A method and device for identifying false transactions and preventing wash trading

Abstract

A method and device for identifying false transactions and preventing brushing, which are used to identify false transactions and brushing hands on an e-commerce platform, prevent brushing from destroying the shopping experience of the e-commerce platform, and prevent counterfeit and substandard commodities from cheating consumers by brushing. By utilizing the characteristics of the brushing group, the data in the database is analyzed and detected to find out the false transaction commodities and the brushing hands. The brushing group characteristics used include the seller one-to-many return to the brushing hand, the brushing group group purchases different ID commodities, the abnormal transaction rate, the abnormal shopping frequency, etc.

Description

Technical Field

[0001] The invention relates to a method for identifying fraudulent transactions on e-commerce platforms, a method for preventing fraudulent transactions, and related devices. Background Technology

[0002] The problem of fake transactions is widespread on e-commerce platforms. After more than a decade of development, sophisticated order-fakers now mimic the entire transaction process, from inquiry and product purchase to payment, shipping, and receipt, making it virtually flawless. Therefore, identifying such fake transactions is extremely difficult, seemingly an insurmountable problem for ordinary people, leaving e-commerce platforms powerless to address it. This widespread reality of fake transactions has led many consumers to be deceived by inflated reviews and fake sales figures, resulting in a decline in the user experience across various e-commerce platforms.

[0003] A certain e-commerce platform has been working to combat fake orders since at least 2009. A search of the Chinese patent database only yielded two patent applications from a certain company related to fake transactions: Patent 201210065665.1 only provides methods for scoring sellers' quality based on identifying fake transaction users, and only provides a method for calculating the proportion of fake transactions in a seller's sales score, but it doesn't propose measures or methods for identifying fake transaction users, which is the real difficulty in preventing fake transactions. Another patent from the same company, 201210407962X, mentions identifying malicious registration users by identifying multiple accounts registered on a single computer to prevent fake transactions, and also provides methods for identifying a single user registering multiple malicious accounts to prevent fake transactions. However, this method is not directly related to the identification of fake transactions and can only prevent situations involving the mass registration of fake order accounts. But for every step the anti-fake order group takes, the countermeasures are already more sophisticated. Modern fake order groups have achieved complete simulation of real transactions (even tracking numbers can be found online), rendering this method ineffective if a user uses only one account. Even today, fake orders remain difficult to control and are widespread. E-commerce platforms still lack truly effective methods to identify and prevent fraudulent transactions. Fake orders are a fatal problem for these e-commerce platforms. Over the years, the technical staff in these companies must have racked their brains and tried every possible method.

[0004] Therefore, if the methods proposed in this article have not been used by existing e-commerce platforms before, they are not something that industry professionals can easily come up with.

[0005] The prior art cited by the examiner in the parent application of this case is "Collusive Sales Fraud Identification Based on Template User Information Search Behavior and Statistical Analysis," published in the November 2015 issue of *Modern Library and Information Technology*. This scheme utilizes the fact that group leaders of fake order-boosting groups publish uniform requirements for fake order details (such as keyword search order and page dwell time) to identify groups with similar behavioral characteristics. It relies on identifying fake order participants based on common features in the fake order process, which creates a significant flaw in the scheme because the process is variable to achieve the desired outcome. If the group leader removes the requirements for fake order details and only states the purpose of the fake order, this method becomes completely ineffective. Summary of the Invention

[0007] The purpose of this invention is to provide a method for identifying fraudulent transactions and identifying those who engage in fraudulent order placement, thereby helping e-commerce platforms prevent such transactions, improve the authenticity of online transactions, and enhance the user experience of e-commerce platforms. In particular, it provides an identification method that does not rely on uniform characteristics of the fraudulent order placement process.

[0008] This application also provides an apparatus for using the above method to ensure the practical application and implementation of the above method.

[0009] The aforementioned company's existing patents and other common methods are all limited to judging the process of a single transaction, analyzing the behavior of an individual buyer, rather than analyzing the entire fraudulent transaction group as a separate entity. They fail to consider a crucial characteristic of fraudulent transactions: to increase transaction volume, a large group of fraudulent traders is required. Such a group of fraudulent traders exhibits certain group characteristics during the fraudulent transaction process, and these characteristics can serve as evidence for identifying fraudulent transactions.

[0010] The purpose of this invention is achieved by using the group characteristics of fake order groups as a basis for judging fraudulent transactions.

