Fraud detection system, fraud detection method, and program

Abstract

To improve the accuracy of fraud detection in payment services.SOLUTION: A target franchisee information acquisition unit (107) of a fraud detection system (1) acquires target franchisee information regarding a target franchisee that has passed the initial screening for a payment service and is subject to fraud detection. A franchisee fraud detection model storage unit (102) stores a franchisee fraud detection model (M2) that has learned a relation between training franchisee information on a training franchisee which is a training franchisee, and presence / absence of fraud of the training franchisee. A franchisee fraud detection unit (108) detects fraud of the target franchisee based on the target franchisee information and the franchisee fraud detection model (M2).SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present disclosure relates to a fraud detection system, a fraud detection method, and a program. [Background technology]

[0002] Conventionally, there is known a technology for detecting fraudulent acts by a member store that has passed the initial screening of a payment service. For example, Patent Document 1 describes a system for detecting fraudulent acts by a member store in a payment service using a credit card by acquiring transaction information related to a transaction between the member store of the payment service and a user who uses the member store from a user terminal and determining whether the transaction information satisfies a predetermined condition. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2020-170462 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, with the technology of Patent Document 1, if an affiliated store commits fraud with its own credit card, there is a possibility that fraudulent transaction information may be sent from the user terminal of the fraudulent affiliated store. In this case, the technology of Patent Document 1 may determine that the transaction information does not satisfy a predetermined condition. This point is similar to other payment services that use payment methods other than credit cards as in Patent Document 1. Conventional technologies were not sufficiently accurate in detecting fraud by affiliated stores.

[0005] One of the objectives of this disclosure is to improve the accuracy of fraud detection in payment services. [Means for solving the problem]

[0006] The fraud detection system of the present disclosure includes a target franchisee information acquisition unit that acquires target franchisee information regarding a target franchisee, which is a franchisee that has passed the initial screening of a payment service and is subject to fraud detection, a franchisee fraud detection model memory unit that stores training franchisee information regarding a training franchisee, which is a franchisee used for training, and a franchisee fraud detection model that has learned the relationship between whether or not the training franchisee has committed fraud, and a franchisee fraud detection unit that detects fraud by the target franchisee based on the target franchisee information and the franchisee fraud detection model. Effect of the Invention

[0007] According to the present disclosure, it is possible to improve the accuracy of fraud detection in payment services. [Brief description of the drawings]

[0008] [Figure 1] FIG. 2 is a diagram illustrating an example of a hardware configuration of the fraud detection system. [Diagram 2] FIG. 13 is a diagram showing an example of examination performed in a payment service. [Diagram 3] FIG. 2 is a diagram illustrating an example of functions realized by the fraud detection system. [Figure 4] FIG. 13 is a diagram illustrating an example of a target payment database. [Diagram 5] FIG. 13 is a diagram showing an example of a target affiliated store database. [Figure 6] FIG. 13 is a diagram showing an example of a training payment database. [Figure 7] FIG. 13 is a diagram showing an example of a training affiliated store database. [Figure 8] FIG. 13 illustrates an example of a notification displayed on the administrator terminal. [Figure 9] FIG. 2 is a diagram illustrating an example of processing executed in the fraud detection system. [Figure 10] A figure showing an example of functions realized by a fraud detection system of a modified example. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] [1. Hardware configuration of the fraud detection system] An embodiment of a fraud detection system according to the present disclosure will be described. Fig. 1 is a diagram showing an example of a hardware configuration of the fraud detection system. For example, the fraud detection system 1 includes a server 10, an affiliated store terminal 20, and an administrator terminal 30. Each of the server 10, the affiliated store terminal 20, and the administrator terminal 30 is connected to a network N such as the Internet or a LAN.

[0010] The server 10 is a server computer managed by a payment service administrator (provider). The payment service is a service related to electronic payment (cashless payment). For example, the payment service is a service related to credit card payment, debit card payment, electronic money payment, barcode payment, two-dimensional code payment, NFC (Near Field Communication) payment, or cryptocurrency payment. For example, the administrator of the payment service is a financial institution such as a credit card company, a bank, or a securities company, or an electronic payment agent.

[0011] For example, the server 10 includes a control unit 11, a storage unit 12, and a communication unit 13. The control unit 11 includes at least one processor. The storage unit 12 includes at least one of a volatile memory such as a RAM and a non-volatile memory such as a flash memory. The communication unit 13 includes at least one of a communication interface for wired communication and a communication interface for wireless communication.

[0012] The affiliated store terminal 20 is a computer of an affiliated store that is affiliated with the payment service. The affiliated store has completed the prescribed application procedures to join the payment service. For example, the affiliated store may be a store such as a restaurant or retail store, a medical institution, a public facility, an event facility, or other facilities. A user who uses the affiliated store can purchase products or use services by making a payment such as the credit card payment described above.

[0013] For example, the affiliated store terminal 20 is a POS terminal, a personal computer, a smartphone, or a tablet. The affiliated store terminal 20 includes a control unit 21, a memory unit 22, a communication unit 23, an operation unit 24, and a display unit 25. The physical configurations of the control unit 21, the memory unit 22, and the communication unit 23 may be similar to those of the control unit 11, the memory unit 12, and the communication unit 13, respectively. The operation unit 24 is an input device such as a keyboard, a mouse, or a touch panel. The display unit 25 is a display such as a liquid crystal display or an organic EL display. The affiliated store terminal 20 also includes hardware such as a reading device necessary for payment.

[0014] The administrator terminal 30 is a computer operated by an administrator. For example, the administrator terminal 30 is a personal computer, a smartphone, or a tablet. For example, the administrator terminal 30 includes a control unit 31, a storage unit 32, a communication unit 33, an operation unit 34, and a display unit 35. The physical configurations of the control unit 31, the storage unit 32, the communication unit 33, the operation unit 34, and the display unit 35 may be similar to those of the control unit 11, the storage unit 12, the communication unit 13, the operation unit 24, and the display unit 25, respectively.

[0015] The programs stored in the storage units 12, 22, 32 may be supplied to the server 10, the affiliated store terminal 20, or the administrator terminal 30 via the network N. Also, the programs stored in a computer-readable information storage medium may be supplied to the server 10, the affiliated store terminal 20, or the administrator terminal 30 via a reading unit (e.g., an optical disk drive or a memory card slot) that reads the information storage medium, or an input / output unit (e.g., a USB port) that inputs and outputs data to and from an external device.

[0016] Furthermore, the fraud detection system 1 only needs to include at least one computer and is not limited to the example of Fig. 1. For example, the fraud detection system 1 may include only the server 10 and the administrator terminal 30, without including the affiliated store terminal 20. The fraud detection system 1 may include only the server 10, without including the affiliated store terminal 20 and the administrator terminal 30. The fraud detection system 1 may include other computers, without including the server 10, the affiliated store terminal 20, and the administrator terminal 30.

[0017] [2. Overview of the fraud detection system] In this embodiment, the fraud detection system 1 detects fraud in payment services. Fraud is any act that violates the terms of use of the payment service, any act that violates the law, or any other nuisance. Detection of fraud is detection of fraudulent acts or acts that are suspected to be fraudulent. Detection of fraud can also be considered as a presumption of fraud. For this reason, the words "detection" used in this embodiment can also be read as "presumption." The fraud detection system 1 detects fraud committed by affiliated stores, users of affiliated stores, or other persons.

[0018] In this embodiment, fraudulent acts by affiliated stores are mainly taken as an example. For example, an affiliated store commits fraud by allowing credit card payment while knowing that credit card payment is prohibited for a product or service. In other cases, an affiliated store may use its own credit card to fraudulently obtain cash. An affiliated store may also commit other fraudulent acts. In order to prevent these types of fraudulent acts, the administrator of the payment service examines and monitors affiliated stores.

[0019] FIG. 2 is a diagram showing an example of an examination performed by a payment service. For example, an applicant who wishes to join a payment service submits a prescribed application to the administrator of the payment service. The application method may be performed in accordance with the flow adopted by known payment services. For example, the applicant submits the application by transmitting the trade name, type of business, merchandise, service content, capital, business hours, owner's name, address, telephone number, fax number, email address, and other information via the Internet. The application may be made in writing.

[0020] For example, an administrator of a payment service performs an initial screening based on the contents of an application from an applicant. The initial screening is to determine whether or not to permit the applicant to participate in the payment service. The initial screening may be performed in accordance with standards adopted by known payment services. If the applicant passes the initial screening, the applicant becomes an affiliated store of the payment service. Users who visit the affiliated store will be able to use various payments supported by the payment service.

[0021] For example, since it is practically difficult for an administrator to prevent all fraudulent affiliated stores in the initial screening, the fraud detection system 1 monitors payments made at affiliated stores. Through monitoring, the fraud detection system 1 detects both fraud in individual payments and fraud across all affiliated stores. In the monitoring of this embodiment, a fraud detection model created using a machine learning technique is used. An example of a machine learning technique will be described later.

[0022] Hereinafter, the fraud detection model for detecting fraud in individual payments will be referred to as the payment fraud detection model M1. The fraud detection model for detecting fraud across all affiliated stores will be referred to as the affiliated store fraud detection model M2. The payment fraud detection model M1 has learned the characteristics of fraudulent individual payments made in the past. The affiliated store fraud detection model M2 has learned the characteristics of affiliated stores where fraudulent payments have occurred in the past. Details of the training data learned by each of the payment fraud detection model M1 and the affiliated store fraud detection model M2 will be described later.

[0023] A payment that is subject to fraud detection is called a target payment. In a payment service, all payments may be target payments, or only payments that meet certain conditions may be target payments. In addition, an affiliated store that is subject to fraud detection is called a target affiliated store. In a payment service, all payments may be target affiliated stores, or only affiliated stores that meet certain conditions may be target affiliated stores. At least one of the target payments and the target affiliated stores may be designated by an administrator of the payment service, or may be selected randomly.

