Fraud detection system, fraud detection method, and program

Abstract

To increase fraud detection accuracy.SOLUTION: A target situation data acquisition unit (102) of a fraud detection system (1) acquires target situation data on a use situation of a second service by a target user from a second service system (3) of a second service used by the target user subject to fraud detection in a first service. A fraud detection unit (103) detects a target user fraud in the first service on the basis of the target situation data and a fraud detection model (M) for detecting a fraud in the first service. A processing execution unit (104) executes prescribed processing on the basis of processing results of the fraud detection unit (103).SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present disclosure relates to a fraud detection system, a fraud detection method, and a program. [Background technology]

[0002] Conventionally, there are known techniques for detecting fraudulent behavior by users in a given service. For example, Patent Document 1 describes a technique in which each server of a plurality of member stores affiliated with a given service shares a fraudulent transaction database related to fraudulent users who have committed fraud at its own member store, and detects fraudulent behavior by users based on not only the fraudulent transaction database managed by itself but also the fraudulent transaction databases managed by the servers of other member stores. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2016-099913 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, with the technology of Patent Document 1, the servers of each of the multiple member stores cannot detect fraud by users who are not registered in the fraudulent transaction database. With the technology of Patent Document 1, the servers of each of the multiple member stores can only detect fraud by users who are not registered in the fraudulent transaction database based on the usage status at that member store. This point is similar to other technologies other than the technology in which the fraudulent transaction database is shared as in Patent Document 1. Conventional technologies did not provide sufficient accuracy in fraud detection.

[0005] One of the goals of this disclosure is to improve the accuracy of fraud detection. [Means for solving the problem]

[0006] The fraud detection system of the present disclosure includes a target situation data acquisition unit that acquires target situation data regarding the usage status of a second service by a target user who is subject to fraud detection in a first service from a second service system of a second service used by the target user, a fraud detection unit that detects fraud by the target user in the first service based on the target situation data and a fraud detection model for detecting fraud in the first service, and a processing execution unit that executes a predetermined process based on a processing result of the fraud detection unit. Effect of the Invention

[0007] According to the present disclosure, it is possible to improve the accuracy of fraud detection. [Brief description of the drawings]

[0008] [Figure 1] FIG. 2 is a diagram illustrating an example of a hardware configuration of the fraud detection system. [Diagram 2] FIG. 2 is a diagram showing an example of how a user uses a first service and a second service. [Diagram 3] FIG. 13 is a diagram illustrating an example of input and output of a fraud detection model. [Figure 4] FIG. 2 is a diagram illustrating an example of functions realized by the fraud detection system. [Diagram 5] FIG. 2 is a diagram illustrating an example of a training database. [Figure 6] FIG. 11 is a diagram illustrating an example of a processing result database. [Figure 7] FIG. 4 is a diagram illustrating an example of a first user database. [Figure 8] FIG. 11 is a diagram illustrating an example of a second user database. [Figure 9] FIG. 2 is a diagram illustrating an example of processing executed in the fraud detection system. [Figure 10] A figure showing an example of functions realized by a fraud detection system of a modified example. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] [1. Hardware configuration of the fraud detection system] An embodiment that is an example of an embodiment of a fraud detection system, a fraud detection method, and a program according to the present disclosure will be described. Fig. 1 is a diagram showing an example of a hardware configuration of a fraud detection system. For example, a fraud detection system 1 is connected to a network N such as the Internet or a LAN. A first service system 2, a second service system 3, and a user terminal 40 are also connected to the network N.

[0010] The fraud detection system 1 is a system that detects fraud in a first service. The first service is a service that is the target of fraud detection. In this embodiment, a payment service corresponds to the first service as an example. The payment service is a service that handles electronic payments. The payment service can support any payment method. For example, the payment service can support credit cards, electronic money, points, bank accounts, accounts at financial institutions other than banks, accounts at other than financial institutions, crypto assets, or other payment methods.

[0011] Fraud is an act that violates the terms of use of the first service, an act that violates the law, an act that violates a request from a government agency, or other nuisance act. Detection of fraud is detection of fraudulent acts or detection of acts that are suspected to be fraudulent (detection of the possibility of fraud). Detection of fraud can also be said to be a presumption of fraud. Therefore, in this embodiment, the word "detection" can also be read as "presumption." For example, if the first service is a payment service, an act of a certain user using another user's payment means corresponds to fraud. An act of a certain user purchasing a product or service for which payment is prohibited with the user's own payment means corresponds to fraud.

[0012] The first service may be any service. The first service is not limited to a payment service. For example, the first service may be an electronic commerce service, a financial service, a communication service, a video distribution service, a music distribution service, a social networking service, or other services. The fraud detected by the fraud detection system 1 may be any act that may occur in the first service. For example, if the first service is an electronic commerce service, an act of a user impersonating another user to order a product corresponds to fraud. If the first service is a financial service, an act of a user impersonating another user to transfer money corresponds to fraud.

[0013] For example, the fraud detection system 1 includes a fraud detection server 10. The fraud detection server 10 is a server computer. The fraud detection server 10 includes a control unit 11, a memory unit 12, and a communication unit 13. The control unit 11 includes at least one processor. The memory unit 12 includes at least one of a volatile memory such as a RAM and a non-volatile memory such as a flash memory. The communication unit 13 includes at least one of a communication interface for wired communication and a communication interface for wireless communication.

[0014] The program stored in the storage unit 12 may be supplied to the fraud detection server 10 via the network N. Also, the program stored in a computer-readable information storage medium may be supplied to the fraud detection server 10 via a reading unit (e.g., an optical disk drive or a memory card slot) that reads the information storage medium, or an input / output unit (e.g., a USB port) that inputs and outputs data to and from an external device.

[0015] Furthermore, the fraud detection system 1 only needs to include at least one computer. The hardware configuration of the fraud detection system 1 is not limited to the example of FIG. 1. For example, the fraud detection system 1 may include a fraud detection server 10 and another computer (e.g., another server computer or a personal computer). The fraud detection system 1 may include at least one of a first service system 2, a second service system 3, and a user terminal 40.

[0016] The first service system 2 is a system that provides a first service to a user. For example, the first service system 2 includes a first service server 20. The first service server 20 is a server computer. The first service server 20 includes a control unit 21, a storage unit 22, and a communication unit 23. The physical configurations of the control unit 21, the storage unit 22, and the communication unit 23 may be similar to those of the control unit 11, the storage unit 12, and the communication unit 13, respectively. Note that the first service system 2 is similar to the fraud detection system 1 in that the program stored in the storage unit 22 may be supplied to the first service server 20 via a network N or the like, and that the hardware configuration of the first service system 2 is not limited to the example of FIG. 1.

[0017] The second service system 3 is a system that provides a second service to a user. The second service is another service different from the first service. The second service is another service that is used as a reference for detecting fraud in the first service. In this embodiment, an example is given in which an electronic commerce service corresponds to the second service. The second service may be any service. The second service is not limited to an electronic commerce service. The second service may be a service different from the first service among the services exemplified as the first service. The first service and the second service may be the same type of service, such as the first service being a first payment service and the second service being a second payment service.

[0018] For example, the second service system 3 includes a second service server 30. The second service server 30 is a server computer. The second service server 30 includes a control unit 31, a memory unit 32, and a communication unit 33. The physical configurations of the control unit 31, the memory unit 32, and the communication unit 33 may be similar to those of the control unit 11, the memory unit 12, and the communication unit 13, respectively. Note that, like the fraud detection system 1, the program stored in the memory unit 32 may be supplied to the second service server 30 via a network N or the like, and the hardware configuration of the second service system 3 is not limited to the example of FIG. 1.

[0019] The user terminal 40 is a user's computer. The user uses both the first service and the second service. For example, the user terminal 40 is a smartphone, a tablet, a personal computer, or a wearable terminal. The user terminal 40 includes a control unit 41, a memory unit 42, a communication unit 43, an operation unit 44, and a display unit 45. The physical configurations of the control unit 41, the memory unit 42, and the communication unit 43 may be similar to those of the control unit 11, the memory unit 12, and the communication unit 13, respectively. The operation unit 44 is an input device such as a keyboard or a touch panel. The display unit 45 is a liquid crystal or organic EL display.

[0020] [2. Overview of the fraud detection system] FIG. 2 is a diagram showing an example of a state in which a user uses each of the first service and the second service. For example, the user uses the first service from a screen SC1 of a first application AP1 installed in the user terminal 40. The first application AP1 is an application for the first service. The user may use the first service from a means other than the first application AP1. For example, the user may use the first service from a browser installed in the user terminal 40. If the first service is a payment service as in this embodiment, the user may use the first service from an IC chip of the user terminal 40.

[0021] For example, the user uses the second service from a screen SC2 of the second application AP2 installed in the user terminal 40. The second application AP2 is an application for the second service. The user may use the second service from a means other than the second application AP2. For example, the user may use the second service from a browser installed in the user terminal 40. In the example of FIG. 2, the user purchases a product in the second service using the same credit card as the payment source for the first service.

[0022] For example, a user uses the second service with a specific credit card from a user terminal 40 having specific terminal identification information. The terminal identification information is information capable of identifying the user terminal 40. For example, the terminal identification information is the serial number (individual identification information) of the user terminal 40, an ID in a SIM card, an IP address, an ID issued by the first service system 2, an ID issued by the second service system 3, or other information.