[0011] The group characteristics mentioned can be: one-to-many refund or cashback transactions occur between sellers of goods involved in fraudulent transactions and members of the fraudulent transaction group. The fraudulent transaction monitoring program detects, analyzes, and statistically analyzes the single transaction amount and frequency of one-to-many payments on online payment platforms, using this as one of the criteria for judging fraudulent transactions. The use of "and" in this article includes both "and" and "or" cases. Because fraudulent transactions involving fraudulent transactions always involve the seller refunding the fraudsters, this data can be monitored for judgment. One-to-many payments refer to a situation where one account transfers funds to multiple other accounts. Generally, it's unlikely that a buyer will continuously pay multiple sellers for the same (or similar) priced goods; therefore, if this occurs, it likely indicates that the seller in a fraudulent transaction is refunding the buyer. When the number of one-to-many payments exceeds a certain threshold, the paying account will be restricted for a certain period and required to provide a payment explanation before it can continue to be used. The fraudulent transaction suspicion parameter of the receiving account will be adjusted (e.g., incremented by 1). After the fraudulent transaction suspicion reaches a certain threshold, the receiving account will be restricted for a certain period.

[0012] This method involves searching for corresponding products on e-commerce platforms based on refund transactions processed through payment platforms. The seller's refund account might be an Alipay account linked to a fraudulent e-commerce account (such as Taobao), or it might be a different payment account (e.g., an Alipay account). However, the city associated with the payment account generally remains the same (the city can be confirmed via mobile phone number, ID number, the location of the bank where the transaction was made, and the location of the bank where the transaction was withdrawn). By statistically analyzing the number of local payment accounts in each region (e.g., by city), a table showing the transaction volume between sellers and buyers in each city can be created. Comparing this table with the local transaction volume data in the e-commerce platform's (e.g., Taobao) transaction database (analyzed based on delivery address) can identify suspected products. During the comparison, a suspected transaction is identified if the city's transaction volume is greater than the Alipay transaction volume. To prevent bias in Alipay location analysis, a Taobao local transaction volume less than a certain percentage of the Alipay local transaction volume can also be considered valid. In reality, some genuine buyers participate in fraudulent transactions, so the total Taobao local transaction volume is generally greater than the Alipay local transaction volume mentioned above. Once an Alipay account is suspected of being involved in fraudulent transactions, all of that user's Alipay accounts will be penalized accordingly. The accounts of their immediate family members will also be penalized (increasing the suspicion of fraudulent transactions by 1).

[0013] The group characteristics mentioned could be: a group of members with the same IDs would purchase products with the same IDs. The fraudulent transaction monitoring program detects and statistically analyzes the same buyers for different ID products (e.g., quantity, user ID set, etc.), using this as one of the criteria for judging fraudulent transactions. The number of product IDs purchased by suspected fraudulent groups for different ID products can also be used as one of the criteria for judging fraudulent transactions.

[0014] As an improvement, accounts logged in from the same computer (which can be detected via cookies) or the same IP address will be considered as the same buyer to prevent buyers from switching between different accounts to carry out fraudulent transactions.

[0015] To improve efficiency, a certain monitoring threshold can be set to monitor products whose total sales exceed a certain number.

[0016] As an improvement measure, to reduce the workload of comparisons and increase the efficiency of the program, the monitoring program uses buyer shopping frequency (the number of purchases within a certain period) as one of the criteria for identifying fraudulent order makers or perpetrators, and performs detection, analysis, and processing based on this. If a buyer's purchase quantity exceeds a certain value within a certain period, they become a suspected case. All items purchased by that buyer become suspected fraudulent order items. The program checks the same buyers for each suspected fraudulent order item; if there is a set of identical buyers, it indicates that these buyers may belong to the same fraudulent order group.

[0017] The aforementioned group characteristic is that the conversion rate of products involved in fraudulent transactions is higher during the fraudulent transaction group's fraudulent transaction phase than in normal circumstances. The fraudulent transaction monitoring program analyzes and statistically analyzes the conversion rate of products (the ratio of a product's sales volume to page views within a certain period), using the conversion rate as one of the criteria for judging fraudulent transactions. If the conversion rate exceeds a certain threshold over a period of time, the product is suspected of being a fraudulent transaction and can be further analyzed and processed.

[0018] The time of the transaction can also be used as a basis for judgment. Generally, the transaction times of order-brushing groups are relatively close (but not necessarily).

[0019] In the database, the product data table has an attribute item related to the degree of suspicion of order fraud; the user data table has an attribute item describing the degree of suspicion of order fraud perpetrators.

