

[0053] The dynamic environmental risk assessment module is used to generate a dynamic environmental risk index based on transaction request data and preset environmental risk feature weights.

[0054] The dynamic threshold generation module is used to generate the dynamic decision threshold for the current transaction based on the dynamic environmental risk index, a preset initial benchmark threshold, and a risk adjustment coefficient.

[0055] The security decision module compares the basic risk score with the dynamic decision threshold and outputs a payment security decision instruction for the current transaction based on preset decision rules.

[0056] This technical solution provides a payment security identification system for payment terminals, deployed on a payment backend server. When a payment terminal initiates a request, the transaction data acquisition module first captures transaction information, including user ID, amount, device fingerprint, network information, and geographic coordinates. It then retrieves user behavior pattern data and preset risk parameters from a historical database. The system concurrently launches a basic risk assessment module and a dynamic environment risk assessment module to handle risks in the user behavior dimension and transaction environment dimension, respectively. The assessment results of these two dimensions are fed as input to a dynamic threshold generation module to produce a decision threshold customized for the current transaction. The security decision module adjudicates the basic risk based on this dynamic threshold. By decoupling and innovatively combining long-term user behavior risks with instantaneous transaction environment risks, this system can adapt to the evolution of user behavior patterns and resist new types of fraud attacks, ensuring security while reducing interference with normal user transactions.

[0057] Example 2

[0058] Please see Figure 2 The basic risk assessment module includes:

[0059] Calculate the consistency index of users' historical behavior;

[0060] Calculate the geographic location correlation score;

[0061] A basic risk score is generated by combining the consistency index of users' historical behavior with the correlation score of geographical location.

[0062] Please see Figure 3 Calculate the consistency index of user's historical behavior, including:

[0063] Calculate the amount deviation of the current transaction based on transaction request data and user historical data;

[0064] Calculate the frequency deviation of the current transaction based on transaction request data and user historical data;

[0065] Calculate the time deviation of the current transaction based on transaction request data and user historical data;

[0066] The amount deviation, frequency deviation, and time deviation are normalized to obtain the normalized deviation value.

[0067] The normalized deviation values ​​are weighted and summed according to the preset behavioral dimension weights to generate a user historical behavior consistency index.

[0068] To generate a preliminary transaction risk profile, the basic risk assessment module first conducts a quantitative analysis of the user's inherent behavioral patterns. By calculating the consistency index of the user's historical behavior, it characterizes the degree of deviation between the current transaction and the user's established behavioral patterns. The underlying logic of this index is that the transaction behavior of legitimate users usually exhibits significant stability and regularity.

[0069] The user history behavior consistency index is defined by the following formula:

[0070] I UBC =w A ·N(D A )+w F ·N(D F )+w T ·N(D T )

[0071] Among them, I UBC The consistency index of user's historical behavior is a dimensionless comprehensive risk indicator in the range of [0,1]. The larger the value, the worse the consistency between the current transaction and the historical behavior.

[0072] D A This represents the absolute deviation between the current transaction amount and the user's historical average transaction amount, and its calculation formula is D. A =|A cur -A hist |, where A cur For the current transaction amount, A hist This is the arithmetic average of all small transactions made by the user over a specific period (e.g., 90 days).

[0073] D F This indicates the deviation of the current trading frequency from the user's historical normal trading frequency pattern. It is calculated by first counting the number of transactions made by the user in all 24-hour sliding windows over a specific period (e.g., 180 days), forming a historical frequency distribution. Then, a high quantile (e.g., the 95th percentile) of this distribution is determined as the frequency threshold F. threshold_hist The frequency deviation is then calculated as D.F =max(0,F cur_24h -F threshold_hist ), where F cur_24h It represents the total number of transactions within 24 hours prior to the point in time when the payment request occurred;

[0074] D T This indicates the degree of deviation between the current transaction time and the user's historical core active periods. It is implemented by identifying the user's main transaction time clusters in history as core active periods based on clustering algorithms such as Gaussian mixture model (for example, the optimal number of clusters can be determined by the BIC criterion), and then calculating the number of hours between the current transaction time and the center point of the nearest core active period.

[0075] w A ,w F ,w T These are dimensionless weighting coefficients, representing the importance of the three dimensions: amount, frequency, and time. The sum of these three is 1. These weights can be set based on statistical analysis of historical fraud cases or by using the feature importance output by machine learning models such as logistic regression and random forest, in order to maximize the model's discriminative power.

