Transaction detection method and device, electronic equipment, storage medium and program product

Abstract

The invention discloses a transaction detection method and device, electronic equipment, a storage medium and a program product, which are applied to the technical field of transaction detection, and the method comprises the following steps: obtaining transaction information of a current transaction; acquiring position information of a transaction subject and position information of a transaction opponent from the transaction information; under the condition that the position information of the transaction opponent cannot be obtained from the transaction information, the position information of the transaction opponent is determined based on at least one of the first mapping relation table and the second mapping relation table; based on the position information of the transaction subject and the position information of the transaction opponent, determining whether the transaction is a remote transaction; and through a real-time calculation engine, based on the transaction information and the target database, determining whether the transaction is a stranger transaction. The success rate of abnormal transaction identification is improved, and stranger transaction identification can be carried out in real time in the transaction process.

Description

Technical Field

[0001] This application belongs to the field of transaction detection technology, and in particular relates to a transaction detection method, apparatus, electronic device, storage medium and program product. Background Technology

[0002] Currently, banks and financial institutions face increasingly severe challenges in the areas of anti-fraud and risk control, especially regarding suspicious transactions between unfamiliar counterparties in different locations. These transactions are often accompanied by higher security risks.

[0003] Traditional risk control methods cannot make real-time judgments on transactions with unfamiliar counterparties during the transaction process, and when making judgments on transactions in different locations, there is a problem that the location information of both parties to the transaction cannot be obtained, which leads to the failure of the judgment on transactions in different locations. Summary of the Invention

[0004] This application provides a transaction detection method, apparatus, electronic device, storage medium, and program product, which can improve the success rate of abnormal transaction identification and enable real-time identification of stranger transactions during the transaction process, thereby effectively improving the efficiency of risk control.

[0005] In a first aspect, embodiments of this application provide a transaction detection method, including: Obtain transaction information for this transaction; Obtain the location information of the trading entity and the counterparty from the transaction information; In the absence of the location information of the counterparty from the transaction information, the location information of the counterparty is determined based on at least one of the first mapping relationship table and the second mapping relationship table; wherein, the first mapping relationship table is used to indicate the correspondence between the issuing bank identification code (BIN) of the transaction card and the account opening institution information, and the second mapping relationship table is used to indicate the correspondence between the corporate account and the account opening institution information. Based on the location information of the transaction entity and the counterparty, determine whether this transaction is a cross-regional transaction; The real-time computing engine determines whether the transaction is a transaction between strangers based on transaction information and the target database. The target database is pre-built based on the historical transaction information of the first transaction card, which is the transaction card used by the transaction subject in this transaction.

[0006] In some possible implementations, the location information of the trading entity and the counterparty is obtained from the transaction information, including: Obtain the information of the first account opening institution corresponding to the transaction entity from the transaction information; The first province code in the first account opening institution information is determined as the location information of the transaction entity; Obtain information on the second account opening institution corresponding to the counterparty from the transaction information; If the information of the second account opening institution is obtained, the second province code in the information of the second account opening institution will be identified as the location information of the counterparty. If the information of the second account opening institution cannot be obtained, it is determined that the location information of the counterparty cannot be obtained from the transaction information.

[0007] In some possible implementations, the location information of the counterparty is determined based on at least one of the first mapping table and the second mapping table, including: Obtain the Bank Identification Number (BIN) of the second transaction card from the transaction information. The second transaction card is the transaction card used by the counterparty in this transaction. If the BIN of the second transaction card is obtained, the target account opening institution information corresponding to the BIN is obtained from the first mapping relationship table; The province code in the target account opening institution information is used to determine the location information of the counterparty.

[0008] In some possible implementations, the location information of the counterparty is determined based on at least one of the first mapping table and the second mapping table, including: If the location information of the counterparty cannot be determined based on the first mapping table, the account name of the counterparty is obtained from the transaction information. Retrieve the target account opening institution information corresponding to the account name from the second mapping table; The province code in the target account opening institution information is used to determine the location information of the counterparty.

[0009] In some possible implementations, determining whether a transaction is a cross-regional transaction is based on the location information of the transacting parties and their counterparties, including: Determine whether the location information of the main trading entity and the counterparty are consistent; If the location information of the transacting entity and the location information of the transacting counterparty are consistent, it is determined that this transaction is not a cross-regional transaction; If the location information of the transacting entity and the location information of the transacting counterparty are inconsistent, the transaction is determined to be a cross-regional transaction.

[0010] In some possible implementations, the target database includes the account names of those who have transacted with the first transaction card; a real-time computing engine, based on transaction information and the target database, determines whether the current transaction is a transaction between strangers, including: Obtain the counterparty's account name from the transaction information; Query the target database to determine if a target account name matching the account name exists in the target database; If a target account name matching the account name exists in the target database, this transaction is determined to be a transaction between a non-stranger and a real person. If no matching target account name exists in the target database, the transaction is determined to be a stranger transaction.

[0011] In some possible implementations, before determining that the transaction is a stranger transaction if the target account name does not exist in the target database, the method also includes: Determine whether there is a pre-existing relationship between the trading entity and its counterparty; In cases where a pre-existing relationship exists between the transacting parties and their counterparties, this transaction is determined to be a transaction between non-strangers. If no matching target account name exists in the target database, this transaction is determined to be a transaction between strangers, including: If no target account name matching the account name exists in the target database, and there is no pre-defined relationship between the transaction entity and the counterparty, the transaction is determined to be a stranger transaction.