[0020] A threshold can be set (the threshold for the number of purchases of the same product ID). When the number of product IDs purchased by a buyer set reaches this threshold, the buyers in that set are listed as suspected order-fakers once. Each time a buyer is listed as a suspected order-faker, their order-faking suspicion attribute is processed (e.g., the attribute value is incremented by 1).

[0021] For example, if the product purchase volume ID threshold is set to 3, and 100 buyers all purchased products with IDs A1, A2, and A3, then the suspected fraudulent order attribute value for these 100 buyers is incremented by 1. If they all purchased products with IDs A1, A2, A3, A4, A5, and A6, then their suspected fraudulent order attribute value is incremented by 4. Alternatively, a threshold can be set for the number of buyers within a buyer set. The aforementioned detection and processing will only be performed on the set when the number of buyers in the set reaches that threshold. Generally, this threshold should be at least 2.

[0022] If an e-commerce platform has 10,000 SKUs, the probability that 100 unique buyers will all purchase SKU1, SKU2, and SKU3 within a short period of time is 6.53 × 10⁻⁶. -1123 (Submitting the question to AI will reveal the calculation process.) E-commerce platforms like Taobao have two to three billion SKUs (stock keeping units, i.e., product IDs) in their databases. A fake order team might place tens of thousands of fake orders for a single product, meaning tens of thousands of independent fake order operators are involved. With these two factors combined, even a threshold of 3 or even 2 will result in high accuracy. For a fake order team, once the order is issued, the probability that members of their team will simultaneously purchase SKU1, SKU2, and SKU3 is 100%. However, fake order teams rely on fake orders for a living; it's difficult for someone to survive without placing at least 10 fake orders a day. Therefore, if the observation period is one day, setting the threshold to 10 will result in high accuracy. If the observation period is extended and the threshold is set to 100, the accuracy will definitely reach 100%. The lower the probability, the higher the accuracy. If something with a very low probability actually happens in reality, it indicates that there is definitely coordinated command behind it, rather than normal transactions. The lower the probability, the higher the accuracy. The greater the overlap among buyers purchasing the same product set, the more buyers there are, and the more SKUs the platform has, the lower the probability and the higher the accuracy. From this analysis, it can be seen that this invention includes a solution that can accurately identify fraudulent orders.

[0023] The most rudimentary approach is to perform the aforementioned comparative analysis and testing on all products in the product order database. This approach is very labor-intensive and is suitable for beginners who are analyzing and processing all past transaction data using this technology. Alternatively, this comprehensive processing can be performed periodically.

[0024] The task of determining the frequency of a buyer's purchases can be performed by the program every time a buyer makes a purchase.

[0025] Sales volume of a product within a certain period of time can also be used as one of the criteria for judgment. For products that exceed a certain threshold, the above detection procedure can also be initiated.

[0026] The product conversion rate can be checked every time a product is sold. For those products that exceed the conversion rate threshold, the aforementioned buyer set analysis is initiated to check whether the product has the same or similar buyer set intersection with other products.

[0027] When a buyer's suspected fraudulent activity reaches a certain threshold, they are identified as a fraudulent seller. For detected fraudulent sellers, penalties include temporary account restrictions. If the number of penalties reaches a certain threshold, the account can be permanently closed. Of course, to prevent misjudgments, penalized accounts can appeal.

[0028] Another method to prevent fake orders is for e-commerce platforms to send people (including those from other companies or organizations) to pose as sellers needing to place fake orders, enticing fake order groups to buy specific bait products in order to identify fake order users on the platform. The product titles can contain keywords with very low search volume, ensuring that those buying the product are primarily fake order participants.

[0029] Another way to prevent fake orders is for e-commerce websites to inform the public that those who report fraudulent transactions can be rewarded. Ordinary buyers are generally less efficient at reporting fake orders because they typically lack evidence, while those who report fake orders can usually provide the contact information of fake order teams, making it easier to place bait orders with them. Those who report fake orders can also directly report which products are being used for fake orders, thus uncovering more fake order operators.

[0030] As an improvement, whistleblowers must provide evidence of fraudulent transactions. For example, they could provide records of messages they received in QQ groups used for fake transactions.

[0031] As an improvement measure: whistleblowers are required to assist e-commerce platforms in investigating groups that engage in fraudulent order practices.

[0032] Whistleblowers can submit lists of products that need to be faked, posted by fake order groups, to e-commerce platforms to help them identify suspected fake order perpetrators.