[0024] For example, server 10 inputs target payment information related to the target payment into payment fraud detection model M1. The target payment information is information indicating characteristics of the target payment. For example, the target payment information indicates at least one of the payment amount, the payment date and time, information on the card such as a credit card used in the payment, information on the user's terminal used in the payment, information on the user himself, information on the product purchased by the user, and information on the service used by the user. The target payment information may also include information on the target affiliated store where the target payment was made.

[0025] For example, the payment fraud detection model M1 calculates the features of the target payment information based on its own parameters adjusted by prior learning. The payment fraud detection model M1 outputs an estimation result (labeling result) of whether the target payment is fraudulent or not based on the features of the target payment information. In this embodiment, the payment fraud detection model M1 outputs either a value indicating that the target payment is fraudulent (e.g., 1) or a value indicating that the target payment is not fraudulent (e.g., 0).

[0026] For example, server 10 inputs target franchise information regarding the target franchise into franchise fraud detection model M2. The target franchise information is information indicating the characteristics of the target franchise. For example, the target franchise information indicates at least one of the target franchise's trade name, industry, merchandise, service content, capital, business hours, owner's name, address, telephone number, fax number, and email address. The target franchise information may also include information on a target payment made at the target franchise.

[0027] For example, the affiliated store fraud detection model M2 calculates the features of the target affiliated store information based on its own parameters adjusted by prior learning. The affiliated store fraud detection model M2 outputs an estimation result (labeling result) of whether the target affiliated store is fraudulent or not based on the features of the target affiliated store information. In this embodiment, the affiliated store fraud detection model M2 outputs either a value (e.g., 1) indicating that the target affiliated store is fraudulent, or a value (e.g., 0) indicating that the target payment is not fraudulent.

[0028] For example, server 10 notifies administrator terminal 30 of a target payment in which fraud was detected by payment fraud detection model M1 and a target affiliated store in which fraud was detected by affiliated store fraud detection model M2. The administrator conducts a sales investigation of each of the target affiliated store in which the target payment in which fraud was detected by payment fraud detection model M1 occurred and the target affiliated store in which fraud was detected by affiliated store fraud detection model M2. The administrator conducts an ongoing review of the target affiliated store based on the results of the sales investigation. The sales investigation and ongoing review may be conducted according to standards set by the administrator.

[0029] In conventional payment services, the initial screening, monitoring, sales survey, and ongoing screening are each separated from each other and are performed independently of each other. In this embodiment, the initial screening, monitoring, sales survey, and ongoing screening are each related to each other, making it possible to perform a comprehensive screening that takes into consideration the overall flow of Figure 2. In such a comprehensive screening, the fraud detection system 1 uses a payment fraud detection model M1 and an affiliated store fraud detection model M2 to improve the accuracy of fraud detection in the payment service. Details of the fraud detection system 1 will be described below.

[0030] [3. Functions realized by the fraud detection system] FIG. 3 is a diagram showing an example of functions realized by the fraud detection system 1. As shown in FIG.

[0031] [3-1. Functions realized by the server] For example, server 10 includes a database storage unit 100, a payment fraud detection model storage unit 101, an affiliated store fraud detection model storage unit 102, a learning unit 103, a receiving unit 104, a target payment information acquisition unit 105, a payment fraud detection unit 106, a target affiliated store information acquisition unit 107, an affiliated store fraud detection unit 108, and a notification unit 109. The database storage unit 100, the payment fraud detection model storage unit 101, and the affiliated store fraud detection model storage unit 102 are realized by the storage unit 12. The learning unit 103, the receiving unit 104, the target payment information acquisition unit 105, the payment fraud detection unit 106, the target affiliated store information acquisition unit 107, the affiliated store fraud detection unit 108, and the notification unit 109 are realized by the control unit 11.

[0032] [Database storage section] The database storage unit 100 stores databases necessary for fraud detection. For example, the database storage unit 100 stores a target payment database DB1, a target affiliated store database DB2, a training payment database DB3, and a training affiliated store database DB4.

[0033] Fig. 4 is a diagram showing an example of the target payment database DB1. The target payment database DB1 is a database in which various information related to the target payment is stored. For example, the target payment database DB1 stores affiliated store identification information capable of identifying the affiliated store where the target payment was made, and target payment information. Any information may be stored in the target payment database DB1, and the information stored in the target payment database DB1 is not limited to the example of Fig. 4. For example, the target payment database DB1 may store information indicating the result of fraud detection by the payment fraud detection model M1.

[0034] For example, when an applicant who wishes to join the payment service passes an initial screening and is recognized as a new affiliated store, the server 10 issues affiliated store identification information to the new affiliated store. The server 10 may issue the affiliated store identification information of the new affiliated store so that the affiliated store identification information does not overlap with the affiliated store identification information of other affiliated stores. The affiliated store identification information may be in any format, for example, numbers, letters, other symbols, or a combination of these.

[0035] The target payment information may include any information related to the target payment. In the example of FIG. 4, the target payment information includes payment means identification information capable of identifying the payment means used in the target payment, the payment amount of the target payment, and the payment date and time of the target payment. The payment means identification information is information capable of identifying a payment means that can be handled in the payment service. The payment means identification information may be any information, such as a credit card number, a debit card number, an electronic money ID, user account information, a bank account, or other information. The payment amount is obtained from the affiliated store terminal 20. The payment date and time is the date and time when the payment is executed on the server 10 or another server computer. Every time a payment is executed in the payment service, a new record may be created in the target payment database DB1 and data of the payment may be stored.

[0036] FIG. 5 is a diagram showing an example of a target franchisee database DB2. The target franchisee database DB2 is a database in which various information relating to a target franchisee is stored. For example, the target franchisee database DB2 stores franchisee identification information and target franchisee information. Any information may be stored in the target franchisee database DB2, and the information stored in the target franchisee database DB2 is not limited to the example of FIG. 5. For example, the target franchisee database DB2 may store information indicating the results of fraud detection by the franchisee fraud detection model M2.

[0037] The target franchise information may include any information related to the target franchise. In the example of FIG. 5, the target franchise information indicates the trade name, business type, address, merchandise, service content, capital, business hours, and owner's name of the target franchise. In this embodiment, an example is given in which all franchisees of the payment service are target franchisees, but only some of the franchisees may be target franchisees. The target franchise information may be registered by the target franchise or by an administrator of the payment service. For example, the target franchise information includes information entered by the target franchise at the time of initial screening. The target franchise information may include information entered by the target franchise after passing the initial screening. Note that each piece of information included in the target franchise information may be text, or the text may be quantified in some form (for example, a number indicating the business type, etc.).

[0038] FIG. 6 is a diagram showing an example of the training payment database DB3. The training payment database DB3 is a database in which training data is stored for training the payment fraud detection model M1. For example, the training payment database DB3 stores a plurality of training data. Each training data is a pair of an input part and an output part. In principle, the input part and the output part of the training data have the same format as the input and output of the payment fraud detection model M1 at the time of estimation. The output part can also be said to be the correct answer at the time of learning. For example, the training data may be created manually by an administrator, or some kind of creation tool may be used.

[0039] For example, the input portion of the training data for payment fraud detection model M1 is training payment information related to a training payment, which is a payment made at a training franchisee, which is a franchisee used for training. The training payment information differs from the target payment information in that it is information about a payment made at a training franchisee, but the content of the information is similar to that of the target payment information. The output portion of the training data for payment fraud detection model M1 is information regarding whether or not the training payment is fraudulent. In this embodiment, a case is described in which the output portion of the training data for payment fraud detection model M1 is a label indicating whether or not the training payment is fraudulent, but the output portion may also be a score indicating suspicion of fraud.

[0040] FIG. 7 is a diagram showing an example of the training member store database DB4. The training member store database DB4 is a database in which training data is stored for the member store fraud detection model M2 to learn from. For example, a plurality of training data are stored in the training member store database DB4. Each training data is a pair of an input part and an output part. In principle, the input part and the output part of the training data are in the same format as the input and output of the member store fraud detection model M2 at the time of estimation. The output part can also be said to be the correct answer at the time of learning. For example, the training data may be created manually by an administrator, or some kind of creation tool may be used.

[0041] For example, the input portion of the training data of the franchisee fraud detection model M2 is training franchisee information regarding the training franchisee. The training franchisee information is different from the target franchisee information in the sense that it is information about the training franchisee, but the content of the information is similar to that of the target franchisee information. The output portion of the training data of the franchisee fraud detection model M2 is information regarding whether or not the training franchisee is fraudulent. In this embodiment, a case is described in which the output portion of the training data of the franchisee fraud detection model M2 is a label indicating whether or not the training franchisee is fraudulent, but the output portion may also be a score indicating suspicion of fraud.

[0042] The data stored in the database storage unit 100 is not limited to the above examples. The database storage unit 100 can store any data. For example, the database storage unit 100 may store a database or other data necessary for fraud detection in a payment service. Hereinafter, when there is no need to distinguish between the target payment information and the training payment information, they may simply be referred to as payment information. Similarly, when there is no need to distinguish between the target affiliated store information and the training affiliated store information, they may simply be referred to as affiliated store information.

[0043] [Payment fraud detection model memory section] The payment fraud detection model storage unit 101 stores a payment fraud detection model M1 that has learned the relationship between training payment information on a training payment, which is a payment made at a training affiliated store, and the presence or absence of fraud in the training payment. The payment fraud detection model M1 includes a program portion that performs calculations of feature amounts, etc., and a parameter portion referenced by the program portion. These feature amounts are sometimes called embedded representations. The parameter portion is changed by learning. When learning by the learning unit 103 is completed, the parameter portion of the payment fraud detection model M1 before learning is overwritten.

[0044] The payment fraud detection model M1 may be a model of any machine learning method. For example, the payment fraud detection model M1 is not limited to a supervised learning or semi-supervised learning model, and may be an unsupervised learning model. For example, the payment fraud detection model M1 may be a model of a neural network, a support vector machine, a random forest, a logistic regression, or another method. The payment fraud detection model storage unit 101 may store a program necessary for learning the payment fraud detection model M1.

