Information processing device, information processing method, and information processing program

Abstract

To reduce opportunity costs in designated transaction methods used for monetary transactions. [Solution] The information processing device according to the present invention comprises a classification unit and a determination unit. The classification unit classifies the type of fraud in a transaction in which fraud has been detected. The determination unit determines the content to be provided to the user subject to review based on the review status of the type of fraud classified by the classification unit.

Description

Technical Field

[0004] ,

[0006] , , , , , ,

[0005] , , ,

[0007] , , , , ,

[0001] The present invention relates to an information processing apparatus, an information processing method, and an information processing program.

Background Art

[0002] Techniques for monitoring money transaction information via financial institutions are known. For example, techniques for monitoring transaction information using classification conditions are known.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] Here, when a transaction is suspected of fraud or when a transaction becomes a target of a predetermined review, the transaction cannot be conducted until the review is completed. However, in the conventional technology, only the fact that the transaction is under review is provided to the user conducting the transaction, so there is a risk that the user will select another transaction method and an opportunity loss will occur.

[0005] The present application has been made in view of the above, and an object thereof is to reduce an opportunity loss in a predetermined transaction means for conducting a money transaction.

Means for Solving the Problems

[0006] The information processing apparatus according to the present application includes a classification unit that classifies the type of fraud of a transaction in which fraud is detected, and a determination unit that determines content to be provided to a user who is a review target based on the review status of the type of fraud classified by the classification unit.

Effects of the Invention

[0007] According to one embodiment, the effect is to reduce opportunity losses in a predetermined transaction method for conducting monetary transactions. [Brief explanation of the drawing]

[0008] [Figure 1] Figure 1 shows an example of conventional content. [Figure 2] Figure 2 shows an example of the configuration of an information processing system according to the embodiment. [Figure 3] Figure 3 shows an example of information processing according to the embodiment. [Figure 4] Figure 4 shows the relationship between cheating rules, types of cheating, and the time required. [Figure 5A] Figure 5A is Figure (1) showing an example of content according to the embodiment. [Figure 5B] Figure 5B is Figure (2) showing an example of content according to the embodiment. [Figure 6] Figure 6 shows an example of the configuration of a terminal device according to the embodiment. [Figure 7] Figure 7 shows an example of the configuration of an information processing device according to the embodiment. [Figure 8] Figure 8 shows an example of a test result storage unit according to an embodiment. [Figure 9] Figure 9 shows an example of a fraudulent rule storage unit according to the embodiment. [Figure 10] Figure 10 is a flowchart showing an example of information processing according to the embodiment. [Figure 11] Figure 11 is a hardware configuration diagram showing an example of a computer that implements the functions of an information processing device. [Modes for carrying out the invention]

[0009] The following describes in detail, with reference to the drawings, the embodiments for implementing the information processing device, information processing method, and information processing program according to the present application (hereinafter referred to as "embodiments"). Note that these embodiments do not limit the information processing device, information processing method, and information processing program according to the present application. Furthermore, the same parts are denoted by the same reference numerals in each of the following embodiments, and redundant descriptions are omitted.

[0010] (Embodiment) [1. Overview of Information Processing] Conventionally, technologies for monitoring financial transaction information through financial institutions are known. For example, technologies for monitoring transaction information using classification criteria are known.

[0011] Furthermore, when fraud is detected, content CX (User Experience) as shown in Figure 1 is displayed to notify users that the transaction, such as payment, has failed and that their use is restricted. Content CX is displayed uniformly whenever fraud is detected, regardless of the review status. Even when content CX is displayed, it is unclear to the user how to deal with it, which can be a source of stress.

[0012] Conventional technology could not differentiate the content displayed to users under review based on their review status, and the content shown in Figure 1 was not tailored to the review status. Therefore, it was not possible to reduce the loss of opportunity in the designated transaction method for monetary transactions.

[0013] In the embodiments described below, a monetary transaction refers to a settlement (for example, payment when purchasing goods), and the process of detecting fraud in a settlement will be explained as an example. However, a monetary transaction can be any transaction in which money changes hands (for example, a transaction that affects not only one user's funds but also the funds of other users), such as remittances or withdrawals. For example, a remittance that moves money from one user's financial account to another user's financial account may also be considered. Alternatively, a withdrawal by cashing out electronic money via an ATM may also be considered.

[0014] When the money transaction is a remittance, it is for detecting fraud in the remittance, and when the money transaction is a withdrawal, it is for detecting fraud in the withdrawal. Even when the money transaction is a remittance or a withdrawal, the same processing as in the case of settlement is performed, but the content displayed to the user and the conditions for dividing the content may be different.

[0015] In the following embodiments, the settlement may be based on any settlement process, may be an electronic settlement via a predetermined application (which may be a mini - application), or may be a settlement involving login.

[0016] In the following embodiments, when fraud is detected, the review (monitoring) is manually determined by an operator (reviewer). Here, it is determined whether it is a malicious transaction, a transaction of a legitimate user due to a simple false detection, etc. The review status such as the time required for monitoring may be observed regularly, for example, every hour.