[0012] Among some possible implementations, the method also includes: Based on the detection results and rule model, it is determined whether this transaction meets the interception trigger conditions; the detection results are used to indicate whether this transaction is a cross-regional transaction and whether this transaction is a transaction between strangers, and the rule model includes the relevant rules for triggering interception; If the conditions for interception are met, this transaction will be intercepted.

[0013] Secondly, embodiments of this application provide a transaction detection device, comprising: The data acquisition module is used to obtain transaction information for this transaction; The cross-regional transaction detection module is used to obtain the location information of the transaction entity and the counterparty from the transaction information; The cross-regional transaction judgment module is also used to determine the location information of the counterparty based on at least one of the first mapping relationship table and the second mapping relationship table when the counterparty's location information cannot be obtained from the transaction information; wherein, the first mapping relationship table is used to indicate the correspondence between the issuing bank identification code (BIN) of the transaction card and the account opening institution information, and the second mapping relationship table is used to indicate the correspondence between the corporate account and the account opening institution information. The cross-regional transaction judgment module is also used to determine whether a transaction is a cross-regional transaction based on the location information of the transaction subject and the location information of the transaction counterparty; The stranger transaction judgment module is used to determine whether a transaction is a stranger transaction based on transaction information and a target database through a real-time computing engine. The target database is pre-built based on the historical transaction information of the first transaction card, which is the transaction card used by the transaction subject in this transaction.

[0014] Thirdly, embodiments of this application provide an electronic device, which includes: The processor and the memory storing computer program instructions; the processor implements the transaction detection method of the first aspect mentioned above when executing the computer program instructions.

[0015] Fourthly, embodiments of this application provide a computer storage medium on which computer program instructions are stored, and when the computer program instructions are executed by a processor, the transaction detection method of the first aspect described above is implemented.

[0016] Fifthly, embodiments of this application provide a computer program product in which instructions, when executed by the processor of an electronic device, enable the electronic device to perform the transaction detection method described in the first aspect.

[0017] In this embodiment, transaction information is obtained, including the location information of the transacting entity and the counterparty. If the counterparty's location information cannot be obtained from the transaction information, it is determined based on at least one of a first mapping table and a second mapping table. Based on the location information of the transacting entity and the counterparty, it is determined whether the transaction is a cross-regional transaction. Finally, through a real-time computing engine, based on the transaction information and a target database, it is determined whether the transaction is a transaction between strangers. According to this embodiment, the success rate of abnormal transaction identification can be improved, and real-time identification of transactions between strangers can be performed during the transaction process, thereby effectively improving the efficiency of risk control. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart illustrating a transaction detection method provided in one embodiment of this application; Figure 2 This is a flowchart illustrating a transaction detection method provided in another embodiment of this application; Figure 3 This is a flowchart illustrating a transaction detection method provided in yet another embodiment of this application; Figure 4 This is a schematic diagram of the structure of a transaction detection device provided in one embodiment of this application; Figure 5 This is a schematic diagram of the structure of an electronic device provided in one embodiment of this application. Detailed Implementation

[0020] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0021] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0022] It should be noted that the acquisition, storage, use, and processing of data in this application embodiment all comply with the relevant provisions of national laws and regulations.

[0023] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0024] Banks' anti-fraud risk control focuses on transactions with strangers in different locations due to the multiple risks involved. First, such transactions may indicate that the cardholder is not operating the account, for example, a stolen card being used fraudulently across regions. Second, these transactions often lack historical correlation and are commonly seen in scenarios involving induced transfers. Malicious individuals can purchase personal information to open accounts in different locations, exploiting geographical distance to interfere with the bank's routine behavioral model identification. By monitoring the real-time location of transaction IPs / devices and combining this with abnormal fluctuations in transaction frequency and amount, banks can quickly intercept high-risk operations, forming a crucial dimension for establishing an abnormal behavior baseline in their risk control systems.

[0025] Traditional methods for identifying cross-regional transactions between strangers involve processing batches of data after the transaction is completed, representing a post-transaction risk management approach. Post-transaction remediation aims to correct completed transactions, but once a risk event occurs, funds may have already been transferred or spent, making recovery extremely difficult. Therefore, traditional solutions cannot promptly prevent high-risk transactions. Furthermore, traditional risk control strategies struggle to obtain the location information of both parties involved in the transaction, leading to potential failures in identifying cross-regional transactions.

[0026] To address the problems of the prior art, embodiments of the present invention provide a transaction detection method, apparatus, electronic device, storage medium, and program product.

[0027] The transaction detection method provided in the embodiments of the present invention will be introduced first below.

[0028] Figure 1 A schematic flowchart of a transaction detection method according to an embodiment of the present invention is shown. Figure 1 As shown, the method may include the following steps: Step 110. Obtain the transaction information for this transaction.

[0029] The transaction detection method provided in this application embodiment can be executed by a transaction detection device. The transaction detection device can obtain the transaction information of the current transaction (i.e., the current transaction) sent by the upstream system when a transaction is conducted in the upstream system. The upstream system is either a front-end system of the transaction detection device or a data source. For example, the upstream system can be a core banking system, a payment channel system, a transaction processing engine, or a payment gateway. The core banking system is the core accounting system that handles basic financial transactions such as deposits, loans, and transfers. Payment channel systems include online banking, mobile banking, ATMs, POS systems, and third-party payment interfaces, which are the direct points of contact for initiating and receiving transactions. The transaction processing engine or payment gateway is the system responsible for transaction routing and distributing clearing instructions.