[0045] [Member store fraud detection model memory section] The member store fraud detection model storage unit 102 stores the member store fraud detection model M2 that has learned the relationship between training member store information on a training member store, which is a training member store, and whether or not the training member store has committed fraud. The member store fraud detection model M2 includes a program portion that performs calculations of feature amounts, etc., and a parameter portion referenced by the program portion. This feature amount is sometimes called an embedded representation. The parameter portion is changed by learning. When learning by the learning unit 103 is completed, the parameter portion of the member store fraud detection model M2 before learning is overwritten. The member store fraud detection model storage unit 102 stores a program necessary for learning the member store fraud detection model M2.

[0046] It should be noted that the affiliated store fraud detection model M2 may be a model of any machine learning method. For example, the affiliated store fraud detection model M2 is not limited to a supervised learning or semi-supervised learning model, and may be an unsupervised learning model. For example, the affiliated store fraud detection model M2 may be a model of a neural network, a support vector machine, a random forest, a logistic regression, or other methods. The affiliated store fraud detection model storage unit 102 may store a program necessary for learning the affiliated store fraud detection model M2.

[0047] [Learning Department] The learning unit 103 executes learning of the payment fraud detection model M1 based on the training data stored in the training payment database DB3. The learning of the payment fraud detection model M1 is to adjust the parameters of the payment fraud detection model M1. For example, the learning unit 103 causes the payment fraud detection model M1 to learn all or part of the multiple training data stored in the training payment database DB3. The learning of the payment fraud detection model M1 itself can use a known machine learning method, and for example, the backpropagation method or the gradient descent method may be used. The loss function and the like used in the learning of the payment fraud detection model M1 may also be a known method. The learning unit 103 executes learning of the payment fraud detection model M1 such that when an input portion of the training data stored in the training payment database DB3 is input, an output portion of the training data is output.

[0048] For example, suppose that the training data stored in the training payment database DB3 indicates a tendency for fraud to occur frequently in payments of a certain payment amount or payments at a certain payment date and time. In this case, through learning by the learning unit 103, the payment fraud detection model M1 learns that payments of that specific payment amount or payments at that specific payment date and time are suspected of being fraudulent. This also applies when other features besides the payment amount and payment date and time are learned by the payment fraud detection model M1. The payment fraud detection model M1 learns that payments with those other features are suspected of being fraudulent.

[0049] The learning unit 103 executes learning of the member store fraud detection model M2 based on the training data stored in the training member store database DB4. The learning of the member store fraud detection model M2 is to adjust the parameters of the member store fraud detection model M2. For example, the learning unit 103 causes the member store fraud detection model M2 to learn all or part of the multiple training data stored in the training member store database DB4. The learning of the member store fraud detection model M2 itself can use a known machine learning method, and for example, the backpropagation method or the gradient descent method may be used. The loss function and the like used in the learning of the member store fraud detection model M2 may also be a known method. The learning unit 103 executes learning of the member store fraud detection model M2 such that when an input portion of the training data stored in the training member store database DB4 is input, an output portion of the training data is output.

[0050] For example, suppose that the training data stored in the training member store database DB4 indicates a tendency for fraud to occur frequently at member stores in a certain area or in a certain type of business. In this case, through learning by the learning unit 103, the member store fraud detection model M2 learns that a member store in that specific area or in that specific type of business is suspected of fraud. This also applies when other characteristics besides area and business type are learned by the member store fraud detection model M2. The member store fraud detection model M2 learns that a member store with those other characteristics is suspected of fraud.

[0051] In this embodiment, the member store fraud detection model M2 has learned more characteristics of the training member stores than the payment fraud detection model M1. For example, the training data stored in the training payment database DB3 may not include the characteristics of the training member stores, but may include only the characteristics of the training payments. The training data stored in the training member store database DB4 includes the characteristics of the training member stores.

[0052] The training data stored in the training payment database DB3 may include characteristics of the training member stores. In this case, the training data stored in the training member store database DB4 includes more characteristics of the training member stores than the characteristics of the training member stores included in the training data stored in the training payment database DB3. For example, if the training data stored in the training payment database DB3 includes n (n is a natural number) characteristics of the training member stores, the training data stored in the training member store database DB4 includes m (m is an integer greater than n) characteristics of the training member stores.

[0053] [Receiver] The receiving unit 104 acquires payment information and affiliated store information from the affiliated store terminal 20. When the receiving unit 104 receives payment information to be learned by the payment fraud detection model M1, it stores the payment information as training payment information in the training payment database DB3. When the receiving unit 104 receives payment information to be estimated by the payment fraud detection model M1, it stores the payment information as target payment information in the training payment database DB3. When the receiving unit 104 receives affiliated store information to be learned by the affiliated store fraud detection model M2, it stores the affiliated store information as training affiliated store information in the training affiliated store database DB4. When the receiving unit 104 receives affiliated store information to be estimated by the affiliated store fraud detection model M2, it stores the affiliated store information as target affiliated store information in the training affiliated store database DB4.

[0054] [Target payment information acquisition section] The target payment information acquisition unit 105 acquires target payment information related to a target payment, which is a payment made at a target affiliated store. In this embodiment, since the target payment information is stored in the target payment database DB1, the target payment information acquisition unit 105 acquires all or a part of the target payment information stored in the target payment database DB1. If the target payment information is recorded in a computer or an external storage medium other than the server 10, the target payment information acquisition unit 105 acquires the target payment information from the other computer or external storage medium. For example, the target payment information acquisition unit 105 may acquire the target payment information from the affiliated store terminal 20 or the administrator terminal 30.

[0055] [Payment Fraud Detection Department] The payment fraud detection unit 106 detects fraud in a target payment based on the target payment information acquired by the target payment information acquisition unit 105 and the payment fraud detection model M1. For example, the payment fraud detection unit 106 inputs the target payment information to the trained payment fraud detection model M1. The payment fraud detection unit 106 may perform preprocessing such as normalization or aggregation on the target payment information, and input the preprocessed target payment information to the trained payment fraud detection model M1.

[0056] For example, the payment fraud detection model M1 calculates features of the target payment information based on parameters adjusted by the learning unit 103. The payment fraud detection model M1 estimates whether the target payment is fraudulent or not based on the calculated features. The payment fraud detection model M1 outputs an estimation result of whether the target payment is fraudulent or not. In other words, the payment fraud detection model M1 performs labeling of whether the target payment is fraudulent or not. The estimation result can also be said to be a label indicating whether it is fraudulent or not. The payment fraud detection model M1 may output a score indicating the suspicion of fraud of the target payment.

[0057] For example, the payment fraud detection unit 106 detects, as a fraudulent target payment, a target payment that is estimated to be fraudulent by the payment fraud detection model M1 among multiple target payments processed by the payment fraud detection model M1. When the payment fraud detection model M1 outputs a score, the payment fraud detection unit 106 detects, as a fraudulent target payment, a target payment whose score output by the payment fraud detection model M1 is equal to or greater than a threshold among multiple target payments processed by the payment fraud detection model M1. The payment fraud detection unit 106 may detect, without using a threshold, a target payment that is equal to or greater than a predetermined rank when multiple target payments are sorted in descending order of score as a fraudulent target payment.

[0058] When a payment request is sent from the affiliated store terminal 20 to the server 10, the payment fraud detection unit 106 may determine whether or not there is fraud by treating the payment as the target payment. The payment fraud detection unit 106 may not determine whether or not there is fraud at the time of the actual payment, but may determine whether or not there is fraud after the fact. For example, the payment fraud detection unit 106 may determine whether or not there is fraud by batch processing of date and time, etc., by treating multiple payments made within a certain period as the target payments.

[0059] [Target affiliate store information acquisition department] The target member store information acquisition unit 107 acquires target member store information related to a target member store that has passed the initial screening of the payment service and is a member store that is subject to fraud detection. In this embodiment, since the target member store information is stored in the target member store database DB2, the target member store information acquisition unit 107 acquires all or a part of the target member store information stored in the target member store database DB2. If the target member store information is recorded in a computer or external storage medium other than the server 10, the target member store information acquisition unit 107 acquires the target member store information from the other computer or external storage medium. For example, the target member store information acquisition unit 107 may acquire the target member store information from the member store terminal 20 or the administrator terminal 30.

[0060] [Affiliate Fraud Detection Department] The affiliated store fraud detection unit 108 detects fraud at a target affiliated store based on the target affiliated store information acquired by the target affiliated store information acquisition unit 107 and the affiliated store fraud detection model M2. For example, the affiliated store fraud detection unit 108 inputs the target affiliated store information to the trained affiliated store fraud detection model M2. The affiliated store fraud detection unit 108 may perform preprocessing, such as normalization or aggregation, on the target affiliated store information, and input the target affiliated store information on which the preprocessing has been performed to the trained affiliated store fraud detection model M2.

[0061] For example, the member store fraud detection model M2 calculates features of the target member store information based on parameters adjusted by the learning unit 103. The member store fraud detection model M2 estimates whether the target member store is fraudulent or not based on the calculated features. The member store fraud detection model M2 outputs an estimation result of whether the target member store is fraudulent or not. In other words, the member store fraud detection model M2 performs labeling of whether the target member store is fraudulent or not. The estimation result can also be said to be a label indicating whether it is fraudulent or not. The member store fraud detection model M2 may output a score indicating the suspicion of fraud of the target member store.

[0062] For example, the member store fraud detection unit 108 detects, as a fraudulent target member store, a target member store that is estimated to be fraudulent by the member store fraud detection model M2 among a plurality of target member stores that are the subject of processing by the member store fraud detection model M2. When the member store fraud detection model M2 outputs a score, the member store fraud detection unit 108 detects, as a fraudulent target member store, a target member store whose score output by the member store fraud detection model M2 is equal to or higher than a threshold among a plurality of target member stores that are the subject of processing by the member store fraud detection model M2. The member store fraud detection unit 108 may detect, as a fraudulent target member store, a target member store that is ranked equal to or higher than a predetermined rank when the plurality of target member stores are arranged in descending order of score, without using a threshold.