[0076] The system calculates I in real time each time a transaction request is processed. UBC The value can deeply and individually depict the unique trading rhythm of each user, thus effectively avoiding the misjudgment problem caused by rigid rules in traditional risk control systems that treat all late-night transactions as high-risk.

[0077] Example 3

[0078] Please see Figure 4 Calculate the geographic location correlation score, including:

[0079] Calculate the shortest distance between the current transaction location and the user's secure geofence;

[0080] Calculate the transfer speed between the current transaction and the previous transaction;

[0081] Based on the transfer speed and a preset speed threshold, a speed anomaly marker is determined;

[0082] By combining the shortest distance and velocity anomaly markers, a geographic location correlation score is generated based on preset distance parameters.

[0083] A basic risk score is generated by combining the consistency index of users' historical behavior with the correlation score of geographical location, including:

[0084] Convert geographic location correlation scores into geographic location risk measures;

[0085] Based on preset weighting coefficients, the user's historical behavior consistency index and geographical location risk measurement are weighted and summed to generate a basic risk score.

[0086] While calculating the consistency index of users' historical behavior, the basic risk assessment module simultaneously initiates a risk assessment of the geographical location dimension, aiming to quantify the physical rationality of the transaction location.

[0087] The geographic location correlation score is generated by the following formula:

[0088]

[0089] Among them, S GLC This represents the geographic location correlation score, which is a dimensionless value in the range [0,1]. The lower the value, the worse the geographic location correlation.

[0090] d min Represents the current trading position P cur Center point C of all known "secure geofences" for this user i The shortest straight-line distance between them, i.e.

[0091] C i This represents the center coordinates of the user's i-th secure geofence. This data is continuously and automatically generated and updated by the backend system through DBSCAN density clustering algorithm analysis of all the user's transaction GPS coordinates within a specific past period. To accommodate the activity range of different users, the neighborhood radius ∈ of the DBSCAN algorithm can be set to an empirical value, and the minimum number of samples MinPts can be set to a small integer;

[0092] d max A preset distance threshold is used to define the upper limit of normal travel distance, such as 50 kilometers in urban commuting scenarios;

[0093] α is a dimensionless distance decay exponent greater than 1, used to non-linearly adjust the effect of distance on the score, and its optimal value can be determined by grid search on the historical validation set.

[0094] V flag It is a binary velocity anomaly marker with a value of 0 or 1, and its determination logic is: calculate the current transaction position P. cur Position P of the previous transaction last Transfer speed between If the speed v exceeds the speed limit threshold V set based on common sense physics. limit (For example, 1000 km / h, slightly higher than the cruising speed of a commercial airliner), would be considered a physically impossible "teleportation," in which case V flagIf forced to be set to 0, otherwise set to 1, this parameter has a veto effect on the scoring results.

[0095] Based on the above calculation results, the basic risk assessment module uses the following formula to calculate the user's historical behavior consistency index I. UBC Geographical relevance score S GLC The calculation results are integrated to output a unified basic risk score:

[0096] R Base =w UBC ·I UBC +w GLC ·(1-S GLC )

[0097] Among them, R Base It is the dimensionless basic risk score of the final output; (1-S GLC The calculation of the positive safety index S) GLC Convert to I UBC Risk measurement in the same direction; w UBC and w GLC These are the dimensionless weighting coefficients assigned to the two dimensions of user behavior and geographic location, and w UBC +w GLC =1.

[0098] The basic risk score is generated by combining the user's historical behavior consistency index with the geographic location correlation score. The specific steps are as follows:

[0099] The geographic location correlation score S GLC Converted to a consistency index with user's historical behavior I UBC Same-direction geographic location risk measure R GLC The conversion formula is:

[0100] R GLC =1-S GLC

[0101] Based on preset weighting coefficients, the user's historical behavior consistency index and the geographic location risk measure are weighted and summed to generate the basic risk score R. Base The calculation formula is:

[0102] R Base =w UBC ·I UBC +w GLC ·R GLC

[0103] Among them, R Base It is the final output, a dimensionless basic risk score; w UBC and w GLCThese are the dimensionless weighting coefficients assigned to the two dimensions of user behavior and geographic location, and w UBC +w GLC =1.

[0104] This synthesis step provides a comprehensive baseline risk profile that does not yet take into account environmental factors, offering a clear and quantifiable basis for subsequent decision-making.

[0105] Example 4

[0106] The dynamic environmental risk assessment module includes:

[0107] For each of the preset environmental risk types, the corresponding environmental risk feature flags are extracted from the transaction request data.