[0030] Once a transaction (such as a transfer) is initiated through the channel, it first undergoes basic verification and processing by the upstream system, generating a transaction log containing key information. Based on this transaction log, the upstream system sends the transaction information to the transaction detection device.

[0031] In some embodiments of this application, the transaction information includes account information of the transacting party and counterparty, transaction time, transaction amount, etc. The transacting party refers to the account holder initiating the transaction, i.e., the payer. The transacting counterparty refers to the recipient of the transaction, i.e., the payee.

[0032] Step 120. Obtain the location information of the trading entity and the counterparty from the transaction information.

[0033] In some embodiments of this application, a cross-regional transaction refers to a transaction in which the two parties are not located in the same geographical area, i.e., a cross-regional transaction, such as a cross-provincial transaction. To determine whether a transaction is a cross-regional transaction, the location information of the transaction entity and the counterparty are obtained separately, and the determination of whether the transaction is a cross-regional transaction is based on the location information of both. The location information of the transaction objects (such as the transaction entity and the counterparty) is information that can characterize the geographical location of the transaction objects.

[0034] In some embodiments of this application, the account information of the transaction object is information that can uniquely identify the transaction object in a single transaction event. The account information may include the transaction object's account name, the transaction card used by the transaction object in this transaction, and the account opening institution information of the transaction card. The transaction card may include, but is not limited to, a debit card. The account opening institution information is relevant information indicating the account opening institution of the transaction card, and may include, but is not limited to, the province code of the province to which the account opening institution is located. Based on this, step 120 above may include the following steps 1201-1205.

[0035] Step 1201. Obtain the information of the first account opening institution corresponding to the transaction entity from the transaction information.

[0036] In some embodiments of this application, the transaction information includes the account information of the transaction subject. The account information of the transaction subject can be obtained from the transaction information, and then the account opening institution information of the transaction card used by the transaction subject this time, i.e., the first account opening institution information, can be extracted from the account information of the transaction subject.

[0037] Step 1202. Determine the first province code in the first account opening institution information as the location information of the transaction entity.

[0038] In some embodiments of this application, the first account opening institution information includes a field representing the province code. By parsing the first account opening institution information, the field representing the province code is obtained, thereby obtaining the first province code. The first province code can characterize the province where the transaction entity is located. Based on this, the first province code is determined as the location information of the transaction entity.

[0039] Step 1203. Obtain the information of the second account opening institution corresponding to the counterparty from the transaction information.

[0040] In some embodiments of this application, the transaction information includes the account information of the transaction object. The account information of the transaction object can be obtained from the transaction information, and then the account opening institution information of the transaction card used by the transaction object this time, i.e., the second account opening institution information, can be extracted from the account information of the transaction object.

[0041] Step 1204. If the information of the second account opening institution is obtained, the second province code in the information of the second account opening institution shall be determined as the location information of the counterparty.

[0042] In some embodiments of this application, when the information of the second account opening institution is obtained from the transaction information, the field representing the province code is extracted from the information of the second account opening institution to obtain the second province code. The second province code can characterize the province where the counterparty is located. Based on this, the second province code is determined as the location information of the counterparty.

[0043] Step 1205. If the information of the second account opening institution cannot be obtained, it is determined that the location information of the counterparty cannot be obtained from the transaction information.

[0044] In some embodiments of this application, the transaction information may contain a situation where the counterparty's account opening institution information is empty. In this case, it is impossible to obtain the second account opening institution information from the transaction information, and thus it is determined that the counterparty's location information cannot be directly obtained from the transaction information.

[0045] Step 130. If the location information of the counterparty cannot be obtained from the transaction information, determine the location information of the counterparty based on at least one of the first mapping table and the second mapping table.

[0046] Here, the first mapping table is used to indicate the correspondence between the bank issuer identification code (BIN) of the transaction card and the account opening institution information, and the second mapping table is used to indicate the correspondence between the account name of the transaction object and the account opening institution information.

[0047] In some embodiments of this application, the first mapping table can be pre-constructed based on a BIN database. This first mapping table is used to map the account opening institution information of transaction cards. The BIN database may include a first database and a second database. The first database refers to the card BIN database maintained by the bank itself, which contains the BIN codes and detailed information of bank cards issued by the bank. The second database refers to an authoritative and unified card BIN information database built / maintained by relevant financial regulatory agencies, which integrates card BIN data reported by multiple commercial banks and serves as a shared card BIN information repository. Based on this, the first mapping table can be used to query the account opening institution information corresponding to transaction cards issued by multiple banks.

[0048] In some embodiments of this application, the second mapping table can be constructed based on business registration data, and the second mapping table can be used to query the account opening institution information of corporate accounts.

[0049] In some embodiments of this application, the data in the first mapping table and the second mapping table can be standardized to ensure that the data format is consistent.

[0050] In some embodiments of this application, a pre-built first mapping table and a second mapping table can be stored in a high-performance database (such as Redis) to support fast queries.

[0051] In some embodiments of this application, the first mapping table and the second mapping table can be updated once a day to ensure the integrity and accuracy of the data.

[0052] In some embodiments of this application, see Figure 2 If the location information of the counterparty cannot be obtained from the transaction information, the location information of the counterparty can be determined through the following steps 1301-1303.