[0063] When a payment request is sent from the affiliated store terminal 20 of a certain affiliated store to the server 10, the affiliated store fraud detection unit 108 may determine whether or not fraud has occurred, regarding that affiliated store as a target affiliated store. The affiliated store fraud detection unit 108 may not determine whether or not fraud has occurred at the time of the actual payment, but may determine whether or not fraud has occurred after the fact. For example, the affiliated store fraud detection unit 108 may determine whether or not fraud has occurred, regarding multiple affiliated stores at which payments have been made within a certain period of time as target affiliated stores, by batch processing of date and time, etc.

[0064] [Notification Department] The notification unit 109 notifies the administrator terminal 30 of fraud detected in the payment service. The notification unit 109 may notify the administrator terminal 30 of fraud based on a predetermined notification means. For example, the notification unit 109 notifies the administrator terminal 30 based on email, messenger, chat, or other tools. If an application for the administrator is installed on the administrator terminal 30, the notification unit 109 may notify on the application.

[0065] Fig. 8 is a diagram showing an example of a notification displayed on the administrator terminal 30. For example, the notification unit 109 notifies the administrator terminal 30 of details of the target payment information that is presumed to be fraudulent by the payment fraud detection model M1. The notification unit 109 notifies the administrator terminal 30 of details of the target affiliated store information that is presumed to be fraudulent by the affiliated store fraud detection model M2. The notification unit 109 makes the notification by transmitting data indicating the notification in Fig. 8 to the administrator terminal 30.

[0066] For example, the administrator checks the notification in FIG. 8 and conducts a sales investigation and ongoing review of the target payment and the target merchant in which fraud was detected. The administrator checks the details of the target payment and the target merchant in which fraud was detected from the notification in FIG. 8. The administrator takes steps to cancel the target payment that is ultimately determined to be fraudulent, or to suspend the use of the payment method, such as a credit card, used in the target payment. The administrator takes steps to suspend the use of the payment service by the target merchant that is ultimately determined to be fraudulent, or to withdraw the target merchant from the payment service.

[0067] [3-2. Functions realized by affiliated store terminals] The affiliated store terminal 20 includes a data storage unit 200 and a transmission unit 201. The data storage unit 200 is realized by the storage unit 22. The transmission unit 201 is realized by the control unit 21.

[0068] [Data storage section] The data storage unit 200 stores data necessary for the affiliated store to use the payment service. For example, the data storage unit 200 stores an application for the affiliated store of the payment service. The application includes a code for the affiliated store terminal 20 to generate payment information and a code for the affiliated store terminal 20 to generate affiliated store information.

[0069] [Transmitter] The transmission unit 201 transmits various information to the server 10. For example, when a payment is made at an affiliated store, the transmission unit 201 transmits payment information of the payment to the server 10. When a person in charge of the affiliated store edits the affiliated store information, the transmission unit 201 transmits the edited affiliated store information to the server 10.

[0070] [3-3. Functions realized on the administrator terminal] The administrator terminal 30 includes a data storage unit 300, a display control unit 301, and an operation reception unit 302. The data storage unit 300 is realized by the storage unit 32. The display control unit 301 and the operation reception unit 302 are realized by the control unit 31.

[0071] [Data storage section] The data storage unit 300 stores data necessary for the administrator's work in the payment service. For example, the data storage unit 300 stores an application for the administrator.

[0072] [Display control section] The display control unit 301 causes various screens to be displayed on the display unit 35. For example, the display control unit 301 causes the display unit 35 to display the notification of Fig. 8 based on an application for the administrator.

[0073] [Operation reception section] The operation receiving unit 302 receives various operations performed from the operation unit 34. For example, the operation receiving unit 302 receives operations on the notification or other screens of FIG. 8. The operation contents received by the operation receiving unit 302 are transmitted to the server 10.

[0074] [4. Processing performed by the fraud detection system] Fig. 9 is a diagram showing an example of processing executed by the fraud detection system 1. The processing in Fig. 9 is executed by the control units 11, 21, and 31 operating in accordance with programs stored in the storage units 12, 22, and 32, respectively.

[0075] As shown in FIG. 9, the server 10 trains a payment fraud detection model M1 based on the training data stored in a training payment database DB3 (S1). The server 10 trains a member store fraud detection model M2 based on the training data stored in a training member store database DB4 (S2). The member store terminal 20 transmits at least one of the target payment information and the target member store information to the server 10 (S3). The member store terminal 20 may transmit the target payment information to the server 10 each time a payment is made at the member store. The member store terminal 20 may transmit the target member store information to the server 10 each time the member store performs an operation to update the target member store information.

[0076] When server 10 receives at least one of the target payment information and the target affiliated store information (S4), it stores the received target payment information in target payment database DB1 (S5). Server 10 stores the received target affiliated store information in target affiliated store database DB2 (S6). If server 10 does not receive the target payment information, processing of S5 is not executed. If server 10 does not receive the target affiliated store information, processing of S6 is not executed.

[0077] Server 10 performs fraud detection of the target payment based on the target payment information of the target payment stored in target payment database DB1 and payment fraud detection model M1 (S7). Server 10 performs fraud detection of the target affiliated store based on the target affiliated store information of the target affiliated store stored in target affiliated store database DB2 and affiliated store fraud detection model M2 (S8). Server 10 notifies administrator terminal 30 based on the results of the fraud detection performed in S7 and the results of the fraud detection performed in S8 (S9). When administrator terminal 30 receives the notification from server 10 (S10), it displays the notification received from server 10 on display unit 35 (S11), and this process ends.

[0078] [5. Summary of the embodiment] The fraud detection system 1 of this embodiment detects fraud by a target affiliated store based on the target affiliated store information and the affiliated store fraud detection model M2. Since the fraud detection system 1 can detect fraud by a target affiliated store, it can improve the accuracy of fraud detection in a payment service. For example, a target affiliated store may intentionally perform a credit card payment for a product or service for which credit card payment is prohibited. Such fraud may occur frequently in a target affiliated store having a certain characteristic. If the affiliated store fraud detection model M2 learns the tendency of fraud by such an affiliated store, the fraud detection system 1 can detect fraud by such an affiliated store. Furthermore, since the payment fraud detection model M1 is a fraud detection that focuses on individual target payments, it is suitable for detecting fraud by taking into account local characteristics, whereas the affiliated store fraud detection model M2 is a fraud detection that focuses on a target affiliated store, it is suitable for detecting fraud that occurs over a longer period of time. For example, the fraud detection system 1 can detect a target affiliated store where fraud frequently occurs by taking into account longer-term characteristics.

[0079] Furthermore, fraud detection system 1 detects fraud in a target payment based on the target payment information and payment fraud detection model M1. Member store fraud detection model M2 has learned more characteristics about the training member store than payment fraud detection model M1. Fraud detection system 1 can detect fraud in individual payments using payment fraud detection model M1 while detecting fraud by the member store itself using member store fraud detection model M2, thereby improving the accuracy of fraud detection in payment services.

[0080] [6. Modifications] The present disclosure is not limited to the embodiments, and may be modified as appropriate without departing from the spirit and scope of the present disclosure.

[0081] 10 is a diagram showing an example of functions realized in the fraud detection system 1 of the modified example. For example, the server 10 includes a condition determination unit 110, an initial screening model creation unit 111, an initial screening model storage unit 112, and an initial screening process execution unit 113. The initial screening model storage unit 112 is realized by the storage unit 12. Each of the condition determination unit 110, the initial screening model creation unit 111, and the initial screening process execution unit 113 is realized by the control unit 11.

[0082] [6-1. Variation 1] For example, the target affiliated store information may include target result information regarding the result of fraud detection of the target payment performed by the payment fraud detection model M1. In the first variant, an example is given in which the target result information indicates the number of target payments in which fraud was detected by the payment fraud detection model M1 among multiple target payments performed at the target affiliated store in the past. When a target payment performed at a target affiliated store is processed by the payment fraud detection unit 106, the server 10 updates the target result information of the target affiliated store based on the result of fraud detection of the target payment. The target result information is stored in the target affiliated store database DB2 as target affiliated store information.

[0083] The target result information is not limited to the above example, and may be any information based on the result of fraud detection of a target payment made at a target affiliated store. For example, the target result information may indicate the number of target payments for which fraud was detected by the payment fraud detection model M1 during the most recent specified period (e.g., the past three months). The target result information may indicate the proportion or frequency of target payments for which fraud was detected by the payment fraud detection model M1 during the most recent specified period. When a target payment made at a target affiliated store is processed by the payment fraud detection unit 106, the server 10 may tally up these target result information based on the result of fraud detection of the target payment.

[0084] The training member store information of the first modification includes training result information regarding the results of fraud detection of training payments made by the payment fraud detection model M1. The training result information differs from the target result information in that it is information for training the member store fraud detection model M2, but is otherwise similar to the target result information. In the first modification, an example is given in which the training result information indicates the number of training payments in which fraud was detected among multiple training payments made in the past at the training member store. Fraud in the training payments may be detected by the payment fraud detection model M1, which is temporarily created based on the training data described in the embodiment (training data that does not include the training result information), or may be manually annotated by an administrator.

[0085] The franchisee fraud detection unit 108 of the first modification detects fraud at a target franchisee based on target franchisee information including target result information and the franchisee fraud detection model M2. For example, the franchisee fraud detection unit 108 inputs target franchisee information including target result information to the learned franchisee fraud detection model M2. Although the content of the target franchisee information input to the franchisee fraud detection model M2 differs from that of the embodiment, the processing executed by the franchisee fraud detection model M2 is the same as that of the embodiment.