[0017] 〔2. Configuration of Information Processing System〕 The information processing system 1 shown in FIG. 2 will be described. As shown in FIG. 2, the information processing system 1 includes a terminal device 10 and an information processing device 100. The terminal device 10 and the information processing device​​​​​​​The terminal device 10 can be any device as long as it can perform the processing in the embodiment. Furthermore, the terminal device 10 may be a smartphone, tablet, notebook PC, desktop PC, mobile phone, PDA, or other device. Figure 2 shows the case where the terminal device 10 is a smartphone.

[0020] Terminal device 10 is, for example, a smart device such as a smartphone or tablet, and is a mobile terminal device that can communicate with any server device via a wireless communication network such as 4G-5G (Generation) or LTE (Long Term Evolution). Terminal device 10 also has a screen, such as an LCD display, which has touch panel functionality and may accept various operations on displayed data such as content from the user, such as tapping, sliding, and scrolling, using a finger or stylus. In Figure 3, terminal device 10 is used by user U1.

[0021] The information processing device 100 is an information processing device aimed at reducing opportunity losses in a predetermined transaction means for conducting monetary transactions, and can be any device as long as it can realize the processing in the embodiment. The information processing device 100 is realized by, for example, a server device or a cloud system, and executes the information processing according to the embodiment.

[0022] The information processing device 100 performs processing to display different content to the user under review according to the review status, such as the time required for monitoring. For example, the information processing device 100 detects fraud and classifies the type of fraud, and then determines the content to be provided to the user under review based on the review status for each classified type of fraud. Since the review content (review scenario) is determined by the classified type of fraud, the type of fraud may be appropriately replaced with "review scenario" or similar terms.

[0023] As a variation, the information processing device 100 may perform processing to display different content to users under review in accordance with the time-series changes in the time required for monitoring (time-series changes based on two or more data points).

[0024] Furthermore, as a variation, the information processing device 100 may perform processing to display different content to users under review, taking into account user attributes, payment store information (such as the store's location and category), and payment amount.

[0025] [3. An example of information processing] Figure 3 shows an example of information processing according to the embodiment. In Figure 3, user U1 performs a payment operation to purchase goods at store P1 (which may be a physical store or an online store) (step S1), and fraud is detected.

[0026] The information processing device 100 determines whether or not the conditions of the fraud rule are met, rejects transactions that meet the conditions, and allows transactions that do not meet the conditions. In Figure 3, the information processing device 100 obtains the settlement information of user U1's settlement transaction D1 (step S11) and determines that settlement transaction D1 meets the fraud rule (step S12).

[0027] The information processing device 100 individually determines whether the transaction meets the conditions of one or more pre-selected fraud rules. In step S12, suppose the information processing device 100 determines that user U1's settlement transaction D1 meets fraud rule R1, one of two pre-selected fraud rules. This allows the information processing device 100 to identify the type of fraud. For example, if the transaction meets fraud rule R1, the information processing device 100 can identify the type of fraud as "fraud 1".

[0028] Each fraud rule has a predetermined time frame assigned to it for differentiating the content delivered to users who are determined to meet the rules. This time is the time required for monitoring to determine whether or not an action is fraudulent. For example, it may be a time set based on the review status for each type of fraud. For example, it may be a time calculated in advance based on data acquired over a specified period.

[0029] Figure 4 shows the relationship between fraud rules, types of fraud, time required, and the number of blocked users. In Figure 4, fraud rules R1 to R4 are included in the fraud rule list L1. The type of fraud for fraud rule R1 is "Fraud 1," and the time required for monitoring to determine whether or not it falls under Fraud 1 is "Required t1." The type of fraud for fraud rule R2 is "Fraud 2," and the time required for monitoring to determine whether or not it falls under Fraud 2 is "Required t2." Required t1 and Required t2 are predetermined minutes. For example, Required t1 and Required t2 are the average review time. For example, Required t1 and Required t2 are the average review time calculated in advance based on data acquired during a predetermined period. Required t1 and Required t2 may fluctuate depending on the review status of other types of fraud. Furthermore, the number of blocked users is, for example, the average number of blocked users on a monthly basis. The average number of blocked users due to fraud 1 is "Blocked 1," and the average number of blocked users due to fraud 2 is "Blocked 2."

[0030] The information processing device 100 determines the time required for monitoring at the current time (or within a range based on the current time) based on the time required for the fraud rule that has been determined to match (step S13). The information processing device 100 determines whether the time required for monitoring at the current time exceeds the time t1 required for the fraud rule R1 that matched user U1's settlement transaction D1. The time required for monitoring at the current time depends on the status of the operator's work (delay status) in determining whether or not the transaction is fraudulent. For example, during busy periods, the status of work tends to be delayed, and the time required for monitoring tends to be longer than usual.

[0031] The information processing device 100 displays content depending on whether the required time exceeds the required time t1. If the required time does not exceed the required time t1, the information processing device 100 provides content C1 that notifies the user to perform the settlement operation again after a time tx close to the required time t1 (step S14a). The time tx may be adjusted to be at least greater than the required time t1. The information processing device 100 provides content C1 that notifies the user that a transaction such as payment has failed and is under review, and that the settlement operation should be performed again after time tx, as shown in Figure 5A, for example.

[0032] On the other hand, if the required time exceeds the required time t1, it is considered that the situation is busier than usual and that the operator's workload is backed up. In this case, the information processing device 100 provides content C2 that notifies the user that the settlement operation will be performed again after a time ty that is far from the required time t1 (step S14b). Time ty may be a time adjusted to be at least greater than time tx. The information processing device 100 provides content C2 that notifies the user that a transaction such as payment has failed and is under review, and that the settlement operation will be performed again after time ty, for example, as shown in Figure 5B.