[0033] The rewards mentioned include, but are not limited to, monetary rewards, material rewards, and other non-material rewards (such as travel and vacations). Letting those who engage in fraudulent transactions know that the rewards for reporting are higher than the income from fraudulent transactions will incentivize them to report such groups. The size of the reward can be determined based on the number of members in the fraudulent transaction group. This notification can be made through other websites or media, on the e-commerce website's own webpage, or when customers contact the seller by phone; however, it is not limited to these methods. The method of notification is not innovative in this invention and will not be listed further here. The best approach is to include prominent information during the purchase process informing buyers that if they are involved in fraudulent transactions, they can receive rewards for reporting fake transactions.

[0034] Once a product is identified as a fraudulently purchased item, all buyers within the fraudulent group's transaction period become suspected fraudsters. Their suspicion index is adjusted (e.g., incremented by 1) each time a suspected fraudulently purchased item is made, the index is adjusted again. Once the index reaches a certain value, the suspected fraudster is determined to be a genuine fraudster.

[0035] Once a user is identified as a fraudulent order-faker, the suspicion of fraudulent orders for all the products purchased by that user is adjusted (e.g., increased by 1).

[0036] The present invention also provides an apparatus for identifying fraudulent transactions, which uses the aforementioned method to analyze and process fraudulent transactions.

[0037] The device contains a program that uses at least one of the methods described above to identify fraudulent transactions.

[0038] The device uses at least one of the above methods to identify fraudulent transactions and order-brushing operators.

[0039] This application can be used in a wide variety of general-purpose or special-purpose computing system environments or configurations. The device may be: a personal computer, a server computer, a workstation, a handheld or portable device, a tablet device, a multiprocessor system, a microprocessor-based system, a set-top box, a programmable consumer electronics device, a network PC, a minicomputer, a mainframe computer, a distributed computing environment and device including any of the above systems or devices, etc.

[0040] The judgment criteria mentioned above refer to the fact that there may be only one criterion or there may be multiple criters.

[0041] The "threshold" mentioned above refers to a manually set value. The threshold used may differ for different variables.

[0042] The program mentioned above does not necessarily refer to a single program; it can also be a piece of program code embedded in other programs.

[0043] Any method can lead to misjudgments. Users who are penalized can appeal to the e-commerce platform. Once it's confirmed that a buyer participated in fraudulent transactions, the relevant information can be submitted to the personal credit reporting system, linking it to the individual's credit history.

[0044] Advantages of the present invention This invention provides a comprehensive method for analyzing, identifying, and processing fraudulent transactions, which can effectively prevent fraudulent transactions on e-commerce platforms, thereby improving the credibility of e-commerce platforms and greatly helping to prevent counterfeit and shoddy goods from deceiving consumers through fraudulent transactions.

[0045] Advantages and technological advancements compared to the prior art: The present invention analyzes only the results of fraudulent order placement, without relying on the uniform characteristics of the entire process. Therefore, it will not fail even if the group owner cancels the fraudulent order placement process. While the process of fraudulent order placement can vary greatly, the result remains unchanged. Therefore, even if the group owner becomes aware of the present invention's technical solution, they cannot bypass it. The probabilistic analysis in this paper demonstrates the extremely high accuracy of the present invention. This represents a significant and obvious technological advancement compared to the prior art. Attached Figure Description

[0046] Appendix Figure 1 This is a schematic diagram of the principle of Embodiment 1 of the present invention. Detailed Implementation

[0047] In the appendix Figure 1 In the illustrated Example 1: The buyers of product 1 are: Buyer 1, Buyer 2, Buyer 3, Buyer 4, and Buyer 5; The buyers of product 2 are: Buyer 1, Buyer 2, Buyer 3, Buyer 4, Buyer 5, and Buyer 6. The buyers of product 3 are: Buyer 1, Buyer 2, Buyer 3, Buyer 4, Buyer 5, and Buyer 7.

[0048] The buyers of product 4 are: Buyer 1, Buyer 2, Buyer 3, Buyer 4, Buyer 5, and Buyer 8.

[0049] The buyers of product 5 are: Buyer 1, Buyer 2, Buyer 3, Buyer 4, Buyer 5, and Buyer 8.

[0050] It can be seen that the common set of buyers for these 5 products (that is, the intersection of the buyer sets of each product) is: Buyer 1, Buyer 2, Buyer 3, Buyer 4, Buyer 5.