[0086] The target affiliated store information of variant 1 includes target result information. The training affiliated store information includes training result information. The fraud detection system 1 detects fraud at the target affiliated store based on the target affiliated store information including the target result information and the affiliated store fraud detection model M2. This enables the affiliated store fraud detection model M2 to detect fraud at the target affiliated store by taking into account the estimation results by the payment fraud detection model M1, thereby improving the accuracy of fraud detection in the payment service. For example, there may be a causal relationship between the presence or absence of fraud in individual payments and the presence or absence of fraud at the target affiliated store, and the affiliated store fraud detection model M2 that has learned such a causal relationship can detect fraud at the affiliated store.

[0087] [6-2. Variation 2] For example, the target affiliated store information may include only information about the target affiliated store itself, but may also include some information about the target payment. In Variation 2, an example is given in which the target affiliated store information includes not only static information such as the address of the target affiliated store, but also the difference between the average amount of target payments made at the target affiliated store in the past three months and the payment amount of the current target payment (a specific target payment). The target affiliated store information may include other information, such as the payment amount of the current target payment, instead of the difference.

[0088] Similarly, the training franchise information may include only information about the training franchise itself, but may also include some information about the training payment. In variant example 2, the training franchise information includes not only static information such as the address of the training franchise, but also the difference between the average amount of training payments made at the training franchise in the last three months and the payment amount of the current training payment (a particular training payment). The training franchise information may include other information, such as the payment amount of the current training payment, instead of the difference.

[0089] Although all payments at a certain target affiliated store may be target payments, in the second modification, only payments that satisfy a certain condition are considered to be target payments. Hereinafter, the condition is referred to as a processing target condition. The processing target condition may be any condition that can be determined based on payment information. In the second modification, a case where the processing target condition is that the payment amount is equal to or greater than a threshold is taken as an example. The processing target condition may be other conditions, such as the date and time of payment, the product purchased by the user at the target affiliated store, the service used by the user at the target affiliated store, or other conditions. The processing target conditions are considered to be stored in advance in the database storage unit 100. The administrator may change the processing target conditions.

[0090] The fraud detection system 1 of the second modification includes a condition determination unit 110. The condition determination unit 110 determines whether a target payment satisfies a processing target condition that is to be processed by the payment fraud detection model M1. The condition determination unit 110 determines whether a target payment satisfies the processing target condition based on target payment information of a target payment. In the second modification, it determines whether the payment amount indicated by the target payment information of a target payment is equal to or greater than a threshold. If the processing target condition is another condition, the condition determination unit 110 may determine whether the target payment satisfies the processing target condition by executing processing according to the other condition.

[0091] The payment fraud detection unit 106 of the second modification sets a target payment that satisfies the processing target condition as a processing target for the payment fraud detection model M1. That is, the payment fraud detection unit 106 determines, from among multiple payments made at a target affiliated store, a payment that satisfies the processing target condition as a target payment. The payment fraud detection unit 106 detects fraud in the target payment based on the target payment information of the target payment and the payment fraud detection model M1. The payment fraud detection unit 106 does not set a target payment that does not satisfy the processing target condition as a processing target for the payment fraud detection model M1. Note that the training data for the payment fraud detection model M1 may be created regardless of the processing target condition, or may be created based on training payment information of a training payment that satisfies the processing target condition.

[0092] The affiliated store fraud detection unit 108 of the second modification treats the target affiliated store where the target payment has been made as the processing target of the affiliated store fraud detection model M2, regardless of the processing target condition. For example, the affiliated store fraud detection unit 108 detects fraud at the target affiliated store based on the target affiliated store information of the target affiliated store and the affiliated store fraud detection model M2 each time a payment is made at the target affiliated store. The affiliated store fraud detection unit 108 may infer fraud at the target affiliated store only when some of the payments have been made, rather than inferring fraud at the target affiliated store when all payments have been made at the target affiliated store. In this case, the some payments are determined based on conditions different from the processing target condition (e.g., randomly selected, etc.).

[0093] The fraud detection system 1 of the second modification determines whether a target payment satisfies the processing target conditions that are the processing target of the payment fraud detection model M1. The fraud detection system 1 treats a target payment that satisfies the processing target conditions as the processing target of the payment fraud detection model M1. The fraud detection system 1 treats a target affiliated store where a target payment has been made as the processing target of the affiliated store fraud detection model M2, regardless of the processing target conditions. This reduces the processing load on the server 10, as not all target payments are subject to processing by the payment fraud detection model M1. Furthermore, since the processing target of the affiliated store fraud detection model M2 is determined regardless of the processing target conditions, it can detect fraud by the affiliated store itself that cannot be detected by the payment fraud detection model M1.

[0094] [6-3. Variation 3] For example, the affiliated store fraud detection unit 108 may obtain a target affiliated store score regarding fraud of the target affiliated store output by the affiliated store fraud detection model M2. In the third variant example, a case is described in which the target affiliated store score is expressed as a numerical value, but the target affiliated store score may be expressed in other forms such as letters or symbols. The target affiliated store score indicates the degree of suspicion of fraud estimated by the affiliated store fraud detection model M2. The degree is sometimes called the probability. For example, the target affiliated store score is expressed as a numerical value between 0 and 1. The higher the numerical value of the target affiliated store score, the higher the suspicion that the target affiliated store is fraudulent. The target affiliated store score can also be said to be the accuracy of the estimation result of the affiliated store fraud detection model M2.

[0095] For example, the affiliated store fraud detection unit 108 obtains a target payment score related to fraud of the target payment output by the payment fraud detection model M1. In the third variant example, a case will be described in which the target payment score is expressed as a numerical value, but the target payment score may be expressed in other forms such as letters or symbols. The target payment score indicates the degree of suspicion of fraud estimated by the payment fraud detection model M1. The degree is sometimes called the probability. For example, the target payment score is expressed as a numerical value between 0 and 1. The higher the numerical value of the target payment score, the higher the suspicion that the target payment is fraudulent. The target payment score can also be said to be the accuracy of the estimation result of the payment fraud detection model M1.

[0096] For example, the affiliated store fraud detection unit 108 calculates a total score for fraud of the target affiliated store and the target payment based on the target affiliated store score and the target payment score. In the third modification, an example is given in which the affiliated store fraud detection unit 108 calculates the sum of the target affiliated store score and the target payment score as the total score, but the affiliated store fraud detection unit 108 may calculate the total score based on a predetermined calculation method. For example, the affiliated store fraud detection unit 108 may calculate the average of the target affiliated store score and the target payment score as the total score. The affiliated store fraud detection unit 108 may calculate the total score based on the target affiliated store score, the target payment score, and a calculation formula including a predetermined weighting coefficient. The affiliated store fraud detection unit 108 may calculate the total score based on the target affiliated store score, the target payment score, and a machine learning model such as a support vector machine.

[0097] For example, the affiliated store fraud detection unit 108 detects fraud by a target affiliated store based on the total score. The affiliated store fraud detection unit 108 determines whether the total score is equal to or greater than a threshold. If the affiliated store fraud detection unit 108 determines that the total score is less than the threshold, it does not determine that the target affiliated store is fraudulent, and if the affiliated store fraud detection unit 108 determines that the total score is equal to or greater than the threshold, it determines that the target affiliated store is fraudulent. The processing after the affiliated store fraud detection unit 108 detects fraud may be similar to that of the embodiment.

[0098] The fraud detection system 1 of the third modification calculates an overall score for fraud of the target member store and the target payment based on the target member store score and the target payment score, and detects fraud by the target member store based on the overall score. The fraud detection system 1 can detect fraud by the target member store by comprehensively taking into account the estimation results of both the payment fraud detection model M1 and the member store fraud detection model M2. In addition, the administrator of the payment service can determine fraud by the target member store based on an easy-to-understand index such as the overall score.

[0099] [6-4. Variation 4] For example, as explained somewhat in the embodiment, the target franchise information may include target registration information, which is information about the target franchise registered by the target franchise. The target registration information is at least one of information entered by the target franchise when applying for membership in the payment service as an applicant and information entered by the target franchise after passing the initial screening of the payment service. The training franchise information includes training registration information, which is information about the training franchise registered by the training franchise. The training registration information differs from the target registration information in that it is information for training the franchise fraud detection model M2, but is similar to the target registration information in other respects.

[0100] The affiliated store fraud detection unit 108 detects fraud at a target affiliated store based on target affiliated store information including target registration information and the affiliated store fraud detection model M2. For example, the affiliated store fraud detection unit 108 inputs target affiliated store information including target registration information to the learned affiliated store fraud detection model M2. Although the content of the target affiliated store information input to the affiliated store fraud detection model M2 differs from that of the embodiment, the processing executed by the affiliated store fraud detection model M2 is the same as that of the embodiment.

[0101] The target franchise information in variant 4 includes the target registration information. The training franchise information includes the training registration information. The franchise fraud detection unit 108 detects fraud by the target franchise based on the target franchise information including the target registration information and the franchise fraud detection model M2. This allows the franchise fraud detection model M2 to detect fraud by the target franchise based on the target registration information registered by the target franchise, thereby improving the accuracy of fraud detection in the payment service. For example, there may be a causal relationship between the target registration information registered by the target franchise and whether or not the target franchise commits fraud, and the franchise fraud detection model M2 that has learned such a causal relationship can detect fraud by the franchise.

[0102] [6-5. Variation 5] For example, as explained somewhat in the second variant, the target affiliated store information may include target difference information relating to the difference between multiple target payments, which are multiple payments made at the target affiliated store. The difference may also be referred to as a disparity or difference. In the fifth variant, an example is given in which the target difference information indicates the difference between the average amount of target payments made at the target affiliated store in the past three months and the payment amount of the current target payment. The target difference information may indicate a difference other than the difference in amount. For example, the target difference information may be the difference between the time period with the greatest number of target payments in a day, the difference in the frequency of target payments, the difference in the products purchased in the target payments, the difference in the services used in the target payments, or other differences.