[0033] The information processing device 100 can effectively prevent users from losing opportunities by displaying different content depending on whether the required time t1 is exceeded or not. In content CX as shown in Figure 1, it is unclear to the user how to deal with the situation, and especially during busy periods, it can become a source of stress as users repeatedly perform the same operation in a short period of time and fail. By displaying different content, it becomes clear how long to wait before performing the payment operation again, so users can perform the payment operation according to the time indicated in the notification, thereby reducing stress.

[0034] In the above embodiment, the required time t1, time tx, and time ty may be any value and may be determined in any way. Required time t1, time tx, and time ty may be set appropriately according to, for example, the evaluation of tests or actual deliveries. For example, they may be set to the optimal value (the value with the highest evaluation, or the value that is estimated to result in the highest evaluation) according to the evaluation of tests or actual deliveries.

[0035] The following describes variation 1 of information processing. In step S13, the information processing device 100 may display different content according to the time-series changes in the time required for monitoring.

[0036] The information processing device 100 may determine the time required for monitoring at multiple recent points in time, based on the time required for the fraudulent rule that has been determined to match. Hereinafter, the information processing device 100 will determine the time required for monitoring at two points in time (or ranges): the time required for monitoring at the most recent point in time z1 (or range based on point in time z1) and the time required for monitoring at the most recent point in time z2 (or range based on point in time z2). The number of points in time (or ranges) to be considered is not limited to this example. For example, content may be displayed differently by considering the time-series changes in the time required at three points in time: the most recent point in time z1, the most recent point in time z2, and the most recent point in time z3.

[0037] The multiple points in time that are subject to this judgment are predetermined and may be set for each fraud rule. If set for each fraud rule, the point in time associated with fraud rule R1 that matches user U1's settlement transaction D1 will be applied. For example, fraud rule R1 may apply the most recent z1 and most recent z2 points in time, while fraud rule R2 may apply the most recent z3 and most recent z4 points in time.

[0038] In Variation 1, the time required for monitoring at these two points in time, and the baseline time required, are determined. Specifically, the combination of the comparison result between the time required for monitoring at the most recent z1 point in time and the baseline time required, and the comparison result between the time required for monitoring at the most recent z2 point in time and the baseline time required, is determined. Then, the content is displayed differently based on this combination.

[0039] The information processing device 100 determines whether the time required for monitoring at the most recent time z1 exceeds the time required t1 associated with the fraud rule R1 that matched user U1's settlement transaction D1, and also determines whether the time required for monitoring at the most recent time z2 exceeds the time required t1 associated with the fraud rule R1 that matched user U1's settlement transaction D1.

[0040] The information processing device 100 displays content based on whether or not the required time t1 is exceeded. Specifically, if the comparison result between the time required for monitoring at multiple points in time and a standard required time reverses at some point in time, the information processing device 100 performs content switching processing. For example, this occurs when the required time t1 is not exceeded at the most recent time z1 but is exceeded at the most recent time z2, or when the required time t1 is exceeded at the most recent time z1 but is not exceeded at the most recent time z2.

[0041] On the other hand, if the comparison between the time required for monitoring at multiple points in time and the reference time does not reverse at multiple points in time, the information processing device 100 does not perform content switching processing. In this case, the same content will be displayed. For example, this occurs when the time required at the most recent point z1 does not exceed the required time t1 and does not exceed the required time at the most recent point z2, or when the time required at the most recent point z1 exceeds the required time t1 and also exceeds the required time at the most recent point z2.

[0042] The information processing device 100 determines whether or not to perform content switching processing based on whether the comparison result of the time required for monitoring multiple points in time reverses at a certain point in time. If there are two points in time for the decision, there are four combinations of content switching processing, and two types of content can be displayed (content for busy periods and content for non-busy periods).

[0043] If the required time t1 is not exceeded at the most recent z1 and is not exceeded at the most recent z2, the information processing device 100 provides content notifying that the settlement operation will be performed again after a time tx close to the required time t1. If the required time t1 is exceeded at the most recent z1 but is not exceeded at the most recent z2, the information processing device 100 also provides content notifying that the settlement operation will be performed again after a time tx close to the required time t1. However, in the latter case, the information processing device 100 performs a content switching process. The information processing device 100 provides content C1 notifying that a transaction such as payment has failed and is under review, as shown in Figure 5A, and that the settlement operation will be performed again after a time tx.

[0044] If the required time t1 exceeds the required time t1 at the most recent time z1 and also exceeds the required time t1 at the most recent time z2, the information processing device 100 provides content notifying that the settlement operation will be performed again after a time ty away from the required time t1. Even if the required time t1 is not exceeded at the most recent time z1 but exceeds the required time t1 at the most recent time z2, the information processing device 100 also provides content notifying that the settlement operation will be performed again after a time ty away from the required time t1. However, in the latter case, the information processing device 100 performs a content switching process. For example, as shown in Figure 5B, the information processing device 100 provides content C2 notifying that a transaction such as payment has failed and is under review, and that the settlement operation will be performed again after a time ty.