[0053] Step 1301. Obtain the Bank Identification Number (BIN) of the second transaction card from the transaction information. The second transaction card is the transaction card used by the counterparty in this transaction.

[0054] In some embodiments of this application, the transaction card number includes the transaction card's BIN code, and the transaction information may include the second transaction card number. Based on this, the second transaction card number can be obtained from the transaction information, and then the BIN code can be extracted from it based on the encoding structure of the transaction card number. For example, if the second transaction card is a bank card, the first 6 digits of its card number are the issuing institution code. Based on this, the first 6 digits of the second transaction card number are extracted as the second transaction card's BIN code.

[0055] Step 1302. If the BIN of the second transaction card is obtained, retrieve the target account opening institution information corresponding to the BIN from the first mapping relationship table.

[0056] As mentioned earlier, the first mapping table indicates the correspondence between the issuer identification number (BIN) of the transaction card and the account opening institution information. Based on this, when the BIN of the second transaction card is obtained, the first mapping table can be consulted to determine the target account opening institution information corresponding to the BIN in the first mapping table. The target account opening institution information is the account opening institution information of the second transaction card.

[0057] Step 1303. Determine the province code in the target account opening institution information as the location information of the counterparty.

[0058] In some embodiments of this application, when the target account opening institution information corresponding to the second transaction card is found based on the first mapping relationship table, the province code is extracted from the target account opening institution information, and the province code is determined as the location information of the counterparty.

[0059] In this way, when the location information of the counterparty cannot be obtained directly from the transaction information, the location information of the counterparty can be further determined based on the first mapping relationship table, thereby improving the success rate of obtaining the counterparty's location information and thus improving the success rate of cross-regional transaction identification.

[0060] In some embodiments of this application, due to reasons such as the inability to obtain the BIN code of the second transaction card from the transaction information, or the absence of target account opening institution information corresponding to the BIN code of the second transaction card in the first mapping table, it may be impossible to determine the location information of the counterparty based on the first mapping table. See also Figure 3 In this case, in order to further improve the accuracy of cross-regional transaction identification, the following steps 1304-1306 can be further performed.

[0061] Step 1304. If the location information of the counterparty cannot be determined based on the first mapping table, obtain the counterparty's account name from the transaction information.

[0062] In some embodiments of this application, the transaction information includes a field indicating the account name of the transaction card used by the counterparty. Based on this, the counterparty's account name can be obtained by extracting this field from the transaction information.

[0063] Step 1305. Obtain the target account opening institution information corresponding to the account name from the second mapping relationship table.

[0064] In some embodiments of this application, after obtaining the counterparty's account name, a second mapping relationship table is queried based on the account name, and the account opening institution information corresponding to the account name in the second mapping relationship table is used as the target account opening institution information.

[0065] In some embodiments of this application, the second mapping table is constructed based on business registration data and is used to indicate the correspondence between corporate accounts and account opening institution information. Therefore, to avoid wasting resources by querying the second mapping table when the counterparty's account is not a corporate account, before performing step 1305, it can be determined whether the account corresponding to the counterparty's account name is a corporate account. If it is determined that the account corresponding to the counterparty's account name is a corporate account, then step 1305 is performed; otherwise, it is determined that abnormal transaction identification cannot be performed.

[0066] Step 1306. Determine the province code in the target account opening institution information as the location information of the counterparty.

[0067] By using the above method, when it is not possible to obtain the counterparty's location information directly from the transaction information, and when it is not possible to determine the counterparty's location information based on the first mapping relationship table, the location information of the counterparty can be determined based on the second mapping relationship table, thereby improving the success rate of obtaining the counterparty's location information and thus improving the success rate of identifying cross-regional transactions.

[0068] Step 140. Based on the location information of the transaction entity and the counterparty, determine whether this transaction is a cross-regional transaction.

[0069] In some embodiments of this application, a cross-regional transaction refers to a transaction between different regions, where the transacting entity and the counterparty are located in different regions. Based on this, after obtaining the location information of the transacting entity and the counterparty, it can be determined whether they are in the same region based on their location relationship. If they are not in the same region, the transaction is determined to be a cross-regional transaction; if they are in the same region, the transaction is determined to be a non-cross-regional transaction.

[0070] In some embodiments of this application, "cross-regional transaction" refers to a transaction across provinces. The location information of both the transacting entity and the counterparty is a province code. Based on this, when determining whether a transaction is a cross-regional transaction, it can be determined whether the location information of the transacting entity and the counterparty are consistent. If the location information of the transacting entity and the counterparty are consistent, the transaction is determined not to be a cross-regional transaction; if the location information of the transacting entity and the counterparty are inconsistent, the transaction is determined to be a cross-regional transaction. For example, if the province code corresponding to the transacting entity and the province code corresponding to the counterparty are not the same, the transaction is determined to be a cross-regional transaction; if the province code corresponding to the transacting entity and the province code corresponding to the counterparty are the same, the transaction is determined to be a non-cross-regional transaction.

[0071] Step 150. Using a real-time computing engine, determine whether this transaction is a transaction between strangers based on transaction information and the target database.

[0072] Here, the target database is pre-built based on the historical transaction information of the first transaction card, which is the transaction card used by the transaction entity in this transaction.