[0103] The training member store information of the fifth variation includes training difference information relating to the difference between multiple training payments, which are multiple payments made at the training member store. For example, the training difference information indicates the difference between the average amount of training payments made at the training member store in the last three months and the payment amount of the current training payment. The training difference information may indicate differences other than the difference in amount. For example, the training difference information may be the difference between the time period with the greatest number of training payments in a day, the difference in the frequency of training payments, the difference in the products purchased in the training payments, the difference in the services used in the training payments, or other differences.

[0104] The franchisee fraud detection unit 108 of the fifth modified example detects fraud at a target franchisee based on target franchisee information including target difference information and the franchisee fraud detection model M2. For example, the franchisee fraud detection unit 108 inputs target franchisee information including target difference information to the learned franchisee fraud detection model M2. Although the content of the target franchisee information input to the franchisee fraud detection model M2 differs from that of the embodiment, the processing executed by the franchisee fraud detection model M2 is the same as that of the embodiment.

[0105] The target member store information of variant 5 includes target difference information. The training member store information includes training difference information. The fraud detection system 1 detects fraud at a target member store based on the target member store information including the target difference information and the member store fraud detection model M2. This enables the member store fraud detection model M2 to detect fraud at a target member store by taking into account the differences between multiple target payments, thereby improving the accuracy of fraud detection in payment services. For example, there may be a causal relationship between the target difference information at a target member store and the presence or absence of fraud at the target member store, and the member store fraud detection model M2 that has learned such a causal relationship can detect fraud at the member store.

[0106] [6-6. Variation 6] For example, to further strengthen the comprehensive screening described in FIG. 2, the results of fraud detection by the affiliated store fraud detection model M2 may be fed back to the initial screening. The initial screening may be performed manually by an administrator of the payment service, but in variant example 6, a case is described in which a model for the initial screening is created based on the results of fraud detection by the affiliated store fraud detection model M2. Hereinafter, this model is referred to as the initial screening model M3. The initial screening model M3 is stored in the initial screening model memory unit 112.

[0107] The fraud detection system 1 includes an initial screening model creation unit 111 and an initial screening process execution unit 113. The initial screening model creation unit 111 creates an initial screening model M3 for initial screening of an applicant who has applied for membership in a payment service, based on fraud of a target affiliated store detected by the affiliated store fraud detection model M2. The initial screening model M3 includes a program portion that performs calculations of features, etc., and a parameter portion referenced by the program portion. These features are sometimes called embedded representations. The parameter portion is changed by learning. When learning by the initial screening model creation unit 111 is completed, the parameter portion of the initial screening model M3 before learning is overwritten.

[0108] The initial screening model M3 may be a model of any machine learning method. For example, the initial screening model M3 is not limited to a supervised learning or semi-supervised learning model, and may be an unsupervised learning model. For example, the initial screening model M3 may be a model of a neural network, a support vector machine, a random forest, a logistic regression, or other methods.

[0109] For example, the initial screening model creation unit 111 creates training data for the initial screening model M3 based on the fraud of the target franchisee detected by the franchisee fraud detection model M2. In principle, the input and output parts of the training data are in the same format as the input and output of the initial screening model M3 at the time of estimation. The output part can also be said to be the correct answer at the time of learning. For example, the training data may be created manually by an administrator, or some kind of creation tool may be used.

[0110] The initial screening model creation unit 111 may create training data for the initial screening model M3 based on information about the target affiliated store where the payment detected by the payment fraud detection model M1 was made. The initial screening model creation unit 111 may create training data for the initial screening model M3 based on the detection results of at least one of the payment fraud detection model M1 and the affiliated store fraud detection model M2.

[0111] For example, the input portion of the training data of the initial screening model M3 is training applicant information relating to a training applicant who is an applicant for training. The training applicant information may be information input as an applicant by a target franchisee in which fraud has been detected by the franchisee fraud detection model M2. The training applicant information may be information registered after the fact by a target franchisee in which fraud has been detected by the franchisee fraud detection model M2. In variant example 6, a case is described in which the output portion of the training data of the initial screening model M3 is a label indicating whether the training applicant is fraudulent or not, but the output portion may also be a score indicating suspicion of fraud.

[0112] For example, the initial screening model creation unit 111 determines, as the output part of the training data of the initial screening model M3, a label indicating whether or not a training applicant has been detected as a fraudulent target affiliate by the affiliate fraud detection model M2 after the training applicant has joined the payment service as an affiliate. The initial screening model creation unit 111 may also determine, as the output part of the training data of the initial screening model M3, the annotation result by the administrator who has seen the notification in FIG. 8. The initial screening model creation unit 111 successively creates training data for the initial screening model M3 and records it in the database storage unit 100.

[0113] For example, the initial screening model creation unit 111 trains the initial screening model M3 on all or part of the multiple training data of the initial screening model M3. The training of the initial screening model M3 is to adjust the parameters of the initial screening model M3. The training of the initial screening model M3 itself can use a known machine learning method, and for example, the backpropagation method or the gradient descent method may be used. The loss function used in the training of the initial screening model M3 may also be a known method. The initial screening model creation unit 111 executes training of the initial screening model M3 such that when an input portion of training data is input, an output portion of the training data is output. The initial screening model creation unit 111 records the trained initial screening model M3 in the initial screening model storage unit 112.

[0114] The initial screening process execution unit 113 executes initial screening process for the initial screening of the applicant based on the initial screening model M3. For example, the initial screening process execution unit 113 acquires target applicant information input by a target applicant, who is an applicant to be processed by the initial screening model M3. The target applicant information differs from training applicant information in that it is information about training applicants, but the content of the information is similar to that of training applicant information. For example, the initial screening process execution unit 113 inputs the target applicant information to the trained initial screening model M3. The initial screening process execution unit 113 may perform preprocessing such as normalization or aggregation on the target applicant information, and input the target applicant information for which preprocessing has been performed to the trained initial screening model M3.

[0115] For example, the initial screening model M3 calculates the feature amount of the target affiliated store information based on the parameters adjusted by the initial screening model creation unit 111. The initial screening model M3 estimates whether the target applicant will commit fraud after becoming an affiliated store based on the calculated feature amount. The initial screening model M3 outputs an estimation result of whether the target applicant is fraudulent or not. In other words, the initial screening model M3 performs labeling of whether the target applicant is fraudulent or not. The estimation result can also be called a label indicating whether or not the applicant is fraudulent. The initial screening model M3 may output a score indicating the suspicion of fraud of the target applicant. The output by the initial screening model M3 is notified to the administrator. The administrator uses the output by the initial screening model M3 as a reference to assess whether or not to affiliate the target applicant with the payment service.

[0116] The fraud detection system 1 of the sixth modified example creates an initial screening model M3 based on the fraud of the target franchisee detected by the franchisee fraud detection model M2. The fraud detection system 1 executes an initial screening process for the initial screening of the applicant based on the initial screening model M3. The fraud detection system 1 can improve the accuracy of the initial screening by using the initial screening model M3 to which the estimation results of the franchisee fraud detection model M2 are fed back. For example, it is possible to prevent a fraudulent franchisee that would have passed a conventional initial screening from passing the initial screening. In the case of the screening example shown in FIG. 2, knowledge gained from screening after monitoring can be fed back to the initial screening.

[0117] [6-7. Variation 7] For example, as described in the embodiment, when fraud at a target affiliated store is detected by the affiliated store fraud detection unit 108, an examination of the target affiliated store is conducted by the administrator of the payment service (sales investigation and ongoing examination in FIG. 2). Therefore, the results of the examination may be fed back to the initial examination. The initial examination model creation unit 111 of variant example 7 creates an initial examination model M3 for the initial examination of applicants who have applied for membership in the payment service based on the examination results by the administrator.

[0118] For example, the initial screening model creation unit 111 creates training data for the initial screening model M3 based on the results of at least one of the sales survey and the on-going screening in FIG. 2. The results of at least one of the sales survey and the on-going screening are a label indicating whether the training franchisee is fraudulent. This label is to be designated by the administrator who conducted at least one of the sales survey and the on-going screening. The input portion of the training data for the initial screening model M3 is the same as in variant 6. In variant 7, the output portion of the training data for the initial screening model M3 indicates the results of at least one of the sales survey and the on-going screening in FIG. 2. The output portion may be a score indicating suspicion of fraud. The processing after the training data for the initial screening model M3 is created may be the same as in variant 6.

[0119] The initial screening process execution unit 113 of the seventh modification executes the initial screening process for the applicant based on the initial screening model M3. Although the method of creating the initial screening model M3 is different from that of the sixth modification, the initial screening process executed by the initial screening process execution unit 113 may be the same as that of the sixth modification.

[0120] The fraud detection system 1 of the seventh modification creates an initial screening model M3 based on the screening results by the administrator. The fraud detection system 1 executes an initial screening process for the initial screening of the applicant based on the initial screening model M3. The fraud detection system 1 can improve the accuracy of the initial screening by using the initial screening model M3 to which the screening results by the administrator are fed back. For example, it is possible to prevent fraudulent affiliated stores that would have passed a conventional initial screening from passing the initial screening. In the case of the screening example shown in FIG. 2, knowledge gained from screening after monitoring can be fed back into the initial screening.

[0121] [6-8. Variation 8] For example, the target affiliated store information may include target initial screening information regarding the processing results of the target affiliated store by the initial screening model M3 regarding the initial screening of an applicant who has applied for membership in the payment service. The initial screening model M3 may be created by the initial screening model creation unit 111 of variant example 6 or variant example 7, or may be created by another creation method. For example, another creation method may be a method in which the initial screening model M3 is created based on training data manually annotated by an administrator.

[0122] For example, the target initial screening information indicates the estimated result of the initial screening model M3 when the target affiliated store applies as an applicant for affiliation to the payment service. Even if the estimated result of the initial screening model M3 is that the applicant is fraudulent, the applicant may pass the initial screening if the administrator does not determine that the applicant is fraudulent. For this reason, the target initial screening information may indicate that the initial screening was fraudulent. The target initial screening information may also indicate the score output by the initial screening model M3.