[0045] This allows the information processing device 100 to automatically switch content. The information processing device 100 may also automatically switch content by linking a database that records the time required for monitoring with a flag that instructs the device to switch content when the required time t1 is exceeded. For example, the information processing device 100 may automatically switch content by assigning a flag that instructs the device to switch content to data that exceeds the required time t1.

[0046] As a further variation, the information processing device 100 may consider the time-series changes in the time required for monitoring at multiple points in time, and if it is likely to cross the requirement t1, it may switch content before crossing requirement t1. If the information processing device 100 can infer that the time required for monitoring is increasing at the most recent z1, most recent z2, and most recent z3 points in time, and that it is becoming busier, it may switch content before crossing requirement t1 to provide content C2. On the other hand, if the information processing device 100 can infer that the time required for monitoring is decreasing at the most recent z1, most recent z2, and most recent z3 points in time, and that it is returning to normal, it may switch content before crossing requirement t1 to provide content C1.

[0047] The following describes variation 2 of information processing. In step S13, the information processing device 100 may differentiate the content displayed by taking into consideration user attributes, payment store information, payment amount, etc.

[0048] The information processing device 100 uses the time required for the fraudulent rule that has been determined to match as a basis, but may change the basis for the required time based on user attributes, payment store information, payment amount, etc. The information processing device 100 may obtain or estimate user attributes, payment store information, payment amount, etc. from payment information, and change the basis for the required time based on the obtained or estimated user attributes, payment store information, payment amount, etc., to differentiate the content displayed. The information processing device 100 may change the basis for the required time and differentiate the content displayed based on the processing described above in Variation 1 of Information Processing.

[0049] The information processing device 100 may shorten the standard required time, for example, because it is assumed that impatient or urgent users cannot wait for time tx. This allows the information processing device 100 to proactively provide content C2 to impatient or urgent users. The information processing device 100 may estimate user attributes in any way, and may estimate them not only from payment information but also from purchase history, etc.

[0050] The information processing device 100 may shorten the standard processing time, for example, in the case of payment at a convenience store, since it is assumed that the user cannot wait for at least time tx. This allows the information processing device 100 to proactively provide content C2 in the case of payment at a convenience store. On the other hand, the information processing device 100 may lengthen the standard processing time, for example, in the case of payment at a restaurant, since it is assumed that the user can wait for at least time tx. This allows the information processing device 100 to proactively provide content C1 in the case of payment at a restaurant.

[0051] The information processing device 100 may shorten the standard processing time, for example, if the payment amount is small, as it is assumed that the user cannot wait for time tx. This allows the information processing device 100 to proactively provide content C2 when the payment amount is small. On the other hand, the information processing device 100 may lengthen the standard processing time, for example, if the payment amount is large, as it is assumed that the user can wait for at least time tx. This allows the information processing device 100 to proactively provide content C1 when the payment amount is large.

[0052] The information processing device 100 may change the standard time required based on predetermined weights for each of the following: user attributes, payment store information, payment amount, etc., once it has acquired or estimated such information. Furthermore, the weights for each of these may be determined on a per-user basis.

[0053] The following describes other variations of information processing. In the above embodiment, we explained as an example the case in which content C1 notifies that the settlement operation will be performed again after time tx and content C2 notifies that the settlement operation will be performed again after time ty. However, the wording of the notifications in content C1 and content C2 is not limited to this example. Instead of notifying that the settlement operation will be performed again, content that notifies that the user should wait in the current state may be displayed. For example, content C1 notifies that the user should wait in the current state for time tx because the transaction is currently under review, and content C2 notifies that the user should wait in the current state for time ty because the transaction is currently under review. In this way, content C1 and content C2 may be displayed that describe different review situations.

[0054] In the above embodiment, the time ty does not have to be a specific number of minutes; it may be a vague phrase such as "wait a while," or any other general information. Content C1, which includes a waiting time, and content C2, which does not include a waiting time, may be displayed separately.

[0055] In the above embodiment, content switching may be performed automatically by the information processing device 100 or by an operator. In the latter case, the information processing device 100 notifies the operator of a warning at a point in time when the comparison result reverses. For example, the information processing device 100 notifies the operator when the business status changes from normal to busy, or when it changes from busy to normal. When the operator makes a decision to switch content based on the warning, the switched content will be provided. For example, if the business status changes from normal to busy and the operator makes a switch based on the warning, content C2 will be provided from the time of the switch. Similarly, if the business status changes from busy to normal and the operator makes a switch based on the warning, content C1 will be provided from the time of the switch.

[0056] [4. Configuration of terminal equipment] Next, the configuration of the terminal device 10 according to the embodiment will be described using Figure 6. Figure 6 is a diagram showing an example of the configuration of the terminal device 10 according to the embodiment. As shown in Figure 6, the terminal device 10 has a communication unit 11, an input unit 12, an output unit 13, and a control unit 14.

[0057] (Communications Section 11) The communication unit 11 is implemented, for example, by a NIC (Network Interface Card). The communication unit 11 is connected to a predetermined network N by wire or wireless connection and sends and receives information to and from the information processing device 100 via the predetermined network N.

[0058] (Input section 12) The input unit 12 accepts various operations from the user. In Figure 4, for example, it accepts various operations from user U1. For example, the input unit 12 may accept various operations from the user via the display surface using a touch panel function. Alternatively, the input unit 12 may accept various operations from buttons provided on the terminal device 10, or from a keyboard or mouse connected to the terminal device 10.