[0108] Multiple environmental risk characteristic markers are weighted and summed according to their respective preset risk weights to generate a dynamic environmental risk index.

[0109] The dynamic environment risk assessment module operates independently of user behavior assessment, focusing on analyzing the inherent instantaneous risks of the device and network environment at the moment the transaction occurs. Its underlying logic is that the technical environment relied upon by fraudsters when launching attacks often exhibits characteristics drastically different from those of legitimate users.

[0110] This module generates a dynamic environmental risk index by weighted summation of a series of environmental risk characteristics. The calculation formula is as follows:

[0111]

[0112] Among them, I DER Represents the dynamic environmental risk index, which is an unbounded, dimensionless positive number. The higher the value, the greater the risk of the trading environment; n is the total number of preset environmental risk characteristics; f i The flag bit representing the i-th environmental risk feature is a binary value of 0 or 1. The value is 1 when the risk feature is detected and 0 when it is not detected. These features include, but are not limited to: first use of the device, device tampering, use of a proxy or VPN, use of an emulator, mismatch between the device time zone and the GPS positioning time zone, and abnormal browser or application.

[0113] w i The dimensionless risk weight represents the i-th environmental risk feature, and its magnitude reflects the strength of the association between this feature and fraud events. One method to determine this weight is to calculate the fraud boosting degree of each feature, i.e. The formula calculates the existence characteristic f. i The probability of fraud occurring in a particular transaction is a multiple of the overall probability of fraud in transactions. These weights should be updated periodically based on the latest fraud intelligence and data.

[0114] This module has the ability to identify deepfakes. Even if a transaction's user behavior and geographic location profile are completely normal, if it was initiated in a high-risk environment, the system will calculate a higher I0. DER This value provides crucial input for dynamically adjusting decision thresholds, thereby revealing potential risks behind seemingly normal transactions.

[0115] Example 5

[0116] The dynamic threshold generation module includes:

[0117] An exponential decay function is used to calculate the decay of the initial baseline threshold based on the dynamic environmental risk index and risk adjustment coefficient, thereby generating a dynamic decision threshold.

[0118] The dynamic threshold generation module no longer uses fixed risk thresholds, but instead generates a unique decision threshold for each transaction in real time. The technical motivation behind this is that when the environmental risk is high, the decision threshold should be more stringent, and vice versa, thereby achieving a dynamic balance between security and user experience.

[0119] This module generates a dynamic decision threshold using an exponential decay function, as shown in the following formula:

[0120]

[0121] Among them, T Dynamic This is the final generated score used in conjunction with the base risk score R. Base The dimensionless dynamic decision threshold for comparison;

[0122] T Initial This is an initial baseline threshold, a global, dimensionless parameter set by the risk strategy department based on overall risk appetite and business objectives. It represents the risk level at zero environmental risk, i.e., I... DER The decision-making standard line under the ideal scenario of 0;

[0123] I DER It is the output of the dynamic environmental risk assessment module, which serves as the adjustment input signal for this formula;

[0124] λ is a key dimensionless risk adjustment coefficient. Its value controls the adjustment of environmental risk to the initial threshold. The optimal balance point can be found by conducting simulation tests on historical datasets and analyzing ROC curves or Precision-Recall curves under different λ values.

[0125] Choosing an exponential decay function ensures that when I DER When T = 0, Dynamic =T Initial, when I DER When >0, T Dynamic <T Initial , and I DER The larger T is Dynamic The rate of decrease is faster, but it remains greater than 0.

[0126] This design endows decision-making criteria with the ability to perceive the context, ensuring that the scale of risk decisions can adaptively scale according to the level of risk in the environment.

[0127] Example 6

[0128] The security decision module includes:

[0129] If the basic risk score is not greater than the dynamic decision threshold, then output the decision instruction to accept the transaction;

[0130] If the basic risk score is greater than the dynamic decision threshold but less than the initial baseline threshold, then a decision instruction requiring further verification is output.

[0131] If the basic risk score is greater than or equal to the initial benchmark threshold, a decision instruction to reject the transaction will be output.