[0123] The training franchise information includes training initial screening information regarding the processing results of the training franchise by the initial screening model M3. The training initial screening information differs from the target initial screening information in that it is information for training the franchise fraud detection model M2, but is otherwise similar to the target initial screening information. In variant example 8, the training initial screening information indicates the estimated results of the initial screening model M3 when the training franchise applies for membership in the payment service as an applicant.

[0124] The franchisee fraud detection unit 108 of the eighth variant detects fraud at a target franchisee based on target franchisee information including target initial screening information and the franchisee fraud detection model M2. For example, the franchisee fraud detection unit 108 inputs target franchisee information including target initial screening information to the learned franchisee fraud detection model M2. Although the content of the target initial screening information input to the franchisee fraud detection model M2 differs from that of the embodiment, the processing executed by the franchisee fraud detection model M2 is the same as that of the embodiment.

[0125] The target member store information of variant example 8 includes target initial screening information. The training member store information includes training initial screening information. The fraud detection system 1 detects fraud by the target member store based on the target member store information including the target initial screening information and the member store fraud detection model M2. This enables the member store fraud detection model M2 to detect fraud by the target member store by taking into account the estimation results by the initial screening model M3, thereby improving the accuracy of fraud detection in the payment service. For example, there may be a causal relationship between the results of the initial screening of the target member store and whether or not the target member store has committed fraud, and the member store fraud detection model M2 that has learned such a causal relationship can detect fraud by the member store.

[0126] [6-9. Variation 9] For example, similar to Variation 3, the affiliated store fraud detection unit 108 may obtain a target affiliated store score related to fraud of the target affiliated store output by the affiliated store fraud detection model M2. In Variation 9, the overall score is calculated based on the score output by the initial screening model M3, rather than the target payment score as in Variation 3. Hereinafter, this score is referred to as the initial screening score.

[0127] The affiliated store fraud detection unit 108 of variant 9 obtains an initial screening score for the initial screening of the target affiliated store output by the initial screening model M3 for the initial screening of the applicant who applied for membership in the payment service. In variant 9, a case is described in which the initial screening score is expressed numerically, but the initial screening score may be expressed in other forms such as letters or symbols. The initial screening score indicates the degree of suspicion of fraud estimated by the initial screening model M3. The degree is sometimes called the probability. For example, the initial screening score is expressed as a number between 0 and 1. The higher the numerical value of the initial screening score, the higher the suspicion that the applicant is fraudulent. The initial screening score can also be said to be the accuracy of the estimation result of the initial screening model M3.

[0128] The affiliated store fraud detection unit 108 of the ninth modified example detects fraud by the target affiliated store based on the target affiliated store score and the initial screening score. For example, the affiliated store fraud detection unit 108 calculates a total score, which is the overall score of the target affiliated store, based on the target affiliated store score and the initial screening score.

[0129] In the ninth modified example, the member store fraud detection unit 108 calculates the total score by summing the target member store score and the initial screening score, but the member store fraud detection unit 108 may calculate the total score based on a predetermined calculation method. For example, the member store fraud detection unit 108 may calculate the average of the target member store score and the initial screening score as the total score. The member store fraud detection unit 108 may calculate the total score based on the target member store score, the initial screening score, and a calculation formula including a predetermined weighting coefficient. The member store fraud detection unit 108 may calculate the total score based on the target member store score, the initial screening score, and a machine learning model such as a support vector machine.

[0130] For example, the affiliated store fraud detection unit 108 detects fraud by a target affiliated store based on the total score. The affiliated store fraud detection unit 108 determines whether the total score is equal to or greater than a threshold. If the affiliated store fraud detection unit 108 determines that the total score is less than the threshold, it does not determine that the target affiliated store is fraudulent, and if the affiliated store fraud detection unit 108 determines that the total score is equal to or greater than the threshold, it determines that the target affiliated store is fraudulent. The processing after the affiliated store fraud detection unit 108 detects fraud may be similar to that of the embodiment.

[0131] It should be noted that the affiliated store fraud detection unit 108 may detect fraud by the target affiliated store based on the target affiliated store score and the initial screening score without calculating the overall score. For example, the affiliated store fraud detection unit 108 may infer that the target affiliated store is fraudulent when the target affiliated store score is equal to or greater than a threshold and the initial screening score is equal to or greater than a threshold. As another example, the affiliated store fraud detection unit 108 may determine a threshold for the target affiliated store score based on the initial screening score and detect fraud by the target affiliated store.

[0132] The fraud detection system 1 of the ninth modified example detects fraud by a target affiliated store based on the target affiliated store score and the initial screening score. The fraud detection system 1 can detect fraud by a target affiliated store by comprehensively taking into account the estimation results of both the initial screening model M3 and the affiliated store fraud detection model M2.

[0133] Furthermore, the fraud detection system 1 calculates a total score, which is a comprehensive score for the target merchant, based on the target merchant score and the initial screening score, and detects fraud by the target merchant based on the total score. The fraud detection system 1 can detect fraud by the target merchant by comprehensively taking into account the estimation results of both the initial screening model M3 and the merchant fraud detection model M2. Furthermore, the administrator of the payment service can determine fraud by the target merchant based on an easy-to-understand index such as the total score.

[0134] [6-10. Variation 10] For example, as in Modifications 3 and 9, the affiliated store fraud detection unit 108 may obtain a target franchisee score related to fraud of the target franchisee output by the franchisee fraud detection model M2. In this case, the affiliated store fraud detection unit 108 may calculate a final target franchisee score based on the past target franchisee score and the current target franchisee score (the target franchisee score calculated based on the latest target franchisee information). Note that in Modification 10, the affiliated store fraud detection unit 108 periodically or irregularly executes the processes described in the embodiment and Modifications 1 to 9 to detect fraud of the target franchisee. The affiliated store fraud detection unit 108 stores the target franchisee score in the target franchisee database DB2. The target franchisee database DB2 stores the history of the target franchisee score.

[0135] In the tenth modification, an example is given in which the affiliated store fraud detection unit 108 calculates the sum of the past target franchisee score and the current target franchisee score as the final target franchisee score (latest target franchisee score), but the affiliated store fraud detection unit 108 may calculate the final target franchisee score based on a predetermined calculation method. For example, the affiliated store fraud detection unit 108 may calculate the final target franchisee score based on the target franchisee score, the current target franchisee score, and a calculation formula including a predetermined weighting coefficient. The affiliated store fraud detection unit 108 may calculate the final target franchisee score based on the target franchisee score, the current target franchisee score, and a machine learning model such as a support vector machine.

[0136] The affiliated store fraud detection unit 108 of the tenth modification detects fraud by the target affiliated store based on the final target affiliated store score. The affiliated store fraud detection unit 108 determines whether the final target affiliated store score is equal to or greater than a threshold. If the affiliated store fraud detection unit 108 determines that the final target affiliated store score is less than the threshold, it does not determine that the target affiliated store is fraudulent, and if it determines that the final target affiliated store score is equal to or greater than the threshold, it determines that the target affiliated store is fraudulent. The processing after the affiliated store fraud detection unit 108 detects fraud may be the same as in the embodiment.

[0137] The fraud detection system 1 of the tenth modification calculates a final target franchisee score based on the past target franchisee score and the current target franchisee score. The fraud detection system 1 detects fraud by the target franchisee based on the final target franchisee score. The fraud detection system 1 can detect fraud by the target franchisee by comprehensively taking into account both the estimation results of the past franchisee fraud detection model M2 and the estimation results of the current franchisee fraud detection model M2.

[0138] [6-11. Other variations] For example, the above-described modifications may be combined.

[0139] For example, the functions described as being realized by the server 10 may be realized by at least one computer in the fraud detection system 1, or the functions may be shared among multiple computers. In this case, the functions may be shared by each of the multiple computers transmitting its own processing results to the other computers. For example, the functions described as being realized by the server 10 may be realized by the administrator terminal 30.