[0059] (Output section 13) The output unit 13 is a display screen for a tablet terminal, for example, which is implemented using a liquid crystal display or an organic EL (Electro-Luminescence) display, and is a display device for displaying various information. For example, the output unit 13 displays information transmitted from the information processing device 100 (content corresponding to the fraud screening status: such as content C1 and content C2).

[0060] (Control Unit 14) The control unit 14 is, for example, a controller, and is implemented by a CPU (Central Processing Unit) or MPU (Micro Processing Unit) executing various programs stored in the internal memory of the terminal device 10 using RAM (Random Access Memory) as the working area. For example, these various programs include application programs installed on the terminal device 10. For example, these various programs include application programs that display information transmitted from the information processing device 100. The control unit 14 is also implemented by an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0061] As shown in Figure 6, the control unit 14 has a receiving unit 141 and a transmitting unit 142, and realizes or executes the information processing operations described below.

[0062] (Receiver 141) The receiving unit 141 receives information transmitted from, for example, the information processing device 100. For example, the receiving unit 141 receives information transmitted from the information processing device 100 for displaying content (such as content C1 or content C2) according to the status of fraud investigation.

[0063] (Transmitter 142) The transmitting unit 142 transmits, for example, the user's payment information. For example, the transmitting unit 142 transmits payment information for a product purchase when a payment operation is performed to purchase a product.

[0064] [5. Configuration of the Information Processing Device] Next, the configuration of the information processing device 100 according to the embodiment will be described with reference to Figure 7. Figure 7 is a diagram showing an example of the configuration of the information processing device 100 according to the embodiment. As shown in Figure 7, the information processing device 100 has a communication unit 110, a storage unit 120, and a control unit 130. The information processing device 100 may also have an input unit (for example, a keyboard or mouse) that receives various operations from the administrator of the information processing device 100, and a display unit (for example, a liquid crystal display) for displaying various information.

[0065] (Communications Department 110) The communication unit 110 is implemented, for example, by a NIC. The communication unit 110 is connected to the network N by wire or wireless connection and sends and receives information to and from terminal devices 10, etc., via the network N.

[0066] (Storage unit 120) The storage unit 120 is implemented by, for example, semiconductor memory elements such as RAM and flash memory, or storage devices such as hard disks and optical discs. As shown in Figure 7, the storage unit 120 has a review result storage unit 121 and an illegal rule storage unit 122.

[0067] The review result storage unit 121 stores the review result for each settlement transaction (case) in which fraud was detected. Here, Figure 8 shows an example of the review result storage unit 121 according to this embodiment. The information stored in the review result storage unit 121 is used, for example, to calculate the time required for monitoring. As shown in Figure 8, the review result storage unit 121 has items such as "settlement transaction ID", "operator ID", "judgment result", and "time required".

[0068] The "Settlement Transaction ID" indicates identification information used to identify the settlement transaction in which fraud was detected. The "Operator ID" indicates identification information used to identify the operator (person in charge) responsible for monitoring the settlement transaction in question. One or more operators are assigned to each settlement transaction in which fraud was detected. The "Judgment Result" indicates the judgment result (whether it was a malicious transaction, a simple false positive, etc.). The "Time Required" indicates the time required for monitoring. In Figure 8, the time required for monitoring settlement transaction D1 is "ta" minutes, and the time required for monitoring settlement transaction D2 is "tb" minutes.

[0069] The "Estimated Time" column stores the time from, for example, when fraud is detected and an investigation is initiated, to when the operator writes the investigation result. The estimated time may be automatically calculated when the operator logs the decision in the decision result field. For example, the estimated time may be calculated when the operator writes the investigation result in the decision result field and the input is completed. This is not the only example; the estimated time may also be calculated when the operator writes the investigation result in the decision result field and operates (clicks or taps, etc.) the investigation completion button to indicate that the investigation is complete.

[0070] The information stored in "Required Time" is aggregated and averaged, for example, in one-hour increments. This averaged information corresponds to the required time for monitoring at multiple recent points in time (such as recent z1 and recent z2) according to the above embodiment.

[0071] The fraud rule storage unit 122 stores information about fraud rules for detecting fraud. Here, Figure 9 shows an example of the fraud rule storage unit 122 according to the embodiment. The information stored in the fraud rule storage unit 122 is used, for example, to detect fraud, to identify the type of fraud, and to obtain a standard time required for each type of fraud. As shown in Figure 9, the fraud rule storage unit 122 has items such as "fraud rule ID", "matching conditions", "type of fraud", and "average review time".

[0072] The "Fraud Rule ID" indicates identification information for identifying a fraud rule. The "Match Condition" indicates the conditions for determining whether or not the relevant fraud rule is met. In the example shown in Figure 9, conceptual information such as "Match Condition #1" and "Match Condition #2" is shown as being stored in "Match Condition," but in reality, information indicating the conditions is stored. The "Type of Fraud" indicates the type of fraud. The "Average Review Time" indicates the average time required for monitoring to determine whether or not the relevant type of fraud is met. In Figure 9, the average review time associated with fraud rule R1 is "Time t1" minutes, and the average review time associated with fraud rule R2 is "Time t2" minutes.