[0023] For example, when a legitimate user repeatedly uses the second service, the combination of the user terminal 40 and credit card is often basically the same. Furthermore, the legitimate user often uses the same credit card from a user terminal 40 with the same terminal identification information for the first service as well. For this reason, if the combination of the user terminal 40 and credit card to be used for the first service is also used for the second service, fraud often does not occur in the first service. In the example of FIG. 2, the legitimate user uses each of the first service and the second service with the same combination of the user terminal 40 and credit card.

[0024] On the other hand, suppose that a malicious user logs in to the first service, masquerading as a legitimate user. Furthermore, suppose that the malicious user does not masquerade as a legitimate user in the second service. In this case, the credit card that is to be used in the first service may be used in the second service by a legitimate user. However, the "combination" of the user terminal 40 and credit card that is to be used in the first service is not used in the second service. In other words, the user terminal 40 of the malicious user is not used in the second service. In this case, the fraud detection server 10 detects fraud in the first service.

[0025] For example, the fraud detection server 10 notifies the first service system 2 that fraud in the first service has been detected. Upon receiving the notification, the first service server 20 triggers additional authentication in the first service. The additional authentication is authentication other than logging in to the first service. For example, the additional authentication may be 3D secure authentication, security code authentication, password authentication in which a password other than the password used when logging in to the first service is used, biometric authentication, credit card possession authentication, or other authentication. In principle, a malicious user cannot successfully perform the additional authentication.

[0026] For example, technology has been known in the past in which a first service refers to a blacklist for a second service. In such technology, a blacklist for the second service is created, and therefore it is assumed that fraud will occur in the second service. On the other hand, the fraud detection system 1 of this embodiment refers to the combination of the user terminal 40 and credit card in the second service to detect fraud in the first service, even if fraud has not occurred in the second service.

[0027] Note that information that can be used as a reference for detecting fraud in the first service is not limited to the combination of the user terminal 40 and the credit card. Other usage conditions in the second service may also be useful for detecting fraud in the first service. For example, if there is a tendency for fraud to occur in the first service for a certain user ID after a sudden increase in the payment amount in the second service for that user ID, the payment amount in the second service can be useful for detecting fraud in the first service.

[0028] For example, if a delivery address in the second service is changed for a certain user ID, and there is a tendency for fraudulent activities to occur in the first service for that user ID, then the delivery address in the second service can be useful in detecting fraudulent activities in the second service. If a number of logins in the second service for a certain user ID increases sharply, and there is a tendency for fraudulent activities to occur in the first service for that user ID, then the number of logins in the second service can be useful in detecting fraudulent activities in the second service.

[0029] Therefore, the fraud detection server 10 of this embodiment detects fraud in the first service based on usage status in the second service that has a causal relationship (correlation) with the presence or absence of fraud in the first service. Hereinafter, a program used in fraud detection is referred to as a fraud detection model. Although details will be described later, the fraud detection model of this embodiment is a model related to machine learning. For example, the fraud detection server 10 detects fraud in the first service based on the usage status in the second service and a fraud detection model related to machine learning.

[0030] Fig. 3 is a diagram showing an example of input and output of a fraud detection model. As shown in Fig. 3, data related to the usage of the second service (in the example of Fig. 3, terminal identification information, credit card number, payment amount, and delivery destination) is input to the fraud detection model M. In this embodiment, it is assumed that not only the second service but also data related to the usage of the first service (in the example of Fig. 3, terminal identification information, credit card number, payment amount, and distance from the center of use) is input to the fraud detection model M.

[0031] For example, the fraud detection model M has previously learned the relationship between the usage status of each of the first service and the second service and the presence or absence of fraud in the first service. The process for learning the fraud detection model M will be described in detail later. The learned fraud detection model M calculates the feature amount of the data input to it. The fraud detection model M performs output according to the calculated feature amount. In this embodiment, the fraud detection model M outputs a value indicating the presence or absence of fraud in the first service.

[0032] As described above, the fraud detection system 1 of this embodiment detects fraud in the first service based on at least the usage status of the second service and the fraud detection model M. This allows the fraud detection system 1 to detect fraud in the first service by referring to the usage status of the second service, which is a service other than the first service. This allows the fraud detection system 1 to improve the accuracy of fraud detection in the first service. Details of the fraud detection system 1 will be described below.

[0033] [3. Functions realized by the fraud detection system] Fig. 4 is a diagram showing an example of functions realized by the fraud detection system 1. Fig. 4 also shows an example of functions realized by each of the first service system 2 and the second service system 3.

[0034] [3-1. Functions realized by the fraud detection server] For example, the fraud detection server 10 includes a data storage unit 100, a learning unit 101, a target situation data acquisition unit 102, a fraud detection unit 103, and a process execution unit 104. The data storage unit 100 is realized by the memory unit 12. The learning unit 101, the target situation data acquisition unit 102, the fraud detection unit 103, and the process execution unit 104 are realized by the control unit 11.

[0035] [Data storage section] The data storage unit 100 stores data necessary for detecting fraud in the first service. For example, the data storage unit 100 stores a trained fraud detection model M, a training database DB1, and a processing result database DB2.

[0036] In this embodiment, the fraud detection model M is a model related to machine learning. Various known machine learning methods can be used. For example, the fraud detection model M is not limited to a supervised learning or semi-supervised learning model, and may be an unsupervised learning model. More specifically, the fraud detection model M may be a model of a neural network, a support vector machine, a random forest, a logistic regression, a decision tree, or other methods. For example, the fraud detection model M includes a program portion that performs calculation of feature amounts, etc., and a parameter portion referenced by the program portion.

[0037] In this embodiment, the fraud detection model M learns the relationship between learning status data on the usage status of the second service by the learning user for learning the fraud detection model M and the presence or absence of fraud by the learning user in the first service. The parameter portion is changed by learning. Before learning is performed by the learning unit 101, the data storage unit 100 stores the fraud detection model M whose parameter portion is an initial value. When learning by the learning unit 101 is completed, the parameter portion of the fraud detection model M before learning is overwritten.

[0038] The learning user is a user who uses the first service and the second service and whose usage status is referenced for learning the fraud detection model M. The learning user may not be an actual user, but may be a virtual user for fraud detection purposes. Which user is selected as the learning user may be specified by the administrator of the fraud detection system 1, or a randomly selected user may correspond to the learning user.

[0039] The usage status of the second service is data that is updated according to the use of the second service. For example, how the second service is being used or to what extent the second service is being used corresponds to the usage status of the second service. The usage status of the second service is not static data but dynamic data. The usage status of the second service can also be said to be data that is updated based on data received from the user terminal 40. The usage status of the first service differs from the usage status of the second service in that it is for the first service, but has a similar meaning.

[0040] The learning status data is usage status data related to the usage status of the second service that is used in learning the fraud detection model M. The learning status data indicates at least items that are thought to have a causal relationship with the presence or absence of fraud, among multiple items related to the usage status of the second service. The items are specific contents indicated by the data. Which items have a causal relationship may be specified by the administrator of the fraud detection system 1, or may be determined based on feature importance calculated by a method such as random forest.

[0041] In the example of Fig. 3, the learning status data indicates values ​​of items such as the terminal identification information of the user terminal 40 used by the learning user in the second service, the credit card number used by the learning user in the payment in the second service, the payment amount of the payment, and the delivery address specified by the learning user in the second service. In the example of Fig. 3, the fraud detection model M also learns learning status data regarding the usage status of the first service by the learning user. The learning status data of the first service differs from the learning status data of the second service in that it is data regarding the usage status in the first service, but is similar in other respects.

[0042] Hereinafter, the learning status data regarding the usage status of the first service is referred to as the first learning status data. The learning status data regarding the usage status of the second service is referred to as the second learning status data. In the example of FIG. 3, the first learning status data differs from the second learning data in some items (e.g., distance from the usage center). For example, the first learning status data indicates values ​​of items such as the terminal identification information of the user terminal 40 used by the learning user in the first service, the credit card number used by the learning user in the payment in the first service, the payment amount of the payment, and the distance from the usage center. The items included in the first learning status data may be the same as the items included in the second learning data.

[0043] In addition, the fraud detection model M may learn data related to the learning user other than the first learning status data and the second learning status data. For example, the fraud detection model M may learn static data such as demographic data (e.g., gender, age, place of residence, occupation, or a combination of these) instead of the usage status of the learning user. For example, the fraud detection model M may not learn the first learning status data. The fraud detection model M may learn only the second learning status data. It is sufficient that the fraud detection model M learns data that is causally related to the presence or absence of fraud in the first service.

[0044] Furthermore, the fraud detection model M may be a model of a method other than machine learning. For example, the fraud detection model M may be a rule-based model created by a method other than machine learning. The fraud detection model M may be a model that combines a model of a machine learning method and a rule-based model. For another example, the fraud detection model M may be a program different from machine learning and rule-based. Models that can be adopted as the fraud detection model M may be various models used in known fraud detection.

[0045] FIG. 5 is a diagram showing an example of the training database DB1. The training database DB1 is a database in which training data to be learned by the fraud detection model M is stored. For example, a plurality of training data are stored in the training database DB1. Each training data is a pair of an input part and an output part. In principle, the input part and the output part of the training data have the same format as the input and output of the fraud detection model M at the time of estimation. The output part can also be said to be the correct answer at the time of learning. For example, the training data may be manually created by an administrator, or some kind of creation tool may be used.

[0046] For example, the input portion of the training data of the fraud detection model M includes at least the second learning status data. In this embodiment, the input portion includes the first learning status data and the second learning status data. The output portion of the training data of the fraud detection model M is information regarding the presence or absence of fraud in the first service. In this embodiment, a case is described in which the output portion of the training data of the fraud detection model M is a label indicating whether or not there is fraud, but the output portion may also be a score indicating suspicion of fraud.