[0073] In some embodiments of this application, "stranger transactions" refer to transactions made for the first time with an unfamiliar account. These transactions lack historical behavioral verification and have a greater risk exposure. The risk superposition effect of cross-regional stranger transactions is significant, and related technologies lack real-time judgment on such transactions, making it difficult to effectively identify high-risk abnormal transactions.

[0074] Therefore, in order to identify transactions between strangers in different locations, a target database corresponding to the first transaction card is pre-built. Thus, when a transaction subject uses the first transaction card to conduct a transaction, a real-time computing engine can determine in real time whether the transaction is a transaction between strangers based on the transaction information and the target database.

[0075] In some embodiments of this application, the historical transaction information of the first transaction card can be processed in batches by a data lake to obtain a target database. The historical transaction information may include transaction information of the first transaction card within the most recent N months, where the value of N can be set according to actual needs. For example, if N is 13, the historical transaction information includes transaction information of the first transaction card within only 13 months.

[0076] In some embodiments of this application, processing the historical transaction information of the first transaction card to obtain a target database may include: cleaning the historical transaction information, extracting the account names of trading partners who have transacted with the first transaction card from the cleaned historical transaction information, and storing these account names in a database to obtain the target database. Thus, the obtained target database includes the account names of trading partners who have transacted with the first transaction card. The data cleaning may include at least one of the following: Remove duplicate transaction records, such as duplicate transactions caused by network retries; Complete missing fields, such as completing geographical location through reverse IP lookup; Standardized data formats, such as unified time zones and monetary units.

[0077] In some embodiments of this application, the target database may use a high-performance database (such as Redis) to support fast queries.

[0078] In some embodiments of this application, before step 150 above, a real-time computing engine (such as Flink, Spark Streaming, or SFM) can be built to perform real-time stranger transaction judgment during the transaction process.

[0079] In some embodiments of this application, if the target database includes the account names of transaction objects that have transacted with the first transaction card, the above step 150 may include the following steps 1501-1504.

[0080] Step 1501. Obtain the counterparty's account name from the transaction information.

[0081] In some embodiments of this application, the transaction information includes a field for the account name of the transaction pair, such as "xx Co., Ltd." or "Zhang xx". Based on this, the account name of the counterparty can be directly obtained from the transaction information.

[0082] Step 1502. Query the target database to determine if a target account name that matches the account name exists in the target database.

[0083] In some embodiments of this application, after obtaining the counterparty's account name, a real-time computing engine is used to query the target database based on the counterparty's account name to determine whether a target account name that matches the account name exists in the target database.

[0084] Step 1503. If a target account name matching the account name exists in the target database, determine that this transaction is a non-stranger transaction.

[0085] In some embodiments of this application, if a target account name with the same name as the counterparty exists in the target database, it indicates that the counterparty has recently transacted with the trading entity, thereby determining that this transaction is not a transaction between strangers, that is, a transaction between non-strangers.

[0086] Step 1504. If no target account name matching the account name exists in the target database, determine that this transaction is a stranger transaction.

[0087] In some embodiments of this application, if the target database does not contain a target account name that matches the counterparty's account name, it indicates that the counterparty has not recently transacted with the transacting entity, thus determining that the transaction is a transaction between strangers.

[0088] In some embodiments of this application, considering that even if the two parties have not transacted recently, the risk of the transaction is low as long as they have a strong social connection, in order to effectively distinguish between "genuine stranger fraud" and "normal financial transactions between relatives / friends with no transaction history" to improve customer experience, the following steps can be performed before determining that the transaction is a stranger transaction if no target account name matching the account name exists in the target database: Determine whether there is a pre-existing relationship between the trading entity and the counterparty; if there is a pre-existing relationship between the trading entity and the counterparty, determine that the transaction is a transaction between strangers.

[0089] Accordingly, if there is no target account name matching the account name in the target database, and there is no pre-set relationship between the transaction entity and the counterparty, then the transaction is determined to be a stranger transaction.

[0090] In some embodiments of this application, the preset relationship is a predefined strong association relationship. For example, the preset relationship may include, but is not limited to, kinship, friendship, cooperation, etc.

[0091] In some embodiments of this application, multi-source data (such as customer information, emergency contacts, authorized address books, device / IP co-existing data, business data, etc.) can be cleaned, correlated, and fused in advance through ETL (Extract-Transform-Load) jobs to construct a relational graph with transaction objects as nodes and various preset relationships as edges. This relational graph is then stored in a high-performance database (such as Redis). Based on this, if no target account name matching the counterparty's account name exists in the target database, the relational graph can be queried in real time using the identification numbers, mobile phone numbers, account names, etc., of both parties as key values. If any preset relationship exists between the transaction subject and the counterparty, it is determined that the transaction is not a transaction between strangers; otherwise, it is determined that the transaction is a transaction between strangers.

[0092] By adopting the above methods, the judgment of stranger transactions is upgraded from a single "transaction behavior association" to a multi-dimensional judgment system of "social relationship association + transaction behavior association", which effectively distinguishes between "genuine stranger fraud" and "normal financial transactions between relatives / friends with no transaction history", which can significantly reduce the false alarm rate and improve customer experience.

[0093] In this embodiment, transaction information is obtained, including the location information of the transacting entity and the counterparty. If the counterparty's location information cannot be obtained from the transaction information, it is determined based on at least one of a first mapping table and a second mapping table. Based on the location information of the transacting entity and the counterparty, it is determined whether the transaction is a cross-regional transaction. Finally, through a real-time computing engine, based on the transaction information and a target database, it is determined whether the transaction is a transaction between strangers. According to this embodiment, the success rate of abnormal transaction identification can be improved, and real-time identification of transactions between strangers can be performed during the transaction process, thereby effectively improving the efficiency of risk control.