[0073] (Control unit 130) The control unit 130 is a controller, and is implemented, for example, by a CPU or MPU executing various programs stored in the memory device inside the information processing device 100 using RAM as the working area. Alternatively, the control unit 130 can be implemented by an integrated circuit such as an ASIC or FPGA.

[0074] As shown in Figure 7, the control unit 130 includes an acquisition unit 131, a classification unit 132, a calculation unit 133, a determination unit 134, a decision unit 135, and a provision unit 136, and realizes or executes the information processing operations described below. Note that the internal configuration of the control unit 130 is not limited to the configuration shown in Figure 7, and other configurations are also acceptable as long as they perform the information processing described later.

[0075] (Acquisition part 131) The acquisition unit 131 acquires various information from the storage unit 120. The acquisition unit 131 stores the acquired information in the storage unit 120.

[0076] The acquisition unit 131 acquires various information from external information processing devices. The acquisition unit 131 also acquires various information from other information processing devices such as the terminal device 10.

[0077] The acquisition unit 131 acquires, for example, transaction information. For example, the acquisition unit 131 acquires transaction information of transactions performed by the user. For example, the acquisition unit 131 acquires settlement information of settlement transactions performed by the user. For example, the acquisition unit 131 acquires or estimates information based on the settlement information of settlement transactions performed by the user.

[0078] The acquisition unit 131 acquires, for example, transaction information of a transaction in which fraud has been detected. For example, the acquisition unit 131 acquires settlement information of a settlement transaction in which fraud has been detected. For example, the acquisition unit 131 acquires or estimates information based on the settlement information of a settlement transaction in which fraud has been detected.

[0079] The acquisition unit 131 acquires, for example, the transaction information of the user subject to review. For example, the acquisition unit 131 acquires the past transaction history of the user subject to review. For example, the acquisition unit 131 acquires the past transaction history of the user at the relevant store.

[0080] (Classification section 132) The classification unit 132, for example, classifies (identifies) the type of fraud. For example, the classification unit 132 classifies the type of fraud based on the information stored in the fraud rule storage unit 122. For example, the classification unit 132 classifies the type of fraud based on the information stored in the fraud rule storage unit 122 and the transaction information acquired by the acquisition unit 131. The classification unit 132, for example, detects fraud and classifies the type of fraud. The classification unit 132, for example, classifies the type of fraud in a transaction in which fraud has been detected. The classification unit 132, for example, classifies the type of fraud based on the determination result by the determination unit 134 described later.

[0081] The classification unit 132, for example, rejects the transaction and classifies the type of fraud if fraud is detected, and permits the transaction if no fraud is detected. The classification unit 132 rejects the transaction and classifies the type of fraud for transactions in which fraud is detected, and permits the transaction for transactions in which no fraud is detected.

[0082] (Calculation section 133) The calculation unit 133 calculates, for example, the time required for monitoring. For example, the calculation unit 133 calculates the time required for monitoring based on the information stored in the review result storage unit 121. For example, the calculation unit 133 calculates the time required for monitoring at the current time. Also, for example, the calculation unit 133 calculates the time required for monitoring at multiple recent points in time. The calculation unit 133 calculates, for example, the average time required for monitoring in a predetermined time unit by aggregating and averaging the relevant data. The calculation unit 133 calculates, for example, the time required for monitoring for each type of fraud classified by the classification unit 132. The calculation unit 133 calculates, for example, the probability that the comparison result between the time required for monitoring and the time required to match the fraud rule will reverse at some point in the future within a predetermined period, taking into account the time-series changes in the time required for monitoring at multiple points in time.

[0083] (Judgment unit 134) The determination unit 134 determines, for example, whether or not the conditions of a fraud rule are met. The determination unit 134 determines, for example, whether or not to reject a transaction that meets the conditions and to allow a transaction that does not meet the conditions. The determination unit 134 determines, for example, whether or not the conditions of one or more pre-selected fraud rules are met, individually for each condition.

[0084] The determination unit 134 determines the time required for monitoring, for example, based on the time required for matching fraudulent rules. For example, the determination unit 134 determines whether the time required for monitoring exceeds the time required for matching fraudulent rules.

[0085] The determination unit 134 determines, for example, the time required for monitoring multiple recent points in time. The determination unit 134 determines, for example, the result of comparing the time required for monitoring multiple recent points in time with the time required for matching fraud rules. The determination unit 134 determines, for example, the combination of the comparison results between the time required for monitoring multiple recent points in time and the time required for matching fraud rules.

[0086] The determination unit 134 determines, for example, whether the comparison result between the time required for monitoring at multiple recent points in time and the time required for matching fraudulent rules reverses at some point in time. Based on whether the comparison result between the time required for monitoring at multiple recent points in time and the time required for matching fraudulent rules reverses at some point in time, the determination unit 134 determines whether or not to perform content switching processing.

[0087] The determination unit 134, for example, considers the time-series changes in the time required for monitoring at multiple points in time, estimates whether or not a reversal will occur at a certain point in time to be observed, and determines whether or not to perform content switching processing.

[0088] The determination unit 134, for example, takes transaction information into consideration, modifies the time required for matching fraudulent rules, and determines the result of comparing it with the modified time required. The determination unit 134, for example, takes transaction information into consideration, modifies the time required for matching fraudulent rules, and determines whether or not to perform content switching processing based on whether or not the comparison result with the modified time required reverses at a certain point.