[0047] For example, in the case of the combination of the terminal identification information and the credit card number described above, an output portion indicating authenticity is associated with an input portion of the training data in which the combination indicated by the first learning status data is the same as the combination indicated by the second learning status data. An output portion indicating fraud is associated with an input portion of the training data in which the combination indicated by the first learning status data is different from the combination indicated by the second learning status data.

[0048] The input portion of the training data may include data having some causal relationship with the presence or absence of fraud in the first service. For example, if there is a causal relationship between demographic data of a learning user registered in at least one of the first service and the second service and the presence or absence of fraud in the first service, the input portion of the training data may include the demographic data. As described above, the first learning status data does not need to be learned by the fraud detection model M, and therefore the input portion of the training data does not need to include the first learning status data.

[0049] For example, in the case of a change in payment amount in the second service described above, an input portion in which the change in payment amount indicated by the second learning status data is less than a threshold is associated with an output portion indicating that it is valid. An input portion in which the change in payment amount indicated by the second learning status data is equal to or greater than a threshold is associated with an output portion indicating that it is fraudulent. In another example, an input portion in which the second learning status data does not indicate a change in the delivery destination is associated with an output portion indicating that it is valid. An input portion in which the second learning status data indicates a change in the delivery destination is associated with an output portion indicating that it is fraudulent.

[0050] In addition, when each of the first learning status data and the second learning status data includes multiple items, the output part associated with the input part of the training data is a value that comprehensively considers these multiple items. In other words, the output part of the training data is determined by comprehensively considering not only a single item such as a combination of terminal identification information and credit card number, but also other items such as changes in the payment amount in the second service.

[0051] Fig. 6 is a diagram showing an example of the processing result database DB2. The processing result database DB2 is a database in which various data related to the processing results of fraud detection is stored. For example, the processing result database DB2 stores the user ID of the target user and processing result data. Any information may be stored in the processing result database DB2, and the information stored in the processing result database DB2 is not limited to the example of Fig. 6. For example, the processing result database DB2 may store the date and time when the fraud detection was performed.

[0052] For example, the user ID is information for the user to log in to each of the first service and the second service. The user ID is an example of user identification information capable of identifying a user. The user identification information may be information capable of identifying a user in some form. The user identification information is not limited to the user ID. For example, the user identification information may be an email address, a telephone number, or terminal identification information. The user identification information may not be common to the first service and the second service. In this case, it is assumed that the correspondence between the user identification information of the first service and the user identification information of the second service is predefined in the data storage unit 100.

[0053] The processing result data is data related to the processing result of the fraud detection unit 103. In this embodiment, the processing result data indicates whether the target user is fraudulent or not. For example, the processing result data indicates either a value indicating that the target user is fraudulent or a value indicating that the target user is not fraudulent. The processing result data may indicate a score regarding the suspicion of fraud of the target user. The score is expressed by a number, a letter, a symbol, or a combination thereof. The score can also be said to be the probability (certainty) that the target user is fraudulent.

[0054] The data stored in the data storage unit 100 is not limited to the above example. The data storage unit 100 can store any data. For example, the data storage unit 100 may store data necessary for fraud detection in the first service. The data storage unit 100 may store a program necessary for learning the fraud detection model M. The data storage unit 100 may store data for fraud detection in the second service.

[0055] [Learning Department] The learning unit 101 executes learning of the fraud detection model M based on the training data stored in the training database DB1. Learning of the fraud detection model M is to adjust the parameters of the fraud detection model M. For example, the learning unit 101 causes the fraud detection model M to learn all or part of the multiple training data stored in the training database DB1. The learning of the fraud detection model M itself can use a known machine learning method, and for example, the backpropagation method or the gradient descent method may be used. The loss function and the like used in learning of the fraud detection model M may also be a known method. The learning unit 101 executes learning of the fraud detection model M such that when an input portion of the training data stored in the training database DB1 is input, an output portion of the training data is output. The learning unit 101 adjusts the parameter portion of the fraud detection model M based on the training data.

[0056] [Target situation data acquisition section] The target situation data acquisition unit 102 acquires target situation data on the usage situation of the second service by the target user who is the target of fraud detection in the first service from the second service system 3 of the second service used by the target user. The target user is any one of a plurality of users of the first service. In this embodiment, which user is selected as the target user is determined by the first service server 20, but the target user may be manually designated by an administrator of the first service, etc.

[0057] The target status data is usage status data of the target user among usage status data related to the usage status of the second service. Hereinafter, the target status data of the second service is referred to as the second target status data. In this embodiment, usage status data related to the usage status of the first service is also used for fraud detection. Hereinafter, the usage status data of the first service of the target user is referred to as the first target status data. The first target status data and the second target status data are in the same format as the first learning status data and the second learning status data used during learning, respectively.

[0058] For example, when a user uses the first service, the first service server 20 determines the user as a target user. The first service server 20 transmits the user ID of the target user and the first target situation data of the target user to the fraud detection system 1. The fraud detection server 10 receives the user ID and the first target situation data of the target user from the first service server 20. The fraud detection server 10 requests the second service system 3 for the second target situation data associated with the user ID of the target user.

[0059] For example, when the second service server 30 receives a request from the fraud detection server 10, it acquires second target situation data associated with the user ID of the target user based on the second user database DB4 described below. The second service server 30 transmits the second target situation data associated with the user ID of the target user to the fraud detection system 1. The target situation data acquisition unit 102 acquires the second target situation data associated with the user ID of the target user from the second service server 30.

[0060] The method of determining the target user may be a predetermined method. The method of determining the target user is not limited to the above example. For example, the first service server 20 may randomly determine the target user from among multiple users of the first service. The first service server 20 may determine as the target user a user whose usage status in the first service satisfies a predetermined condition (for example, usage amount is above a threshold or usage frequency is above a threshold). The target user may be determined not by the first service server 20 but by the fraud detection server 10, the second service server 30, or another computer.

[0061] [Fraud Detection Department] The fraud detection unit 103 detects fraud by the target user in the first service based on the second target situation data and a fraud detection model M for detecting fraud in the first service. In this embodiment, the fraud detection model M is a model related to machine learning, so the fraud detection unit 103 detects fraud by the target user in the first service based on the second target situation data and the learned fraud detection model M. The fraud detection unit 103 detects fraud by the target user in the first service when the output of the fraud detection model M indicates fraud or when the score of the fraud detection model M is equal to or greater than a threshold.

[0062] In this embodiment, since not only the second target situation data but also the first target situation data is used in fraud detection, the fraud detection unit 103 inputs the first target situation data and the second target situation data to the trained fraud detection model M. The fraud detection unit 103 may perform preprocessing such as aggregation or normalization on the first target situation data and the second target situation data, and then input the first target situation data and the second target situation data that have been subjected to the preprocessing to the trained fraud detection model M.

[0063] For example, the fraud detection model M calculates feature quantities of the first target situation data and the second target situation data input thereto based on the parameter portion adjusted by learning. The fraud detection model M outputs an inference result regarding the fraud of the target user based on the calculated feature quantities. In this embodiment, the fraud detection model M outputs an inference result indicating whether the target user is fraudulent or not. The inference result is either a value indicating that the target user is fraudulent or a value indicating that the target user is not fraudulent. The fraud detection model M may output a score regarding the fraud of the target user.

[0064] In addition, when data other than the first learning status data and the second learning status data is learned in the fraud detection model M, the fraud detection unit 103 may input not only the first target situation data and the second target situation data but also the other data to the fraud detection model M. The other data may also be subjected to preprocessing such as aggregation or normalization. When only the second learning status data is learned in the fraud detection model M, the fraud detection unit 103 may input only the second target situation data to the fraud detection model M.

[0065] For example, when the fraud detection model M is created by a method other than machine learning, the fraud detection unit 103 may input the first learning status data and the second learning status data to the fraud detection model M created by a method other than machine learning. When the fraud detection model M is a rule-based model, the fraud detection unit 103 determines whether the first learning status data and the second learning status data satisfy the rules defined in the fraud detection model M.

[0066] For example, when the fraud detection model M is a rule-based model, each rule is associated with the presence or absence of fraud. When the first learning status data and the second learning status data satisfy the first rule, the fraud detection unit 103 determines that the target user is fraudulent. When the first learning status data and the second learning status data satisfy the second rule, the fraud detection unit 103 determines that the target user is not fraudulent. Even when the fraud detection model M is a rule-based model, the fraud detection unit 103 may input data other than the first learning status data and the second learning status data to the fraud detection model M. The fraud detection unit 103 may input only the second learning status data to the fraud detection model M.

[0067] [Processing execution section] The process execution unit 104 executes a predetermined process based on the processing result of the fraud detection unit 103. The predetermined process is a process whose execution is determined based on the processing result of the fraud detection unit 103, or a process that is executed based on data related to the processing result of the fraud detection unit 103. In this embodiment, the process execution unit 104 executes, as the predetermined process, a first transmission process of transmitting processing result data related to whether the target user is fraudulent to the first service system 2 of the first service. Note that the predetermined process is not limited to the first transmission process. Other examples of the predetermined process will be described in a modified example described later.

[0068] In this embodiment, the processing result data indicates whether the target user is fraudulent. For example, the processing result data is either a value indicating that the target user is fraudulent or a value indicating that the target user is not fraudulent. The processing result data may indicate a score regarding the fraud of the target user. For example, when fraud is detected by the fraud detection unit 103, the processing execution unit 104 transmits processing result data indicating that the target user is fraudulent to the first service system 2. When fraud is not detected by the fraud detection unit 103, the processing execution unit 104 transmits processing result data indicating that the target user is not fraudulent to the first service system 2.