[0094] In some embodiments of this application, the transaction detection method may further include: Based on the detection results and rule model, it is determined whether this transaction meets the interception trigger conditions; the detection results are used to indicate whether this transaction is a cross-regional transaction and whether this transaction is a transaction between strangers, and the rule model includes the relevant rules for triggering interception; If the conditions for interception are met, this transaction will be intercepted.

[0095] In some embodiments of this application, the rule model may be an expert rule model built based on business experience. The rule model may include a series of expert rules; for example, the rule model may include the following rules: Rule 1: If this transaction is a cross-regional transaction and involves strangers, a high-risk warning will be triggered and the transaction will be blocked.

[0096] Rule 2: If the transaction amount exceeds the preset threshold and the transaction is between strangers, an interception will be triggered.

[0097] Rule 3: If the transaction time is in an abnormal time period (such as early morning) and it is a transaction between strangers, then the transaction will be blocked.

[0098] In some embodiments of this application, rule engines (such as Drools, SFM) can be used to implement the real-time application of rule models.

[0099] In some embodiments of this application, the transaction detection device may integrate a real-time message queue (such as Kafka) and an interception system to support real-time transaction termination.

[0100] In some embodiments of this application, after an interception is triggered, risk control personnel can be further notified so that they can make corresponding records and handle the situation.

[0101] Using the above methods, during the transaction process, after detecting whether the transaction is a cross-regional transaction or a transaction between strangers, the system can determine in real time whether the transaction meets the interception trigger conditions based on the detection results, rule models, and transaction information. If the interception trigger conditions are met, the transaction is intercepted, thus achieving real-time interception. In this way, through risk superposition judgment and real-time interception mechanisms, transaction risks can be effectively reduced.

[0102] In some embodiments of this application, the thresholds and conditions in the rule model can be dynamically adjusted based on historical transaction data and risk change trends. For example, the rule model can be adjusted and optimized in the following ways: Regularly evaluate the accuracy and coverage of expert rules and identify deficiencies in the rules; Based on the evaluation results, optimize the rule conditions and thresholds.

[0103] Furthermore, the rules in the rule model can be expanded based on new fraud methods and risk characteristics.

[0104] In some embodiments of this application, a rule management platform (such as Drools Workbench) can be used to achieve dynamic management and optimization of rules.

[0105] In some embodiments of this application, the transaction detection device may integrate data analysis tools (such as ELK Stack) to support real-time monitoring and analysis of rule effects.

[0106] Based on the transaction detection method provided in the above embodiments, this application also provides specific implementations of the transaction detection device. Please refer to the following embodiments.

[0107] See Figure 4 This is a schematic diagram of the transaction detection device provided in the embodiments of this application, as shown below. Figure 4 As shown, the transaction detection device 400 may include the following modules: The data acquisition module 401 is used to acquire transaction information for this transaction; The cross-regional transaction judgment module 402 is used to obtain the location information of the transaction subject and the location information of the transaction counterparty from the transaction information; The cross-regional transaction judgment module 402 is further configured to determine the location information of the counterparty based on at least one of a first mapping relationship table and a second mapping relationship table when the location information of the counterparty cannot be obtained from the transaction information; wherein, the first mapping relationship table is used to indicate the correspondence between the issuing bank identification code (BIN) of the transaction card and the account opening institution information, and the second mapping relationship table is used to indicate the correspondence between the corporate account and the account opening institution information. The cross-regional transaction judgment module 402 is also used to determine whether the transaction is a cross-regional transaction based on the location information of the transaction subject and the location information of the transaction counterparty; The stranger transaction judgment module 403 is used to determine whether the current transaction is a stranger transaction based on the transaction information and the target database through a real-time computing engine; wherein, the target database is pre-constructed based on the historical transaction information of the first transaction card, and the first transaction card is the transaction card used by the transaction subject in this transaction.

[0108] In this embodiment, transaction information is obtained, including the location information of the transacting entity and the counterparty. If the counterparty's location information cannot be obtained from the transaction information, it is determined based on at least one of a first mapping table and a second mapping table. Based on the location information of the transacting entity and the counterparty, it is determined whether the transaction is a cross-regional transaction. Finally, through a real-time computing engine, based on the transaction information and a target database, it is determined whether the transaction is a transaction between strangers. According to this embodiment, the success rate of abnormal transaction identification can be improved, and real-time identification of transactions between strangers can be performed during the transaction process, thereby effectively improving the efficiency of risk management.

[0109] In some embodiments of this application, the cross-regional transaction determination module 402 is specifically used for: Obtain the information of the first account opening institution corresponding to the transaction entity from the transaction information; The first province code in the first account opening institution information is determined as the location information of the transaction entity; Obtain information on the second account opening institution corresponding to the counterparty from the transaction information; If the information of the second account opening institution is obtained, the second province code in the information of the second account opening institution will be identified as the location information of the counterparty. If the information of the second account opening institution cannot be obtained, it is determined that the location information of the counterparty cannot be obtained from the transaction information.