[0089] (Decision Section 135) The decision unit 135 determines, for example, the content to be provided to the user. For example, the decision unit 135 determines the content to be provided to the user based on the determination result by the judgment unit 134. For example, the decision unit 135 determines the content to be provided to the user based on the determination result by the judgment unit 134 of whether or not to perform content switching processing. For example, the decision unit 135 determines whether to provide content C1 or content C2.

[0090] The decision unit 135 determines the content to be provided to the user based on, for example, the comparison result between the time required for monitoring and the time required for matching fraud rules. Specifically, the decision unit 135 determines the content to be provided to the user based on the comparison result between the time required for monitoring for each type of fraud and a predetermined threshold set based on the status of the fraud type review. For example, the decision unit 135 determines the content to be provided to the user based on whether the comparison result will reverse at some point in the near future. Alternatively, for example, the decision unit 135 determines the content to be provided to the user based on the probability of a reversal at some point in the future. For example, if the probability of a reversal at some point in the future within a predetermined period is high, the decision unit 135 decides to provide the post-reversal content, and if the probability of a reversal at some point in the future within a predetermined period is low, it decides to provide the currently provided content. Alternatively, for example, the decision unit 135 determines the content to be provided to the user based on the comparison result with a predetermined threshold changed based on the transaction information acquired by the acquisition unit 131.

[0091] (Provider 136) The providing unit 136, for example, provides (transmits) the content determined by the decision unit 135 to the user. The providing unit 136, for example, provides the user with information to display the content determined by the decision unit 135. For example, the providing unit 136 provides the user with information to display the content determined by the decision unit 135 on the display screen of the user's terminal device 10.

[0092] [6. Information Processing Flow] Next, the information processing procedure by the information processing system 1 according to the embodiment will be explained using Figure 10. Figure 10 is a flowchart of the information processing procedure according to the embodiment.

[0093] As shown in Figure 10, when the information processing device 100 acquires transaction information, it determines whether or not there is fraud in the transaction based on the acquired transaction information (step S101). If the information processing device 100 determines that there is fraud (step S101; YES), it classifies the type of fraud (step S102). On the other hand, if the information processing device 100 determines that there is no fraud (step S101; NO), it permits the transaction (step S103) and terminates the information processing.

[0094] The information processing device 100 determines the time required for monitoring based on the status of the review of the classified type of fraud (step S104). Specifically, the information processing device 100 determines whether the time required for monitoring exceeds a predetermined threshold set based on the review status of the classified type of fraud. If the information processing device 100 determines that the time required for monitoring exceeds the predetermined threshold (step S104; YES), it decides to provide the second content (corresponding to content C2) (step S105). On the other hand, if the information processing device 100 determines that the time required for monitoring does not exceed the predetermined threshold (step S104; NO), it decides to provide the first content (corresponding to content C1) (step S106). Then, the information processing device 100 provides the content it decided to provide (step S107) and terminates the information processing.

[0095] [7. Effects] As described above, the information processing device 100 according to this embodiment includes a classification unit 132 and a determination unit 135. The classification unit 132 classifies the type of fraud in the transactions in which fraud has been detected. The determination unit 135 determines the content to be provided to the user under review based on the review status of the type of fraud classified by the classification unit 132.

[0096] As a result, the information processing device 100 according to the embodiment can appropriately determine, for example, how the user should respond and how long they should wait when fraud is detected, thereby reducing user stress. Therefore, the information processing device 100 according to the embodiment can reduce opportunity losses in predetermined transaction means for conducting monetary transactions.

[0097] Furthermore, the classification unit 132 rejects transactions in which fraud is detected, classifies the type of fraud in the transaction, and permits transactions in which no fraud is detected.

[0098] As a result, the information processing device 100 according to this embodiment can appropriately sort transactions to determine whether or not they should be subject to review, for example, by rejecting transactions in which fraud has been detected and making them subject to review, and permitting transactions in which no fraud has been detected.

[0099] Furthermore, the determination unit 135 determines the content based on the comparison result between the time required for monitoring the type of fraud and a predetermined threshold set based on the status of the fraud type review.

[0100] As a result, the information processing device 100 according to the embodiment can, for example, display different content depending on the review status and notify the user of appropriate information, thereby reducing user stress.

[0101] Furthermore, the determination unit 135 determines the content based on whether the comparison result between the required time and a predetermined threshold reverses at some point in a series of recent time points.

[0102] As a result, the information processing device 100 according to the embodiment can switch content according to the time-series changes in the review status, for example, thus enabling more efficient content distribution.

[0103] Furthermore, the determination unit 135 determines the content based on the probability that the comparison result between the required time and a predetermined threshold will reverse at some point in the future.

[0104] As a result, the information processing device 100 according to the embodiment can, for example, predict future review statuses in accordance with time-series changes in review status, thereby enabling more efficient distribution of content.

[0105] Furthermore, the determination unit 135 determines the content based on a predetermined threshold that has been modified based on the transaction information of the transaction.

[0106] As a result, the information processing device 100 according to the embodiment can effectively prevent users from losing opportunities by, for example, displaying different content based on various information such as user attributes.