[0069] [3-2. Functions realized by the first service system] For example, the first service server 20 includes a data storage unit 200, a transmission unit 201, and a reception unit 202. The data storage unit 200 is realized by the storage unit 22. The transmission unit 201 and the reception unit 202 are realized by the control unit 21.

[0070] [Data storage section] The data storage unit 200 stores data necessary for detecting fraud in the first service. For example, the data storage unit 200 stores a first user database DB3.

[0071] Fig. 7 is a diagram showing an example of the first user database DB3. The first user database DB3 is a database in which data related to a user in the first service is stored. For example, the first user database DB3 stores a user ID and first usage status data which is usage status data of the first service. Any information may be stored in the first user database DB3, and the information stored in the first user database DB3 is not limited to the example of Fig. 7. For example, the first user database DB3 may store the generation date and time of the first usage status data.

[0072] The first usage status data can be used as either the first target status data or the first learning status data. For example, when a user uses the first service, the first service server 20 generates first usage status data of the user based on the usage status of the first service by the user. In the example of FIG. 3, the first service server 20 generates first usage status data including the terminal ID of the user terminal 40, information on the credit card used by the user, the payment amount by the user, the distance from the center of use, or other items based on data received from the user terminal 40. The first service server 20 stores the generated first usage status data in the first user database DB3 in association with the user ID of the user.

[0073] [Transmitter] The transmission unit 201 transmits various data to the fraud detection system 1. For example, the transmission unit 201 transmits the first usage status data of the target user as first target status data to the fraud detection system 1. The transmission unit 201 transmits the first usage status data of the learning user as first learning status data to the fraud detection system 1.

[0074] [Receiver] The receiving unit 202 receives various data from the fraud detection system 1. For example, the receiving unit 202 receives processing result data from the fraud detection system 1.

[0075] [3-3. Functions realized by the second service system] For example, the second service server 30 includes a data storage unit 300, a transmission unit 301, and a reception unit 302. The data storage unit 300 is realized by the storage unit 32. The transmission unit 301 and the reception unit 302 are realized by the control unit 31.

[0076] [Data storage section] The data storage unit 300 stores data necessary for detecting fraud in the first service. For example, the data storage unit 300 stores the second user database DB4.

[0077] FIG. 8 is a diagram showing an example of the second user database DB4. The second user database DB4 is a database in which data related to a user in the second service is stored. For example, the second user database DB4 stores a user ID and second usage status data which is usage status data of the second service. Any information may be stored in the second user database DB4, and the information stored in the second user database DB4 is not limited to the example of FIG. 8. For example, the second user database DB4 may store the generation date and time of the second usage status data.

[0078] The second usage status data can be used as either the second target status data or the second learning status data. For example, when a user uses the second service, the second service server 30 generates second usage status data of the user based on the usage status of the second service by the user. In the example of FIG. 3, the second service server 30 generates second usage status data including the terminal ID of the user terminal 40, information on the credit card used by the user, the payment amount by the user, the distance from the center of use, or other items based on the data received from the user terminal 40. The second service server 30 stores the generated second usage status data in the second user database DB4 in association with the user ID of the user.

[0079] For example, in the second service system 3, a list of fraudulent users whose fraudulence has been detected in the second service may be generated. In this case, the data storage unit 300 stores the list. The list may also be called a blacklist. The method of generating the list itself may be a publicly known method. For example, information such as the user ID of a user who has been recognized as fraudulent by an administrator of the second service is shown in the list. When the second service system 3 performs its own fraud detection, information such as the user ID of a user who has been recognized as fraudulent by the own fraud detection is shown in the list. The target user may be a user not on these lists. The target user may be a user on these lists.

[0080] [Transmitter] The transmission unit 301 transmits various data to the fraud detection system 1. For example, the transmission unit 301 transmits the second usage status data of the target user as second target status data to the fraud detection system 1. The transmission unit 301 transmits the second usage status data of the learning user as second learning status data to the fraud detection system 1.

[0081] [Receiver] The receiving unit 302 receives various data from the fraud detection system 1. For example, the receiving unit 302 receives a request for second target situation data from the fraud detection system 1.

[0082] [4. Processing performed by the fraud detection system] Fig. 9 is a diagram showing an example of processing executed by the fraud detection system 1. The processing in Fig. 9 is executed by the control units 11, 21, and 31 operating in accordance with the programs stored in the storage units 12, 22, and 32, respectively. As shown in Fig. 9, the fraud detection server 10 learns the fraud detection model M based on the training data stored in the training database DB1 (S1). The first service server 20 transmits to the fraud detection server 10, based on the first user database DB3, the user ID of a target user for whom the fraud detection model M is to estimate the presence or absence of fraud, and first target situation data relating to the usage situation of the first service by the target user (S2).

[0083] The fraud detection server 10 receives the user ID and first target situation data of the target user from the first service server 20 (S3). The fraud detection server 10 requests the second service server 30 for second target situation data associated with the user ID of the target user (S4). The second service server 30 receives the request from the fraud detection server 10 (S5). The second service server 30 transmits the second target situation data associated with the user ID of the target user to the fraud detection server 10 based on the second user database DB4 (S6).

[0084] The fraud detection server 10 receives the second target situation data from the second service server 30 (S7). The fraud detection server 10 detects fraud of the target user based on the first target situation data and the second target situation data of the target user and the learned fraud detection model M (S8). The fraud detection server 10 transmits processing result data regarding whether the target user is fraudulent or not based on the processing result in S8 (S9).

[0085] The first service server 20 receives the processing result data from the fraud detection server 10 (S10). The first service server 20 notifies the administrator of the first service based on the processing result data (S11), and the process ends. In S11, the first service server 20 can notify the administrator by any means. For example, the means may be email, push notification, notification on a management tool, or other means.

[0086] [5. Summary of the embodiment] The fraud detection system 1 of this embodiment acquires second target situation data from the second service system 3. The fraud detection system 1 detects fraud by the target user in the first service based on the second target situation data and a fraud detection model M for detecting fraud in the first service. The fraud detection system 1 executes a predetermined process based on the processing result of the fraud detection unit 103. The fraud detection system 1 can analyze a tendency of fraud that cannot be identified by the information of the target user in the first service using the second target situation data, so that the accuracy of fraud detection can be improved. For example, assume that a malicious third party attempts to use a combination of a terminal ID and a credit card number that is not used in the second service in the first service. When the combination of the terminal ID and the credit card number is indicated in the second target situation data, the fraud detection model M can identify that the malicious third party is attempting to use a combination of a terminal ID and a credit card number that is not indicated in the second target situation data. Therefore, the fraud detection system 1 can improve the accuracy of fraud detection.

[0087] Moreover, the fraud detection model M is a model related to machine learning. The fraud detection model M has learned the relationship between the second learning situation data and the presence or absence of fraud by the learning user in the first service. The fraud detection system 1 detects fraud by the target user in the first service based on the second target situation data and the learned fraud detection model M. The fraud detection system 1 can improve the accuracy of fraud detection by using the fraud detection model M of machine learning. For example, the fraud detection system 1 can also handle the case where unknown data is input.

[0088] Furthermore, the fraud detection system 1 executes, as a predetermined process, a first transmission process of transmitting processing result data regarding whether or not the target user is fraudulent to the first service system 2. The fraud detection system 1 can inform the first service system 2 of whether or not the target user is fraudulent. This enables the fraud detection system 1 to prevent fraud in the first service and to identify fraud occurring in the first service at an early stage.

[0089] In addition, the second service system 3 generates a list of fraudulent users whose fraud has been detected in the second service. The target user is a user who is not on the list. The fraud detection system 1 can detect fraud even if the target user is one whose fraud has not been detected in the second service.

[0090] [6. Modifications] The present disclosure is not limited to the embodiments, and may be modified as appropriate without departing from the spirit and scope of the present disclosure.

[0091] 10 is a diagram showing an example of functions realized in the fraud detection system 1 of the modified example. For example, the fraud detection server 10 includes an ordinal data acquisition unit 105. The ordinal data acquisition unit 105 is realized by the control unit 11. The first service server 20 includes a creation unit 203 and an original detection unit 204. Each of the creation unit 203 and the original detection unit 204 is realized by the control unit 21.

[0092] [6-1. Variation 1] For example, there may be multiple second services that the fraud detection server 10 refers to in fraud detection in the first service. Multiple second service systems 3 are each connected to the network N of variant example 1. The hardware configuration and functions of each second service system 3 may be the same as those in the embodiment. The service providers of the multiple second services may be the same as each other, or may be different from each other.

[0093] In the first modification, as in the embodiment, an example is taken of a case where the user ID of the first service and the user ID of the second service are the same. The user ID of a certain second service and the user ID of another second service may be different from each other. In this case, the relationship between these user IDs is defined in at least one of the data storage unit 100 and the data storage unit 200. In the first modification, the number of second services is two. It is to be noted that the number of second services is not limited to two. The number of second services may be three or more.

[0094] For example, the first second service is an electronic commerce service similar to that in the embodiment. The second service system 3 of the first second service is similar to the second service system 3 in the embodiment. A financial service will be described as an example of the second second service. For example, the financial service is a service provided by a financial institution such as a bank or a securities company. A user uses the financial service from a financial app or browser installed on a user terminal 40. The financial app is an application provided by a financial institution. As in the embodiment, the second service may be any service.