[0110] In some embodiments of this application, the cross-regional transaction determination module 402 is specifically used for: Obtain the Bank Identification Number (BIN) of the second transaction card from the transaction information. The second transaction card is the transaction card used by the counterparty in this transaction. If the BIN of the second transaction card is obtained, the target account opening institution information corresponding to the BIN is obtained from the first mapping relationship table; The province code in the target account opening institution information is used to determine the location information of the counterparty.

[0111] In some embodiments of this application, the cross-regional transaction determination module 402 is specifically used for: If the location information of the counterparty cannot be determined based on the first mapping table, the account name of the counterparty is obtained from the transaction information. Retrieve the target account opening institution information corresponding to the account name from the second mapping table; The province code in the target account opening institution information is used to determine the location information of the counterparty.

[0112] In some embodiments of this application, the cross-regional transaction determination module 402 is specifically used for: Determine whether the location information of the main trading entity and the counterparty are consistent; If the location information of the transacting entity and the location information of the transacting counterparty are consistent, it is determined that this transaction is not a cross-regional transaction; If the location information of the transacting entity and the location information of the transacting counterparty are inconsistent, the transaction is determined to be a cross-regional transaction.

[0113] In some embodiments of this application, the stranger transaction determination module 403 is specifically used for: Obtain the counterparty's account name from the transaction information; Query the target database to determine if a target account name matching the account name exists in the target database; If a target account name matching the account name exists in the target database, this transaction is determined to be a transaction between a non-stranger and a real person. If no matching target account name exists in the target database, the transaction is determined to be a stranger transaction.

[0114] In some embodiments of this application, the stranger transaction determination module 403 is further configured to: If no target account name matching the account name exists in the target database, before determining that this transaction is a transaction between strangers, it is necessary to determine whether there is a pre-existing relationship between the transaction subject and the transaction counterparty; In cases where a pre-existing relationship exists between the transacting parties and their counterparties, this transaction is determined to be a transaction between non-strangers. If no matching target account name exists in the target database, this transaction is determined to be a transaction between strangers, including: If no target account name matching the account name exists in the target database, and there is no pre-defined relationship between the transaction entity and the counterparty, the transaction is determined to be a stranger transaction.

[0115] In some embodiments of this application, the device 400 further includes: a real-time interception module, used for: Based on the detection results and rule model, it is determined whether this transaction meets the interception trigger conditions; the detection results are used to indicate whether this transaction is a cross-regional transaction and whether this transaction is a transaction between strangers, and the rule model includes the relevant rules for triggering interception; If the conditions for interception are met, this transaction will be intercepted.

[0116] The transaction detection device provided in this application embodiment can achieve... Figures 1 to 3 The various processes implemented in the method implementation examples will not be described again here to avoid repetition.

[0117] Figure 5 A schematic diagram of the hardware structure of the electronic device provided in an embodiment of this application is shown.

[0118] Electronic device 500 may include processor 501 and memory 502 storing computer program instructions.

[0119] Specifically, the processor 501 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0120] Memory 502 may include a large-capacity memory for data or instructions. For example, and not limitingly, memory 502 may include a hard disk drive (HDD), a floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or a Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 502 may include removable or non-removable (or fixed) media. Where appropriate, memory 502 may be internal or external to electronic device 500. In a particular embodiment, memory 502 is a non-volatile solid-state memory. Memory 502 may include read-only memory (ROM), random access memory (RAM), disk storage media devices, optical storage media devices, flash memory devices, electrical, optical, or other physical / tangible memory storage devices. Thus, generally, memory 502 includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it can perform the operations described in any of the transaction detection methods in the above embodiments.

[0121] The processor 501 implements any of the transaction detection methods described in the above embodiments by reading and executing computer program instructions stored in the memory 502.

[0122] In one example, the electronic device 500 may also include a communication interface 503 and a bus 510. For example, Figure 5 As shown, the processor 501, memory 502, and communication interface 503 are connected through bus 510 and complete communication with each other.

[0123] The communication interface 503 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0124] Bus 510 includes hardware, software, or both, that couples components of electronic device 500 together. For example, and not limitingly, the bus may include Accelerated Graphics Port (AGP) or other graphics buses, Enhanced Industry Standard Architecture (EISA) buses, Front Side Bus (FSB), HyperTransport (HT) interconnects, Industry Standard Architecture (ISA) buses, Infinite Bandwidth Interconnects, Low Pin Count (LPC) buses, memory buses, Microchannel Architecture (MCA) buses, Peripheral Component Interconnect (PCI) buses, PCI-Express (PCI-X) buses, Serial Advanced Technology Attachment (SATA) buses, Video Electronics Standards Association Local (VLB) buses, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 510 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, any suitable bus or interconnect is contemplated herein.

[0125] Furthermore, in conjunction with the transaction detection methods in the above embodiments, this application embodiment can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the transaction detection methods in the above embodiments.

[0126] This application also provides a computer program product, including a computer program, which, when executed, implements any of the transaction detection methods described in the above embodiments.

[0127] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0128] The functional blocks shown in the above-described structural diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0129] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0130] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0131] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A transaction detection method, characterized in that, include: Obtain transaction information for this transaction; The location information of the trading entity and the trading counterparty is obtained from the transaction information; If the location information of the counterparty cannot be obtained from the transaction information, the location information of the counterparty shall be determined based on at least one of the first mapping relationship table and the second mapping relationship table; wherein, the first mapping relationship table is used to indicate the correspondence between the issuing bank identification code (BIN) of the transaction card and the account opening institution information, and the second mapping relationship table is used to indicate the correspondence between the corporate account and the account opening institution information. Based on the location information of the transaction entity and the location information of the transaction counterparty, it is determined whether this transaction is a cross-regional transaction; Using a real-time computing engine, based on the transaction information and the target database, it is determined whether this transaction is a transaction between strangers; wherein, the target database is pre-constructed based on the historical transaction information of the first transaction card, which is the transaction card used by the transaction subject in this transaction.