[0107] [8. Hardware Configuration] Furthermore, the information processing device 100 according to the above embodiment can be realized by a computer 1000 having the configuration shown in Figure 11. Figure 11 is a hardware configuration diagram showing an example of a computer that realizes the functions of the information processing device 100. The computer 1000 has a CPU 1100, RAM 1200, ROM 1300, HDD 1400, communication interface (I / F) 1500, input / output interface (I / F) 1600, and media interface (I / F) 1700.

[0108] The CPU 1100 operates based on programs stored in the ROM 1300 or HDD 1400, and controls various parts. The ROM 1300 stores boot programs executed by the CPU 1100 when the computer 1000 starts up, as well as programs that depend on the computer 1000's hardware.

[0109] The HDD1400 stores programs executed by the CPU1100, as well as data used by such programs. The communication interface1500 acquires data from other devices via a predetermined communication network and sends it to the CPU1100, and transmits data generated by the CPU1100 to other devices via the predetermined communication network.

[0110] The CPU 1100 controls output devices such as displays and printers, and input devices such as keyboards and mice, via the input / output interface 1600. The CPU 1100 acquires data from input devices via the input / output interface 1600. The CPU 1100 also outputs the generated data to output devices via the input / output interface 1600.

[0111] The media interface 1700 reads a program or data stored in the recording medium 1800 and provides it to the CPU 1100 via the RAM 1200. The CPU 1100 loads the program from the recording medium 1800 onto the RAM 1200 via the media interface 1700 and executes the loaded program. The recording medium 1800 can be, for example, an optical recording medium such as a DVD (Digital Versatile Disc) or PD (Phase Change Rewritable Disk), a magneto-optical recording medium such as an MO (Magneto-Optical disk), tape media, magnetic recording medium, or semiconductor memory.

[0112] For example, when the computer 1000 functions as an information processing device 100 according to the embodiment, the CPU 1100 of the computer 1000 realizes the functions of the control unit 130 by executing a program loaded on the RAM 1200. The CPU 1100 of the computer 1000 reads and executes these programs from the recording medium 1800, but as another example, these programs may be obtained from other devices via a predetermined communication network.

[0113] [9. Other] Furthermore, among the processes described in the above embodiments, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically by known methods. In addition, the processing procedures, specific names, and information including various data and parameters shown in the above document and drawings can be arbitrarily changed unless otherwise specified. For example, the various information shown in each figure is not limited to the information shown.

[0114] Furthermore, the components of each illustrated device are functionally conceptual and do not necessarily need to be physically configured as shown. In other words, the specific forms of distribution and integration of each device are not limited to those shown, and all or part of them can be functionally or physically distributed and integrated in any unit according to various loads and usage conditions.

[0115] Furthermore, the embodiments described above can be combined as appropriate, as long as the processing content is not contradictory.

[0116] Although some embodiments of the present invention have been described in detail above with reference to the drawings, these are illustrative examples, and the present invention can be implemented in various other forms with modifications and improvements based on the knowledge of those skilled in the art, starting with the embodiments described in the disclosure section of the invention.

[0117] Furthermore, the terms "section, module, unit" mentioned above can be replaced with "means" or "circuit," etc. For example, the acquisition unit can be replaced with acquisition means or acquisition circuit. [Explanation of symbols]

[0118] 1. Information Processing System 10 Terminal devices 11 Communications Department 12 Input section 13 Output section 14 Control Unit 100 Information Processing Devices 110 Communications Department 120 Storage section 121 Review Result Storage Unit 122 Unfair Rules Storage Unit 130 Control Unit 131 Acquisition Department 132 Classification Department 133 Calculation Section 134 Judgment section 135 Decision Section 136 Provision Department 141 Receiving Unit 142 Transmitter N Network

Claims

1. A classification unit that categorizes the type of fraud in transactions where fraud has been detected, Based on the review status of the types of fraud classified by the classification unit, a decision unit determines the content to be provided to the user under review. An information processing device characterized by having the following features.

2. The aforementioned classification unit is Transactions in which fraud is detected will be rejected and the type of fraud will be classified, while transactions in which no fraud is detected will be permitted. The information processing apparatus according to feature 1.

3. The aforementioned determination unit, The content is determined based on the comparison between the time required to monitor the type of fraud and a predetermined threshold set based on the status of the review of the type of fraud. The information processing apparatus according to feature 1.

4. The aforementioned determination unit, The content is determined based on whether the comparison result between the required time and the predetermined threshold reverses at some point in the recent sequence of multiple points in time. The information processing apparatus according to claim 3.

5. The aforementioned determination unit, The content is determined based on the probability that the comparison result between the required time and the predetermined threshold will reverse at some point in the future. The information processing apparatus according to claim 3.

6. The aforementioned determination unit, Based on the predetermined threshold which has been modified based on the transaction information of the transaction, the content is determined. The information processing apparatus according to claim 3.

7. A method of information processing performed by a computer, A classification process to categorize the types of fraud in transactions where fraud has been detected, Based on the status of the review of the types of fraud classified by the classification step, a decision step is made to determine the content to be provided to the user under review. An information processing method characterized by including

8. A classification procedure for categorizing the types of fraud in transactions where fraud has been detected, Based on the review status of the types of fraud classified by the above classification procedure, a decision procedure is made to determine the content to be provided to the users under review, An information processing program characterized by causing a computer to execute it.

Images