[0095] Each second service system 3 of the multiple second services updates the second user database DB4 that it manages based on its own usage. The process by which each second service system 3 updates the second usage data is as described in the embodiment. For example, the second service system 3 of the second second service updates the second usage data when the user uses online banking or the like from a financial app or browser. For example, the second usage data of the second second service indicates the terminal ID of the user terminal 40 used by the user, the credit card number used for payment, the payment amount, the remittance destination, the date and time of use, or a combination of these.

[0096] The target situation data acquisition unit 102 of the first modified example acquires second target situation data related to the usage situation of the second service by the target user from the second service system 3 of each of the multiple second services. The process by which the target situation data acquisition unit 102 acquires the second target situation data from each of the second service systems 3 is the same as that of the embodiment. The target situation data acquisition unit 102 requests the second target situation data of the target user from each of the second service systems 3 of the multiple second services. Each of the second service servers 30 transmits the second target situation data to the fraud detection system 1 based on its own second user database DB4. The target situation data acquisition unit 102 acquires the second target situation data from each of the second service systems 3.

[0097] The fraud detection model M of the first modification has learned the relationship between the second learning status data of the second service system 3 of each of the multiple second services and the presence or absence of fraud by the learning user. The input portion of the training data of the first modification includes the second learning status data of the second service system 3 of each of the multiple second services. Although the input portion of the training data is different from the embodiment, the processing of the learning unit 101 itself is the same as in the embodiment. That is, the learning method of the fraud detection model M itself is the same as in the embodiment.

[0098] The fraud detection unit 103 of the first modification detects fraud by the target user in the first service based on the second target situation data acquired from each of the second service systems 3 of the multiple second services and the fraud detection model M. The fraud detection unit 103 of the first modification inputs not only the second target situation data acquired from one second service system 3 but also the second target situation data acquired from each of the multiple second service systems 3 to the fraud detection model M. The fraud detection model M calculates a feature amount based on the second target situation data acquired from each of the multiple second service systems 3 based on the parameter portion adjusted by learning. The fraud detection model M outputs an inference result regarding the fraud of the target user based on the calculated feature amount. The processing after the inference result is output is the same as that of the embodiment.

[0099] The fraud detection system 1 of the first modification acquires second target situation data of the target user from each of the second service systems 3 of the multiple second services. The fraud detection system 1 detects fraud by the target user in the first service based on the second target situation data acquired from each of the second service systems 3 of the multiple second services and the fraud detection model M. The fraud detection system 1 of the first modification can detect fraud in the first service by comprehensively taking into account trends in each of the multiple second services, and therefore can further improve the accuracy of fraud detection.

[0100] [6-2. Variation 2] For example, in the first modification, items included in the second target situation data acquired from one second service system 3 may be different from items included in the second target situation data acquired from another second service system 3. The target situation data acquisition unit 102 in the second modification acquires second target situation data relating to different types of usage situations from each of the second service systems 3 of a plurality of second services.

[0101] In the second variant, as in the first variant, an example is taken in which the first second service is an e-commerce service. An example is taken in which the second second service is a financial service. For example, the second target status data of the first second service includes a delivery destination, which is an item specific to the first second service. The second target status data of the second second service includes a remittance destination, which is an item specific to the second second service. Two or more items may differ between the second target status data of the first second service and the second target status data of the second second service.

[0102] The fraud detection unit 103 of the second modification detects fraud by a target user in a first service based on second target situation data relating to different types of usage situations acquired from the second service system 3 of each of the second services and based on the fraud detection model M. The items included in the second target situation data are different from each other, as somewhat explained in the first modification. All items of the second target situation data of each of the second services may be different, or only some items may be different. The process itself executed by the fraud detection unit 103 is the same as in the first modification.

[0103] In addition, the fraud detection model M of the second modification has learned second learning status data related to different types of usage situations. The items included in the second learning status data are, in principle, the same as the items included in the second target situation data. All items of the second learning status data of each of the multiple second services may be different, or only some of the items may be different. The learning method of the fraud detection model M itself is the same as that of the first modification.

[0104] The fraud detection system 1 of the second modification acquires second target situation data relating to different types of usage situations from each of the second service systems 3 of the multiple second services. The fraud detection system 1 detects fraud by the target user in the first service based on the second target situation data relating to the different types of usage situations acquired from each of the second service systems 3 of the multiple second services and the fraud detection model M. The fraud detection system 1 of the second modification can detect fraud by the target user in the first service by taking into account items specific to each second service, and therefore can further improve the accuracy of fraud detection.

[0105] [6-3. Variation 3] For example, in the first and second variants, the second target situation data may include a usage situation represented by a numerical value, such as a payment amount. In this case, an evaluation value may be calculated based on the numerical values ​​of each of the second services, and fraud in the first service may be detected. The evaluation value is a value that the fraud detection model M refers to in order to detect fraud. In the third variant, a total value is described as an example of an evaluation value, but the evaluation value may be any value obtained by substituting the numerical values ​​of each of the second services into a predetermined formula. For example, the evaluation value may be an average value, a variance, a standard deviation, or another value.

[0106] The target situation data acquisition unit 102 of the third modification acquires second target situation data indicating a numerical value related to the usage situation of the second service by the target user from the second service system 3 of each of the second services. The numerical value may indicate any usage situation, and may be, for example, an individual payment amount, an average payment amount, a total value of payment amounts, the number of times of use, the frequency of use, the duration of use, or other numerical values. The fact that the second target situation data indicates a numerical value has been somewhat explained in the embodiment and the first and second modifications. Other points of the target situation data acquisition unit 102 are similar to those of the embodiment and the first and second modifications.

[0107] The fraud detection model M of the third modification is assumed to have learned the relationship between the evaluation value calculated based on the second learning status data and whether or not the learning user has committed fraud. The learning unit 101 calculates the evaluation value based on the second learning status data, and then learns the fraud detection model M. The evaluation value may be calculated in advance and included in the input portion of the training data. The input portion of the training data of the third modification may include an evaluation value calculated from the second learning status data of the second service system 3 of each of the multiple second services. The processing of the learning unit 101 itself is the same as in the embodiment.

[0108] The fraud detection unit 103 of the third modification calculates an evaluation value based on a numerical value indicated by the second target situation data acquired from the second service system 3 of each of the multiple second services. The fraud detection unit 103 detects fraud by the target user in the first service based on the calculated evaluation value and the fraud detection model M. It is assumed that a calculation formula used in calculating the evaluation value is stored in advance in the data storage unit 100. The fraud detection unit 103 calculates the evaluation value based on a numerical value indicated by the second target situation data acquired from the second service system 3 of each of the multiple second services and the calculation formula.

[0109] In the third modification, a case where the sum corresponds to the evaluation value is taken as an example, so the fraud detection unit 103 calculates the sum of the numerical values ​​indicated by the second target situation data acquired from the second service systems 3 of each of the multiple second services as the evaluation value. The fraud detection unit 103 detects fraud by the target user in the first service based on the calculated sum and the fraud detection model M. For example, the fraud detection unit 103 inputs the sum to the fraud detection model M. The fraud detection model M calculates a feature based on the sum. The fraud detection model M outputs an estimation result according to the calculated feature.

[0110] The fraud detection system 1 of the third modification acquires, from the second service system 3 of each of the multiple second services, second target situation data indicating a numerical value related to the usage status of the second service by the target user. The fraud detection system 1 calculates an evaluation value based on the numerical value indicated by the second target situation data acquired from the second service system 3 of each of the multiple second services. The fraud detection system 1 detects fraud by the target user in the first service based on the calculated evaluation value and the fraud detection model M. The fraud detection system 1 of the third modification can further improve the accuracy of fraud detection by taking into account the evaluation value that integrates the usage status of each of the multiple second services.

[0111] [6-4. Variation 4] For example, in the third modification, an evaluation value is calculated, but instead of calculating an evaluation value, a representative value may be identified from the numerical values ​​indicated by the second target situation data of each of the multiple second services. The representative value is a numerical value used in fraud detection. In the fourth modification, a maximum value corresponds to the representative value, but the representative value may be, for example, a minimum value, a median value, or another value. The processing of the target situation data acquisition unit 102 in the fourth modification is the same as that in the third modification. Not only one representative value but multiple representative values ​​may be identified.

[0112] The fraud detection model M of the fourth modification is assumed to have learned the relationship between the representative value identified based on the learning status data and whether or not the learning user has committed fraud. The learning unit 101 identifies the representative value based on the second learning status data, and then learns the fraud detection model M. The representative value may be identified in advance and included in the input portion of the training data. The input portion of the training data of the fourth modification may include a representative value identified from the second learning status data of the second service system 3 of each of the multiple second services. The processing of the learning unit 101 itself is the same as in the embodiment.

[0113] The fraud detection unit 103 of the fourth modification specifies a representative value from among the numerical values ​​indicated by the second target situation data acquired from the second service system 3 of each of the second services. The fraud detection unit 103 detects fraud by the target user in the first service based on the specified representative value and the fraud detection model M. In the fourth modification, a case in which the maximum value corresponds to the representative value is taken as an example, so the fraud detection unit 103 specifies a maximum value from among the numerical values ​​indicated by the second target situation data acquired from the second service system 3 of each of the second services. The fraud detection unit 103 detects fraud by the target user in the first service based on the specified maximum value and the fraud detection model M. For example, the fraud detection unit 103 inputs the maximum value to the fraud detection model M. The fraud detection model M calculates a feature amount based on the maximum value. The fraud detection model M outputs an estimation result according to the calculated feature amount.