[0051] Following the aforementioned method, if the purchase threshold for the same ID is set to 2, the suspected fraudulent order attribute value for buyers 1, 2, 3, 4, and 5 is 4. If the suspected fraudulent order threshold is 3, then all five buyers are identified as fraudulent order participants. These five items will then be identified as fraudulent order items. If the purchase times of buyers 6, 7, and 8 are close to the purchase times of buyers 1-5, then the suspected fraudulent order value for buyers 6 and 7 is increased by 1. The suspected fraudulent order value for buyer 8 is increased by 2.

[0052] For specific comparisons and analyses of identical buyers, the program can verify the buyer IDs of these products one by one. Alternatively, it can perform mathematical calculations by placing each buyer into an array or matrix (for example, if a buyer purchased a product, the corresponding number in the array would be 1, and if not, 0). Specific retrieval methods can refer to existing technologies and mathematical knowledge; there are many methods available, but they are not innovative and are not the focus of this invention. They will not be elaborated upon here.

[0053] For the sake of simplicity, the method embodiments are described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0054] This application can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0055] Finally, it should be noted that in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0056] The methods and devices for identifying fraudulent transactions and preventing order brushing provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for identifying fraudulent transactions based on the intersection operation of buyer sets, characterized in that, Executed by the e-commerce platform's server, the process includes the following steps: Step S1: Obtain order data from the order database and extract the mapping relationship between product ID and buyer ID; Step S2: Based on the mapping relationship, construct a corresponding set of buyer IDs for each of the N different product IDs; Step S3: The processor performs an intersection operation on the N buyer ID sets to generate a set of identical buyer intersections; Step S4: In the user data table of the server database, there are attribute items that describe the degree of suspected fraudulent transactions; calculate the number of product IDs of different ID products purchased by the buyer intersection set; use this as the basis for judging whether it is a fraudulent transaction, and process the suspected fraudulent transaction attributes of buyers in the buyer set; Step S5: When the suspected order-brushing attribute value is greater than the preset suspected order-brushing threshold, the automatic judgment logic is triggered, and the corresponding buyer is marked as an order-brushing operator. Step S6: Based on the judgment result, the server automatically sends a transaction permission restriction instruction to the backend system for the person who engaged in fraudulent transactions.

2. The method according to claim 1, characterized in that: The specific processing method for extracting buyer ID information in step S1 is as follows: read the hardware feature information or login network node information in the order data, and parse and map orders with the same hardware feature information or the same login network node information to the same unique buyer ID.

3. The method according to claim 1, characterized in that: It also calculates the ratio of transaction volume to page views for a specific product ID within a preset time period as the conversion rate; when the conversion rate deviates from the normal operating fluctuation range of the system, the specific product ID is selected as the object to be extracted first in step S2 to construct the buyer ID set.

4. The method according to claim 1, characterized in that: Step S4 includes setting an ID threshold. When the number of product IDs of the same product purchased by a buyer group reaches the threshold, the buyers in the group are listed as suspected of fraudulent transactions. The system statistically analyzes and processes the suspected fraudulent transaction attribute values ​​of buyers in the same buyer intersection set. These attribute values ​​are calculated by accumulating the number of different ID products purchased by the buyers within a preset time period.

5. The method according to claim 1, characterized in that: It also uses the frequency of buyer purchases (the number of purchases within a certain period of time) as one of the criteria for judging whether someone is a fraudulent seller, and conducts detection, analysis and processing of this; if a buyer's purchase quantity exceeds a certain value within a certain period of time, they become a suspected case.

6. A device for identifying fraudulent transactions based on the intersection operation of buyer sets, characterized in that, Servers used in e-commerce platforms include: The mapping extraction module is used to extract the mapping relationship between product IDs and buyer IDs; The collection building module is used to build collections of buyer IDs corresponding to different product IDs; The intersection operation module is used to perform intersection operations to generate a set of intersections of identical buyers. The Suspicion Statistics module is used to calculate the suspected fraud attribute value of a buyer ID based on the number of products purchased from different IDs. The automated control module is used to mark groups involved in fraudulent activities and automatically impose access restrictions when the suspected fraudulent activity attribute value exceeds a preset threshold.

7. A computer-readable storage medium, characterized in that, The device stores program instructions that, when executed by a processor, implement the identification method as described in any one of claims 1 to 5.

8. A device for identifying fraudulent transactions, characterized in that: It contains a program that uses at least one of the methods described in claims 1 to 5 above to identify fraudulent transactions.

Images