[0140] [7. Notes] For example, the fraud detection system according to the present disclosure can also be configured as follows. (1) a target merchant information acquisition unit that acquires target merchant information regarding a target merchant that is a merchant that has passed an initial screening of a payment service and is subject to fraud detection; a franchisee fraud detection model storage unit that stores a franchisee fraud detection model that learns the relationship between training franchisee information regarding the training franchisee, which is a training franchisee, and whether or not the training franchisee has committed fraud; an affiliated store fraud detection unit that detects fraud at the target affiliated store based on the target affiliated store information and the affiliated store fraud detection model; Fraud detection systems, including: (2) The fraud detection system includes: a target payment information acquisition unit that acquires target payment information regarding a target payment that is a payment made at the target affiliated store; a payment fraud detection model storage unit that stores a payment fraud detection model that has learned a relationship between training payment information regarding a training payment, which is a payment made at the training affiliated store, and whether or not the training payment is fraudulent; a payment fraud detection unit that detects fraud in the target payment based on the target payment information and the payment fraud detection model; Further comprising: The merchant fraud detection model has learned features related to the training merchant more than the payment fraud detection model. The fraud detection system described in (1). (3) The target merchant information includes target result information regarding a result of fraud detection of the target payment performed by the payment fraud detection model, The training merchant information includes training result information regarding the result of fraud detection of the training payment performed by the payment fraud detection model; the affiliated store fraud detection unit detects fraud by the target affiliated store based on the target affiliated store information including the target result information and the affiliated store fraud detection model; (2) A fraud detection system as described above. (4) The fraud detection system further includes a condition determination unit that determines whether the target payment satisfies a processing target condition that is a processing target of the payment fraud detection model; The payment fraud detection unit sets the target payment that satisfies the processing target condition as a processing target of the payment fraud detection model, the affiliated store fraud detection unit treats the target affiliated store where the target payment has been made as a processing target of the affiliated store fraud detection model, regardless of the processing target condition; A fraud detection system according to (2) or (3). (5) The member store fraud detection unit, obtaining a target merchant score regarding fraud for the target merchant outputted by the merchant fraud detection model; obtaining a target payment score regarding fraud of the target payment output by the payment fraud detection model; calculating an overall fraud score for the target merchant and the target payment based on the target merchant score and the target payment score; Detecting fraud at the target affiliated store based on the overall score; A fraud detection system according to any one of (2) to (4). (6) The target franchise information includes target registration information, which is information about the target franchise registered by the target franchise, The training franchise information includes training registration information, which is information about the training franchise registered by the training franchise; The affiliated store fraud detection unit detects fraud by the target affiliated store based on the target affiliated store information including the target registration information and the affiliated store fraud detection model. A fraud detection system according to any one of (1) to (5). (7) The target merchant information includes target difference information regarding a difference between a plurality of target payments, which are a plurality of payments made at the target merchant, The training member store information includes training difference information regarding a difference between a plurality of training payments, which are a plurality of payments made at the training member store; the franchisee fraud detection unit detects fraud by the target franchisee based on the target franchisee information including the target difference information and the franchisee fraud detection model; A fraud detection system according to any one of (1) to (6). (8) The fraud detection system includes: an initial screening model creation unit that creates an initial screening model for an applicant who has applied to join the payment service based on the fraud of the target affiliated store detected by the affiliated store fraud detection model; an initial screening process execution unit that executes an initial screening process for the applicant based on the initial screening model; The fraud detection system according to any one of (1) to (7), further comprising: (9) When the member store fraud detection unit detects fraud at the target member store, an administrator of the payment service examines the target member store; The fraud detection system includes: an initial screening model creation unit that creates an initial screening model for initial screening of applicants who have applied for membership in the payment service based on a screening result by the administrator; an initial screening process execution unit that executes an initial screening process for the applicant based on the initial screening model; The fraud detection system according to any one of (1) to (8), further comprising: (10) The target franchise information includes target initial screening information regarding a processing result of the target franchise according to an initial screening model regarding an initial screening of an applicant who has applied for membership in the payment service, The training franchise information includes training initial screening information regarding the processing results of the training franchise according to the initial screening model; The franchisee fraud detection unit detects fraud by the target franchisee based on the target franchisee information including the target initial screening information and the franchisee fraud detection model. A fraud detection system according to any one of (1) to (9). (11) The member store fraud detection unit, obtaining a target merchant score regarding fraud for the target merchant outputted by the merchant fraud detection model; Obtain an initial screening score for the initial screening of the target affiliated store outputted by an initial screening model for the initial screening of an applicant who has applied to join the payment service; Detecting fraud by the target affiliated store based on the target affiliated store score and the initial screening score; A fraud detection system according to any one of (1) to (10). (12) The franchise fraud detection unit calculates a total score, which is a comprehensive score of the target franchise, based on the target franchise score and the initial screening score, and detects fraud by the target franchise based on the total score. (11) A fraud detection system as described above. (13) The member store fraud detection unit, obtaining a target merchant score regarding fraud for the target merchant outputted by the merchant fraud detection model; Calculate a final target franchisee score based on the past target franchisee scores and the current target franchisee score; Detecting fraud at the target merchant based on the final target merchant score; A fraud detection system according to any one of (1) to (12). [Explanation of symbols]

[0141] 1 Fraud detection system, N network, 10 server, 11, 21, 31 control unit, 12, 22, 32 memory unit, 13, 23, 33 communication unit, 20 affiliated store terminal, 30 administrator terminal, 24, 34 operation unit, 25, 35 display unit, M1 payment fraud detection model, M2 affiliated store fraud detection model, M3 initial screening model, 100 database storage unit, 101 payment fraud detection model storage unit, 102 affiliated store fraud detection model storage unit, 103 learning unit, 104 receiving unit, 105 target payment information acquisition unit, 106 payment fraud detection unit, 107 target affiliated store information acquisition unit, 108 affiliated store fraud detection unit, 109 notification unit, 110 condition determination unit, 111 initial screening model creation unit, 112 initial screening model storage unit, 113 initial screening process execution unit, 200 data storage unit, 201 Transmission unit, 300 data storage unit, 301 display control unit, 302 operation reception unit, DB1 target payment database, DB2 target affiliated store database, DB3 training payment database, DB4 training affiliated store database.

Claims

1. a target merchant information acquisition unit that acquires target merchant information regarding a target merchant that is a merchant that has passed an initial screening of a payment service and is subject to fraud detection; a franchisee fraud detection model storage unit that stores a franchisee fraud detection model that learns the relationship between training franchisee information regarding the training franchisee, which is a training franchisee, and whether or not the training franchisee has committed fraud; an affiliated store fraud detection unit that detects fraud at the target affiliated store based on the target affiliated store information and the affiliated store fraud detection model; Fraud detection systems, including:

2. The fraud detection system includes: a target payment information acquisition unit that acquires target payment information regarding a target payment that is a payment made at the target affiliated store; a payment fraud detection model storage unit that stores a payment fraud detection model that has learned a relationship between training payment information regarding a training payment, which is a payment made at the training affiliated store, and whether or not the training payment is fraudulent; a payment fraud detection unit that detects fraud in the target payment based on the target payment information and the payment fraud detection model; Further comprising: The merchant fraud detection model has learned features related to the training merchant more than the payment fraud detection model. The fraud detection system of claim 1 .

3. The target merchant information includes target result information regarding a result of fraud detection of the target payment performed by the payment fraud detection model, The training merchant information includes training result information regarding the result of fraud detection of the training payment performed by the payment fraud detection model; the affiliated store fraud detection unit detects fraud by the target affiliated store based on the target affiliated store information including the target result information and the affiliated store fraud detection model; The fraud detection system of claim 2 .

4. The fraud detection system further includes a condition determination unit that determines whether the target payment satisfies a processing target condition that is a processing target of the payment fraud detection model; The payment fraud detection unit sets the target payment that satisfies the processing target condition as a processing target of the payment fraud detection model, the affiliated store fraud detection unit treats the target affiliated store where the target payment has been made as a processing target of the affiliated store fraud detection model, regardless of the processing target condition; The fraud detection system according to claim 2 or 3.

5. The member store fraud detection unit, obtaining a target merchant score regarding fraud for the target merchant outputted by the merchant fraud detection model; obtaining a target payment score regarding fraud of the target payment output by the payment fraud detection model; calculating an overall fraud score for the target merchant and the target payment based on the target merchant score and the target payment score; Detecting fraud at the target affiliated store based on the overall score; The fraud detection system according to claim 2 or 3.

6. The target franchise information includes target registration information, which is information about the target franchise registered by the target franchise, The training franchise information includes training registration information, which is information about the training franchise registered by the training franchise; The affiliated store fraud detection unit detects fraud by the target affiliated store based on the target affiliated store information including the target registration information and the affiliated store fraud detection model. The fraud detection system according to any one of claims 1 to 3.

7. The target merchant information includes target difference information regarding a difference between a plurality of target payments, which are a plurality of payments made at the target merchant, The training member store information includes training difference information regarding a difference between a plurality of training payments, which are a plurality of payments made at the training member store; the franchisee fraud detection unit detects fraud by the target franchisee based on the target franchisee information including the target difference information and the franchisee fraud detection model; The fraud detection system according to any one of claims 1 to 3.

8. The fraud detection system includes: an initial screening model creation unit that creates an initial screening model for an applicant who has applied to join the payment service based on the fraud of the target affiliated store detected by the affiliated store fraud detection model; an initial screening process execution unit that executes an initial screening process for the applicant based on the initial screening model; The fraud detection system according to any one of claims 1 to 3, further comprising:

9. When the member store fraud detection unit detects fraud at the target member store, an administrator of the payment service examines the target member store; The fraud detection system includes: an initial screening model creation unit that creates an initial screening model for initial screening of applicants who have applied for membership in the payment service based on a screening result by the administrator; an initial screening process execution unit that executes an initial screening process for the applicant based on the initial screening model; The fraud detection system according to any one of claims 1 to 3, further comprising:

10. The target franchise information includes target initial screening information regarding a processing result of the target franchise according to an initial screening model regarding an initial screening of an applicant who has applied for membership in the payment service, The training franchise information includes training initial screening information regarding the processing results of the training franchise according to the initial screening model; The franchise fraud detection unit detects fraud by the target franchise based on the target franchise information including the target initial screening information and the franchise fraud detection model. The fraud detection system according to any one of claims 1 to 3.

11. The member store fraud detection unit, obtaining a target merchant score regarding fraud for the target merchant outputted by the merchant fraud detection model; Obtain an initial screening score for the initial screening of the target affiliated store outputted by an initial screening model for the initial screening of an applicant who has applied to join the payment service; Detecting fraud by the target affiliated store based on the target affiliated store score and the initial screening score; The fraud detection system according to any one of claims 1 to 3.

12. The franchise fraud detection unit calculates a total score, which is a comprehensive score of the target franchise, based on the target franchise score and the initial screening score, and detects fraud by the target franchise based on the total score. The fraud detection system of claim 11.

13. The member store fraud detection unit, obtaining a target merchant score regarding fraud for the target merchant outputted by the merchant fraud detection model; Calculate a final target franchisee score based on the past target franchisee scores and the current target franchisee score; Detecting fraud at the target merchant based on the final target merchant score; The fraud detection system according to any one of claims 1 to 3.

14. a target member store information acquisition step of acquiring target member store information regarding a target member store which is a member store that has passed an initial screening of a payment service and is subject to fraud detection; a franchise fraud detection step of detecting fraud by the target franchise based on a franchise fraud detection model in which a relationship between training franchise information on the training franchise, which is a training franchise, and whether or not the training franchise has committed fraud has been learned, and the target franchise information; A fraud detection method comprising:

15. a target merchant information acquisition unit that acquires target merchant information regarding a target merchant that is a merchant that has passed an initial screening of a payment service and is subject to fraud detection; a franchise fraud detection unit that detects fraud by the target franchise based on a franchise fraud detection model in which a relationship between training franchise information on the training franchise, which is a training franchise, and whether or not the training franchise has committed fraud has been learned, and the target franchise information; A program that makes a computer function as a

Images