[0114] The fraud detection system 1 of the fourth modification acquires second target situation data indicating numerical values ​​related to the usage status of the second service by the target user from the second service system 3 of each of the multiple second services. The fraud detection system 1 identifies a representative value from among the numerical values ​​indicated by the second target situation data acquired from the second service system 3 of each of the multiple second services. The fraud detection system 1 detects fraud by the target user in the first service based on the identified representative value and the fraud detection model M. The fraud detection system 1 of the fourth modification can further improve the accuracy of fraud detection by focusing on a representative value from among the usage status of each of the multiple second services.

[0115] [6-5. Variation 5] For example, in the embodiment, the first transmission process of transmitting processing result data to the first service system 2 corresponds to the predetermined process executed by the process execution unit 104. The predetermined process executed by the process execution unit 104 may be any process based on the processing result of the fraud detection unit 103. The predetermined process executed by the process execution unit 104 is not limited to the example of the embodiment. In Modification 5, another example of the predetermined process executed by the process execution unit 104 will be described.

[0116] The process execution unit 104 of the fifth modified example identifies at least one second service that is valid in detecting fraud by the target user in the first service from among the second services based on the processing result of the fraud detection unit 103. The process execution unit 104 executes, as a predetermined process, a second transmission process of transmitting valid service data related to the identified at least one second service to the first service system 2 of the first service.

[0117] Effectiveness in fraud detection means that it is important in estimating whether or not fraud has occurred. For a machine learning fraud detection model M, high feature importance is equivalent to effectiveness in fraud detection. Feature importance is the degree to which a feature contributes to the estimation result in machine learning. Feature importance is sometimes called by other names such as impact. For a non-machine learning fraud detection model M, a large number of parameters that satisfy the rules for determining fraud is equivalent to effectiveness in fraud detection.

[0118] In the fifth modification, a case where high feature importance corresponds to effectiveness in detecting fraud is taken as an example. The method of calculating the feature importance may be a known method. For example, random forest, permutation importance, SHAP (SHapley Additive exPlanations), or other methods may be used. The processing execution unit 104 calculates the feature importance based on these methods. The processing execution unit 104 identifies a second service corresponding to second target situation data having a relatively high feature importance. For example, the processing execution unit 104 identifies a second service corresponding to second target situation data having the highest feature importance, second target situation data having a top predetermined number of feature importance, or second target situation data having a feature importance equal to or greater than a threshold.

[0119] The valid service data is data capable of identifying the second service that is valid upon fraud detection. For example, the valid service data may be the name of the second service, the name of the second service server 30, or other data. The process execution unit 104 executes the second transmission process by transmitting, to the first service system 2, the valid service data indicating the second service that is identified as valid upon fraud detection.

[0120] The first service server 20 of the fifth modified example receives valid service data from the fraud detection system 1. The first service server 20 records the valid service data in the data storage unit 200. The valid service data can be used for any purpose. For example, the first service server 20 notifies the administrator of the first service of the second service indicated by the valid service data. The contents of the valid service data may be displayed on the terminal of the administrator of the first service. The administrator of the first service becomes aware of the second service. The administrator of the first service contacts the administrator of the second service and cooperates with each other's fraud detection algorithms. The valid service data may be utilized in the first service's unique fraud detection algorithm.

[0121] The fraud detection system 1 of the fifth modification identifies at least one second service that is effective in detecting fraud by the target user in the first service from among the multiple second services based on the processing result of the fraud detection unit 103. The fraud detection system 1 executes, as a predetermined process, a second transmission process of transmitting effective service data related to the identified at least one second service to the first service system 2 of the first service. The fraud detection system 1 of the fifth modification can provide the first service system 2 with information that is useful in detecting fraud in the first service.

[0122] [6-6. Variation 6] For example, in variant 5, the first service system 2 may create its own fraud detection model based on the valid service data. The own fraud detection model is a model for the first service system 2 itself to perform fraud detection, not the fraud detection system 1. Variation 6 takes as an example a case where the own fraud detection model is a model related to machine learning. Note that the fraud detection system 1 of variant 6 includes the first service system 2. The data storage unit 200 of variant 6 stores the own fraud detection model.

[0123] For example, various known machine learning techniques can be used. For example, the unique fraud detection model is not limited to a supervised learning or semi-supervised learning model, and may be an unsupervised learning model. More specifically, the unique fraud detection model may be a neural network, a support vector machine, a random forest, a logistic regression, a decision tree, or a model of another technique.

[0124] For example, the unique fraud detection model includes a program portion that performs calculation of features, etc., and a parameter portion referenced by the program portion. The parameter portion is changed by learning. For example, the first service server 20 or another computer learns the unique fraud detection model. When the learning is completed, the parameter portion of the unique fraud detection model before learning is overwritten. The unique fraud detection model learns the relationship between the second learning status data regarding the usage status of the second service by the learning user for learning the unique fraud detection model, and the presence or absence of fraud by the learning user in the first service.

[0125] The unique fraud detection model may be a model of a method other than machine learning. For example, the unique fraud detection model may be a rule-based model created by a method other than machine learning. The unique fraud detection model may be a model that combines a model of a machine learning method and a rule-based model. Models that can be adopted as the unique fraud detection model may be various models used in known fraud detection.

[0126] The first service system 2 includes a creation unit 203 and a unique detection unit 204. The creation unit 203 creates a fraud detection model unique to the first service system 2 based on the valid service data. The data storage unit 200 of the modified example 6 stores training data for the unique fraud detection model. Each training data is a pair of an input part and an output part. In principle, the input part and the output part of the training data have the same format as the input and output of the unique fraud detection model at the time of estimation. The output part can also be said to be the correct answer at the time of learning. For example, the training data may be created manually by an administrator, or some kind of creation tool may be used.

[0127] For example, the input portion of the training data of the unique fraud detection model includes at least the second learning status data. In Variation 6, the input portion includes the first learning status data and the second learning status data. The output portion of the training data of the unique fraud detection model is information regarding the presence or absence of fraud in the first service. Variation 6 describes a case where the output portion of the training data of the unique fraud detection model is a label indicating whether or not there is fraud, but the output part may also be a score indicating suspicion of fraud.

[0128] For example, the creation unit 203 determines a second service to be included in the input portion of the training data based on the valid service data. Among the multiple second services, the creation unit 203 includes in the input portion of the training data the second learning status data of a second service having the highest feature importance indicated by the valid service data, a second service having the feature importance up to a predetermined top rank, or a second service having the feature importance equal to or greater than a threshold. The second learning status data of other second services is not included in the input portion of the training data, and is not used during estimation.

[0129] For example, the creation unit 203 trains the training data into a unique fraud detection model. The learning of the unique fraud detection model itself can utilize a known machine learning method, and for example, the backpropagation method or the gradient descent method may be used. The loss function and the like used in the learning of the unique fraud detection model may also be a known method. The creation unit 203 executes learning of the unique fraud detection model such that when an input portion of training data is input, an output portion of the training data is output.

[0130] The unique detection unit 204 of the sixth modification detects fraud by the target user based on the unique fraud detection model created by the creation unit 203. In the sixth modification, the unique fraud detection model is a model related to machine learning, so the unique detection unit 204 detects fraud by the target user in the first service based on the second target situation data and the learned unique fraud detection model. The unique detection unit 204 detects fraud by the target user in the first service when the output of the unique fraud detection model indicates fraud or when the score of the unique fraud detection model is equal to or greater than a threshold.

[0131] The first service server 20 may acquire the second target situation data of the target user from the second service system 3 of the second service that is used in the estimation by the unique fraud detection model among the multiple second services. The flow of the first service server 20 acquiring the second target situation data may be similar to the flow of the fraud detection server 10 acquiring the second target situation data. In the sixth modification, not only the second target situation data but also the first target situation data is used in fraud detection.

[0132] For example, the unique detection unit 204 inputs the first target situation data and the second target situation data to the trained unique fraud detection model. The unique detection unit 204 may perform preprocessing such as aggregation or normalization on the first target situation data and the second target situation data, and then input the first target situation data and the second target situation data that have been subjected to the preprocessing to the trained unique fraud detection model.

[0133] For example, the unique fraud detection model calculates feature quantities of the first target situation data and the second target situation data input thereto based on the parameter portion adjusted by learning. The unique fraud detection model outputs an inference result regarding the fraud of the target user based on the calculated feature quantities. In the sixth modification example, the unique fraud detection model outputs an inference result indicating whether the target user is fraudulent or not. The inference result is either a value indicating that the target user is fraudulent or a value indicating that the target user is not fraudulent. The unique fraud detection model may output a score regarding the fraud of the target user.

[0134] For example, the first service server 20 notifies an administrator of the first service of a user whose fraud has been detected by the unique fraud detection model. The first service server 20 may restrict the use of the first service by a user whose fraud has been detected by the unique fraud detection model, without the need to notify the administrator of the first service. The result of fraud detection by the unique fraud detection model can be used for any purpose.

[0135] The fraud detection system 1 of the sixth modification creates a fraud detection model unique to the first service system 2 based on the valid service data. The fraud detection system 1 detects fraud by the target user based on the unique fraud detection model. By utilizing the unique fraud detection model for the first service, the fraud detection system 1 of the sixth modification can further improve the accuracy of fraud detection in the first service.

[0136] [6-7. Variation 7] For example, a fraudulent user may commit fraud in a predetermined order in each of a plurality of second services. There may be a tendency that the first service is more likely to be targeted for fraud after fraud has been committed in a certain order. For this reason, when fraud occurs in each of a plurality of second services, the fraud may be detected taking into consideration the order in which the fraud occurred.