2. The method according to claim 1, characterized in that, The step of obtaining the location information of the trading entity and the trading counterparty from the transaction information includes: Obtain the information of the first account opening institution corresponding to the transaction entity from the transaction information; The first province code in the first account opening institution information is determined as the location information of the transaction entity; Obtain the information of the second account opening institution corresponding to the counterparty from the transaction information; If the information of the second account opening institution is obtained, the second province code in the information of the second account opening institution is determined as the location information of the counterparty. If the information of the second account opening institution cannot be obtained, it is determined that the location information of the counterparty cannot be obtained from the transaction information.

3. The method according to claim 1, characterized in that, Determining the location information of the counterparty based on at least one of the first mapping table and the second mapping table includes: Obtain the Bank Identification Number (BIN) of the second transaction card from the transaction information. The second transaction card is the transaction card used by the counterparty in this transaction. If the BIN of the second transaction card is obtained, the target account opening institution information corresponding to the BIN is obtained from the first mapping relationship table; The province code in the target account opening institution information is determined as the location information of the counterparty.

4. The method according to claim 3, characterized in that, Determining the location information of the counterparty based on at least one of the first mapping table and the second mapping table includes: If the location information of the counterparty cannot be determined based on the first mapping table, the account name of the counterparty is obtained from the transaction information; Obtain the target account opening institution information corresponding to the account name from the second mapping table; The province code in the target account opening institution information is determined as the location information of the counterparty.

5. The method according to any one of claims 2-4, characterized in that, The step of determining whether a transaction is a cross-regional transaction based on the location information of the transacting entity and the counterparty includes: Determine whether the location information of the trading entity and the location information of the trading counterparty are consistent; If the location information of the transacting entity and the location information of the transacting counterparty are consistent, it is determined that this transaction is not a cross-regional transaction; If the location information of the transaction entity and the location information of the transaction counterparty are inconsistent, the transaction is determined to be a cross-regional transaction.

6. The method according to any one of claims 1-4, characterized in that, The target database includes the account names of transaction objects that have transacted with the first transaction card; The step of determining whether a transaction is a transaction between strangers based on the transaction information and the target database using a real-time computing engine includes: Obtain the account name of the counterparty from the transaction information; Query the target database to determine if a target account name matching the account name exists in the target database; If a target account name matching the stated account name exists in the target database, the transaction is determined to be a transaction between a non-stranger and a non-stranger. If no target account name matching the stated account name exists in the target database, the transaction is determined to be a stranger transaction.

7. The method according to claim 6, characterized in that, Before determining that the transaction is a stranger transaction if no target account name matching the account name exists in the target database, the method further includes: Determine whether a pre-established relationship exists between the transaction entity and the transaction counterparty; If the pre-defined relationship exists between the transaction entity and the transaction counterparty, the transaction is determined to be a transaction between strangers. If no target account name matching the stated account name exists in the target database, determining that the transaction is a stranger transaction includes: If no target account name matching the account name exists in the target database, and no preset relationship exists between the transaction subject and the transaction counterparty, the transaction is determined to be a stranger transaction.

8. The method according to claim 1, characterized in that, The method further includes: Based on the detection results and rule model, it is determined whether the transaction meets the interception trigger conditions; wherein, the detection results are used to indicate whether the transaction is a cross-regional transaction and whether the transaction is a transaction between strangers, and the rule model includes relevant rules for triggering interception; If the aforementioned interception triggering conditions are met, the transaction will be intercepted.

9. A transaction detection device, characterized in that, include: The data acquisition module is used to obtain transaction information for this transaction; The cross-regional transaction judgment module is used to obtain the location information of the transaction subject and the location information of the transaction counterparty from the transaction information; The cross-regional transaction judgment module is further configured to determine the location information of the counterparty based on at least one of a first mapping relationship table and a second mapping relationship table when the location information of the counterparty cannot be obtained from the transaction information; wherein, the first mapping relationship table is used to indicate the correspondence between the issuing bank identification code (BIN) of the transaction card and the account opening institution information, and the second mapping relationship table is used to indicate the correspondence between the corporate account and the account opening institution information. The cross-regional transaction judgment module is also used to determine whether the transaction is a cross-regional transaction based on the location information of the transaction subject and the location information of the transaction counterparty; The stranger transaction judgment module is used to determine whether the current transaction is a stranger transaction based on the transaction information and the target database through a real-time computing engine; wherein, the target database is pre-constructed based on the historical transaction information of the first transaction card, which is the transaction card used by the transaction subject in this transaction.

10. An electronic device, characterized in that, The electronic device includes: a processor and a memory storing computer program instructions; the processor, when executing the computer program instructions, implements the transaction detection method as described in any one of claims 1-8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions that, when executed by a processor, implement the transaction detection method as described in any one of claims 1-8.

12. A computer program product, characterized in that, When the instructions in the computer program product are executed by the processor of the electronic device, the electronic device is able to perform the transaction detection method as described in any one of claims 1-8.

Images