[0132] The final payment security decision module is responsible for executing the final decision-making logic. This module receives the basic risk score R. Base and dynamic decision threshold T Dynamic Then, a judgment is made based on the following three-level decision-making rules:

[0133] Rule 1, if R Base ≤T Dynamic The system determines that the transaction is low-risk and outputs a "accept transaction" decision instruction;

[0134] Rule 2, if T Initial >R Base >T Dynamic This condition reveals a specific risk signal: the basic risk of the transaction itself is within the acceptable initial threshold, but due to the risk of the transaction environment, the decision threshold is lowered, causing the basic risk score to cross this tightened defense line. The system judges such transactions as medium risk or suspicious and outputs decision instructions that require further verification, such as triggering secondary identity verification or entering the manual review process.

[0135] Rule 3, if R Base ≥T Initial This indicates that regardless of the trading environment, the transaction itself has presented an unacceptably high risk. The system judges it as a high-risk transaction and outputs a "reject transaction" decision instruction.

[0136] This three-stage decision-making logic can accurately capture and isolate transactions that escalate due to environmental risks. By introducing a buffer mechanism, it can effectively intercept potential fraud while giving legitimate users the opportunity to complete transactions, thereby improving the accuracy of risk management and user experience.

[0137] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A payment security identification system for a payment terminal, characterized in that, include: The transaction data acquisition module is used to acquire the transaction request data of the current transaction and retrieve the user's historical data and preset risk parameters corresponding to the transaction request data; The basic risk assessment module is used to generate a basic risk score that characterizes the rationality of user behavior and geographical location based on the transaction request data and the user's historical data. The dynamic environmental risk assessment module is used to generate a dynamic environmental risk index based on the transaction request data and a preset environmental risk feature weight. The dynamic threshold generation module is used to generate the dynamic decision threshold for the current transaction based on the dynamic environmental risk index, a preset initial benchmark threshold, and a risk adjustment coefficient. The security decision module is used to compare the basic risk score with the dynamic decision threshold, and output a payment security decision instruction for the current transaction according to preset decision rules.

2. The payment security identification system for a payment terminal according to claim 1, characterized in that, The basic risk assessment module includes: Calculate the consistency index of users' historical behavior; Calculate the geographic location correlation score; The basic risk score is generated by combining the user's historical behavior consistency index with the geographic location correlation score.

3. The payment security identification system for a payment terminal according to claim 2, characterized in that, The calculation of the user's historical behavior consistency index includes: Based on the transaction request data and the user's historical data, calculate the amount deviation of the current transaction; Based on the transaction request data and the user's historical data, calculate the frequency deviation of the current transaction; Calculate the time deviation of the current transaction based on the transaction request data and the user's historical data; The amount deviation, frequency deviation, and time deviation are normalized to obtain normalized deviation values. The normalized deviation values ​​are weighted and summed according to preset behavioral dimension weights to generate the user's historical behavior consistency index.

4. The payment security identification system for a payment terminal according to claim 2, characterized in that, The calculation of the geographic location correlation score includes: Calculate the shortest distance between the current transaction location and the user's secure geofence; Calculate the transfer speed between the current transaction and the previous transaction; Based on the transfer speed and a preset speed threshold, a speed anomaly marker is determined; By combining the shortest distance with the speed anomaly marker, and based on preset distance parameters, a geographic location correlation score is generated.

5. A payment security identification system for a payment terminal according to claim 2, characterized in that, The process of generating the basic risk score by combining the user's historical behavior consistency index with the geographic location correlation score includes: The geographic location correlation score is converted into a geographic location risk metric. Based on preset weighting coefficients, the user's historical behavior consistency index and the geographic location risk measure are weighted and summed to generate the basic risk score.

6. The payment security identification system for a payment terminal according to claim 1, characterized in that, The dynamic environmental risk assessment module includes: For each of the preset environmental risk types, the corresponding environmental risk feature flags are extracted from the transaction request data. The multiple environmental risk feature flags are weighted and summed according to their respective preset risk weights to generate the dynamic environmental risk index.

7. A payment security identification system for a payment terminal according to claim 1, characterized in that, The dynamic threshold generation module includes: An exponential decay function is used to calculate the decay of the initial benchmark threshold based on the dynamic environmental risk index and the risk adjustment coefficient, thereby generating the dynamic decision threshold.

8. A payment security identification system for a payment terminal according to claim 1, characterized in that, The security decision module includes: If the basic risk score is not greater than the dynamic decision threshold, then an instruction to accept the transaction is output. If the basic risk score is greater than the dynamic decision threshold but less than the initial baseline threshold, then a decision instruction requiring further verification is output. If the basic risk score is greater than or equal to the initial benchmark threshold, a decision instruction to reject the transaction is output.

Images