[0137] The fraud detection system 1 includes a sequence data acquisition unit 105. When fraud occurs in each of a plurality of second services, the sequence data acquisition unit 105 acquires sequence data relating to the sequence in which the fraud occurred. The sequence data indicates the sequence of the second services in which the fraud occurred. The fraud is detected by an administrator of the second service. The fraud detection system 1 acquires data indicating the occurrence of fraud from the second service system 3 of each of the plurality of second services. The sequence data acquisition unit 105 identifies the sequence in which the fraud occurred based on the data and generates sequence data.

[0138] The fraud detection unit 103 of the seventh modification detects fraud by the target user in the first service further based on the order data. For example, the fraud detection unit 103 inputs the order data to the fraud detection model M. It is assumed that the fraud detection model M of the seventh modification also learns the relationship between the order data and the presence or absence of fraud in the first service. The fraud detection model M calculates a feature amount based on the order data. The fraud detection model M estimates the presence or absence of fraud by the target user in the first service based on the calculated feature amount.

[0139] The fraud detection system 1 of the seventh modification acquires sequence data regarding the sequence in which fraud occurred when fraud occurred in each of the multiple second services. The fraud detection system 1 detects fraud by a target user in the first service further based on the sequence data. The fraud detection system 1 of the seventh modification can further improve the accuracy of fraud detection by further considering the sequence in which fraud occurred in each of the multiple second services. For example, when fraud has been detected in a specific sequence in each of the multiple second services and a user with a certain usage pattern tends to commit fraud in the first service, the fraud detection system 1 becomes more likely to detect fraud in the first service.

[0140] [6-8. Variation 8] For example, in the fifth modification, a case has been given in which sending valid service data to the first service system 2 corresponds to the predetermined processing executed by the processing execution unit 104. In the eighth modification, another example of the predetermined processing executed by the processing execution unit 104 will be described. Based on the processing result of the fraud detection unit 103, the processing execution unit 104 in the eighth modification specifies, from among a plurality of second services, at least one second service that is valid in detecting fraud of the target user in the first service. This processing is the same as in the fifth modification.

[0141] The process execution unit 104 of the eighth modified example executes, as a predetermined process, a third transmission process of transmitting target user data related to the target user in whom fraud was detected in the first service to the second service system 3 of at least one of the above-specified second services. In the eighth modified example, a case is taken as an example in which the user ID of the target user corresponds to the target user data, but the target user data may be any information related to the target user. For example, the target user data may be all or a part of the second target situation data of the target user, or all or a part of the first target situation data of the target user. The target user data may be a user ID.

[0142] The second service server 30 of the eighth modified example receives target user data from the fraud detection system 1. The second service server 30 records the target user data in the data storage unit 300. The target user data can be used for any purpose. For example, the second service server 30 notifies the administrator of the second service of the contents of the target user data. The administrator of the second service considers his / her own unique fraud detection algorithm based on the contents.

[0143] The fraud detection system 1 of the eighth modification example identifies at least one second service that is effective in detecting fraud by a target user in the first service from among a plurality of second services based on the processing result of the fraud detection unit 103. The fraud detection system 1 executes, as a predetermined process, a third transmission process of transmitting target user data related to a target user whose fraud was detected in the first service to a second service system of the identified at least one second service. The fraud detection system 1 of the eighth modification example can provide the second service system 3 with information useful in detecting fraud in at least one of the first service and the second service.

[0144] [6-9. Variation 9] For example, the second target situation data may include multiple items related to the usage status of the second service. This also applies to the second target situation data in the embodiment. The processing execution unit 104 of the modified example 9 identifies an item that is effective in detecting fraud of the target user in the first service from among the multiple items based on the processing result of the fraud detection unit 103. The meaning of "effective in detecting fraud" is as explained in the modified example 5. In the modified example 9, as in the modified example 5, a case is taken as an example in which high feature importance corresponds to being effective in detecting fraud.

[0145] The process execution unit 104 of the ninth modified example executes a fourth transmission process as a predetermined process, which transmits item data relating to the identified item to the first service system 2 of the first service. The item data is data capable of identifying an item that is valid in fraud detection. For example, the item data may be the name of the item, the ID of the item, or other data. The process execution unit 104 executes the fourth transmission process by transmitting item data indicating the item identified as valid in fraud detection to the first service system 2.

[0146] The first service server 20 of the ninth variant receives item data from the fraud detection system 1. The first service server 20 records the item data in the data storage unit 200. The item data can be used for any purpose. For example, the first service server 20 notifies the administrator of the first service of the items indicated by the item data. The administrator of the first service becomes aware of the items. The administrator of the first service contacts the administrator of the second service and cooperates with each other's fraud detection algorithms. The item data may be utilized in the first service's unique fraud detection algorithm.

[0147] The fraud detection system 1 of the 9th modification identifies an item that is effective in detecting fraud by the target user in the first service from among multiple items based on the processing result of the fraud detection unit 103. The fraud detection system 1 executes, as a predetermined process, a fourth transmission process of transmitting item data related to the identified item to the first service system 2. The fraud detection system 1 of the 9th modification can provide the first service system with information that is useful in detecting fraud in the first service.

[0148] [6-10. Variation 10] For example, in the 9th modification, the first service system 2 may create its own fraud detection model based on the item data as in the 6th modification. The meaning of the own fraud detection model is as explained in the 6th modification. The fraud detection system 1 in the 10th modification further includes the first service system 2. The first service system 2 includes a creation unit 203 and a own detection unit 204.

[0149] The creation unit 203 of the modification 10 creates a fraud detection model unique to the first service system 2 based on the item data. The unique fraud detection model of the modification 10 learns the relationship between second learning status data on the usage status of the second service by the learning user for learning the unique fraud detection model and the presence or absence of fraud by the learning user in the first service. The second learning status data of the modification 10 indicates the items indicated by the item data.

[0150] The data storage unit 200 of the tenth modification stores training data for the unique fraud detection model. For example, the creation unit 203 trains the unique fraud detection model on the training data. The learning of the unique fraud detection model itself can utilize a known machine learning method, and for example, the backpropagation method or the gradient descent method may be used. The loss function and the like used in the learning of the unique fraud detection model may also be a known method. The creation unit 203 executes learning of the fraud detection model M such that when an input portion of training data is input, an output portion of the training data is output.

[0151] For example, the creation unit 203 determines the items of the second learning status data to be included in the input portion of the training data based on the item data. The creation unit 203 includes, from among the multiple items, second learning status data including the item with the highest feature importance indicated by the item data, items with the feature importance up to a predetermined top rank, or items with the feature importance equal to or greater than a threshold, in the input portion of the training data. Other items are not included in the input portion of the training data, and are not used during estimation.

[0152] The unique detection unit 204 of the tenth modification detects fraud by the target user based on the unique fraud detection model created by the creation unit 203. In the tenth modification, the unique fraud detection model is a model related to machine learning, so the unique detection unit 204 detects fraud by the target user in the first service based on the second target situation data and the learned unique fraud detection model. The unique detection unit 204 detects fraud by the target user in the first service when the output of the unique fraud detection model indicates fraud or when the score of the unique fraud detection model is equal to or greater than a threshold.

[0153] In the tenth modification, not only the second target situation data but also the first target situation data is used for fraud detection. The unique detection unit 204 inputs the first target situation data and the second target situation data to the trained unique fraud detection model. The unique detection unit 204 may perform preprocessing such as aggregation or normalization on the first target situation data and the second target situation data, and then input the first target situation data and the second target situation data that have been subjected to the preprocessing to the trained unique fraud detection model.

[0154] For example, the unique fraud detection model calculates feature quantities of the first target situation data and the second target situation data input thereto based on the parameter portion adjusted by learning. The unique fraud detection model outputs an inference result regarding the fraud of the target user based on the calculated feature quantities. In the tenth modification, the unique fraud detection model outputs an inference result indicating whether the target user is fraudulent or not. The inference result is either a value indicating that the target user is fraudulent or a value indicating that the target user is not fraudulent. The unique fraud detection model may output a score regarding the fraud of the target user.

[0155] For example, the first service server 20 notifies an administrator of the first service of a user whose fraud has been detected by the unique fraud detection model. The first service server 20 may restrict the use of the first service by a user whose fraud has been detected by the unique fraud detection model, without the need to notify the administrator of the first service. The result of fraud detection by the unique fraud detection model can be used for any purpose.

[0156] The fraud detection system 1 of the tenth modification creates a fraud detection model unique to the first service system 2 based on the item data. The fraud detection system 1 detects fraud by the target user based on the unique fraud detection model. By utilizing the unique fraud detection model for the first service, the fraud detection system 1 of the tenth modification can further improve the accuracy of fraud detection in the first service.

[0157] [6-11. Other variations] For example, the above-described modifications may be combined.

[0158] For example, the functions described as being realized by the fraud detection server 10 may be realized by at least one computer in the fraud detection system 1, or the functions may be shared among multiple computers. In this case, the functions may be shared by each of the multiple computers transmitting its own processing results to the other computers. For example, the functions described as being realized by the fraud detection server 10 may be realized by at least one of the first service server 20 and the second service server 30.

[0159] [7. Notes] For example, the fraud detection system according to the present disclosure can also be configured as follows. (1) a target situation data acquisition unit that acquires target situation data regarding a usage situation of a second service by a target user who is a target of fraud detection in a first service from a second service system of a second service used by the target user; a fraud detection unit that detects fraud by the target user in the first service based on the target situation data and a fraud detection model for detecting fraud in the first service; a processing execution unit that executes a predetermined process based on a processing result of the fraud detection unit; Fraud detection systems, including: (2) The fraud detection model is a machine learning model, The fraud detection model learns a relationship between learning status data on a usage status of the second service by a learning user for learning the fraud detection model and the presence or absence of fraud by the learning user in the first service, The fraud detection unit detects fraud by the target user in the first service based on the target situation data and the learned fraud detection model. The fraud detection system described in (1). (3) The process execution unit executes, as the predetermined process, a first transmission process of transmitting process result data regarding whether the target user is fraudulent to a first service system of the first service. A fraud detection system according to (1) or (2). (4) the target situation data acquisition unit acquires the target situation data related to a usage situation of the second service by the target user from the second service system of each of the plurality of second services; the fraud detection unit detects fraud by the target user in the first service based on the target situation data acquired from the second service system of each of the plurality of second services and the fraud detection model; A fraud detection system according to any one of (1) to (3). (5) the target situation data acquisition unit acquires the target situation data relating to different types of usage situations from the second service systems of the second services, the fraud detection unit detects fraud by the target user in the first service based on the target situation data related to the different types of usage situations acquired from the second service systems of each of the plurality of second services and based on the fraud detection model; (4) A fraud detection system as described above. (6) the target situation data acquisition unit acquires, from the second service system of each of the plurality of second services, the target situation data indicating a numerical value related to a usage situation of the second service by the target user; The fraud detection unit is calculating an evaluation value based on the numerical value indicated by the target situation data acquired from the second service system of each of the plurality of second services; Detecting fraud by the target user in the first service based on the calculated evaluation value and the fraud detection model. A fraud detection system according to (4) or (5). (7) the target situation data acquisition unit acquires, from the second service system of each of the plurality of second services, the target situation data indicating a numerical value related to a usage situation of the second service by the target user; The fraud detection unit is Identifying a representative value from among the numerical values ​​indicated by the target situation data acquired from each of the second service systems of the plurality of second services; Detecting fraud by the target user in the first service based on the identified representative value and the fraud detection model. A fraud detection system according to any one of (4) to (6). (8) The processing execution unit is Identifying at least one second service that is effective in detecting fraud by the target user in the first service from among the plurality of second services based on a processing result of the fraud detection unit; executing, as the predetermined process, a second transmission process of transmitting valid service data related to the identified at least one second service to a first service system of the first service; A fraud detection system according to any one of (4) to (7). (9) the fraud detection system further includes the first service system; The first service system is a creation unit that creates a fraud detection model unique to the first service system based on the valid service data; A unique detection unit that detects fraud by the target user based on the unique fraud detection model created by the creation unit; The fraud detection system according to (8) above. (10) the fraud detection system further includes an order data acquisition unit that acquires, when fraud occurs in each of the plurality of second services, order data relating to an order in which the fraud occurred; The fraud detection unit detects fraud by the target user in the first service based on the order data. A fraud detection system according to any one of (4) to (9). (11) The processing execution unit is Identifying at least one second service that is effective in detecting fraud by the target user in the first service from among the plurality of second services based on a processing result of the fraud detection unit; execute, as the predetermined process, a third transmission process of transmitting target user data related to the target user in which fraud has been detected in the first service to the second service system of the identified at least one second service; A fraud detection system according to any one of (4) to (10). (12) The target situation data includes a plurality of items related to a usage situation of the second service, The processing execution unit is Identifying an item that is effective for detecting fraud by the target user in the first service from among the plurality of items based on a processing result of the fraud detection unit; execute, as the predetermined process, a fourth transmission process of transmitting item data related to the identified item to a first service system of the first service; A fraud detection system according to any one of (1) to (11). (13) the fraud detection system further includes the first service system; The first service system is A creation unit that creates a fraud detection model unique to the first service system based on the item data; A unique detection unit that detects fraud by the target user based on the unique fraud detection model created by the creation unit; The fraud detection system according to (12) above. (14) In the second service system, a list of fraudulent users whose fraud has been detected in the second service is generated; The target user is a user not on the list. A fraud detection system according to any one of (1) to (13). [Explanation of symbols]

[0160] 1 fraud detection system, 2 first service system, 3 second service system, 10 fraud detection server, 11, 21, 31, 41 control unit, 12, 22, 32, 42 memory unit, 13, 23, 33, 43 communication unit, 20 first service server, 30 second service server, 40 user terminal, 44 operation unit, 45 display unit, M fraud detection model, N network, 100 data storage unit, 101 learning unit, 102 target situation data acquisition unit, 103 fraud detection unit, 104 processing execution unit, 105 order data acquisition unit, 200 data storage unit, 201 transmission unit, 202 reception unit, 203 creation unit, 204 unique detection unit, 300 data storage unit, 301 transmission unit, 302 reception unit, DB1 training database, DB2 processing result database, DB3 first user database, DB4 second user database.

Claims

1. a target situation data acquisition unit that acquires target situation data regarding a usage situation of a second service by a target user who is a target of fraud detection in the first service from a second service system of the second service used by the target user; a fraud detection unit that detects fraud by the target user in the first service based on the target situation data and a fraud detection model for detecting fraud in the first service; a processing execution unit that executes a predetermined process based on a processing result of the fraud detection unit; Fraud detection systems, including:

2. The fraud detection model is a machine learning model, The fraud detection model learns a relationship between learning status data on a usage status of the second service by a learning user for learning the fraud detection model and the presence or absence of fraud by the learning user in the first service, The fraud detection unit detects fraud by the target user in the first service based on the target situation data and the learned fraud detection model. The fraud detection system of claim 1 .

3. The process execution unit executes, as the predetermined process, a first transmission process of transmitting process result data regarding whether the target user is fraudulent to a first service system of the first service. The fraud detection system according to claim 1 or 2.

4. the target situation data acquisition unit acquires the target situation data related to a usage situation of the second service by the target user from the second service system of each of the plurality of second services; The fraud detection unit detects fraud by the target user in the first service based on the target situation data acquired from the second service system of each of the plurality of second services and the fraud detection model. The fraud detection system according to claim 1 or 2.

5. the target situation data acquisition unit acquires the target situation data relating to different types of usage situations from the second service systems of the second services, the fraud detection unit detects fraud by the target user in the first service based on the target situation data regarding the different types of usage situations acquired from the second service systems of each of the second services and the fraud detection model; The fraud detection system of claim 4.

6. the target situation data acquisition unit acquires, from the second service system of each of the plurality of second services, the target situation data indicating a numerical value related to a usage situation of the second service by the target user; The fraud detection unit is calculating an evaluation value based on the numerical value indicated by the target situation data acquired from the second service system of each of the plurality of second services; Detecting fraud by the target user in the first service based on the calculated evaluation value and the fraud detection model. The fraud detection system of claim 4.

7. the target situation data acquisition unit acquires, from the second service system of each of the plurality of second services, the target situation data indicating a numerical value related to a usage situation of the second service by the target user; The fraud detection unit is Identifying a representative value from among the numerical values ​​indicated by the target situation data acquired from each of the second service systems of the plurality of second services; Detecting fraud by the target user in the first service based on the identified representative value and the fraud detection model. The fraud detection system of claim 4.

8. The processing execution unit is Identifying at least one second service that is effective in detecting fraud by the target user in the first service from among the plurality of second services based on a processing result of the fraud detection unit; executing, as the predetermined process, a second transmission process of transmitting valid service data related to the identified at least one second service to a first service system of the first service; The fraud detection system of claim 4.

9. The fraud detection system further includes the first service system; The first service system is a creation unit that creates a fraud detection model unique to the first service system based on the valid service data; A unique detection unit that detects fraud by the target user based on the unique fraud detection model created by the creation unit; The fraud detection system of claim 8 , comprising:

10. the fraud detection system further includes an order data acquisition unit that acquires, when fraud occurs in each of the plurality of second services, order data relating to an order in which the fraud occurred; The fraud detection unit detects fraud by the target user in the first service based on the order data. The fraud detection system of claim 4.

11. The processing execution unit is Identifying at least one second service that is effective in detecting fraud by the target user in the first service from among the plurality of second services based on a processing result of the fraud detection unit; execute, as the predetermined process, a third transmission process of transmitting target user data related to the target user in which fraud has been detected in the first service to the second service system of the identified at least one second service; The fraud detection system of claim 4.

12. The target situation data includes a plurality of items related to a usage situation of the second service, The processing execution unit is Identifying an item that is effective for detecting fraud by the target user in the first service from among the plurality of items based on a processing result of the fraud detection unit; execute, as the predetermined process, a fourth transmission process of transmitting item data related to the specified item to a first service system of the first service; The fraud detection system according to claim 1 or 2.

13. The fraud detection system further includes the first service system; The first service system is a creation unit that creates a fraud detection model unique to the first service system based on the item data; A unique detection unit that detects fraud by the target user based on the unique fraud detection model created by the creation unit; The fraud detection system of claim 12 , comprising:

14. In the second service system, a list of fraudulent users whose fraud has been detected in the second service is generated; The target user is a user not on the list. The fraud detection system according to claim 1 or 2.

15. a target situation data acquisition step of acquiring target situation data on a usage situation of a second service by a target user who is a target of fraud detection in the first service from a second service system of the second service used by the target user; a fraud detection step of detecting fraud by the target user in the first service based on the target situation data and a fraud detection model for detecting fraud in the first service; a processing execution step of executing a predetermined process based on a processing result of the fraud detection step; A fraud detection method comprising:

16. a target situation data acquisition unit that acquires, from a second service system of a second service used by a target user who is a target of fraud detection in the first service, target situation data regarding a usage situation of the second service by the target user; a fraud detection unit that detects fraud by the target user in the first service based on the target situation data and a fraud detection model for detecting fraud in the first service; a process execution unit that executes a predetermined process based on a process result of the fraud detection unit; A program that makes a computer function as a

Images