Fraud detection systems and programs

Abstract

To determine fraud based on appropriate criteria tailored to each customer. [Solution] The fraud detection system of this embodiment comprises an image acquisition means, a fraudulent behavior determination means, a threshold changing means, and a notification means. The image acquisition means acquires image data of a customer captured by a sensing device while the customer is performing product registration or accounting processing at a POS terminal. The fraudulent behavior determination means determines that a customer has committed fraudulent activity if the customer's actions captured in the image data acquired by the image acquisition means exceed a threshold for determining fraudulent activity. The threshold changing means changes the determination threshold from its initial value while the product registration or accounting processing is being performed. The notification means notifies the customer when the fraudulent behavior determination means determines that a customer has committed fraudulent activity.

Description

Technical Field

[0001] Embodiments of the present invention relate to a fraud detection system and a program.

Background Art

[0002] In recent years, the popularity of self-checkout, in which customers who purchase products at stores perform all procedures from product registration to settlement themselves, has been increasing. While the introduction of self-checkout is expected to improve labor shortages and reduce labor costs, there is a risk of non-payment due to customers accidentally or deliberately not registering products and fraud such as customers leaving the store before settlement.

[0003] Generally, in stores that introduce self-checkout, clerks called attendants are arranged to support customers using self-checkout. However, since one attendant is responsible for multiple self-checkout counters, it is not realistic for the clerk to constantly monitor the movements of customers. In addition, if a clerk directly checks a customer for fraud, there is also a risk that the customer will feel uncomfortable and file a complaint. For this reason, there is a technology that captures the actions of customers with a camera and detects fraud using image recognition technology. In such fraud detection using image recognition technology, a threshold value serving as a determination criterion is set, and fraud may be determined when the threshold value is exceeded.

[0004] However, in the determination of fraud using a uniform threshold value for all customers, even if a customer behaves differently from other customers during the operation of self-checkout, it may not be possible to determine fraud based on appropriate criteria according to the behavior of the customer.

Summary of the Invention

Problems to be Solved by the Invention

[0005] The problem to be solved by the present invention is to provide a fraud detection system and a program capable of determining fraud based on appropriate criteria according to customers.

Means for Solving the Problems

[0006] The fraud detection system of this embodiment comprises an image acquisition means, a fraudulent behavior determination means, a threshold change means, and a notification means. The image acquisition means acquires image data of a customer captured by a sensing device while the customer is performing product registration or accounting processing at a POS terminal. The fraudulent behavior determination means determines that a customer has committed fraudulent activity if the customer's actions captured in the image data acquired by the image acquisition means exceed a threshold for determining fraudulent activity. The threshold change means changes the determination threshold from its initial value while the product registration or accounting processing is being performed. The notification means notifies the customer when the fraudulent behavior determination means determines that a customer has committed fraudulent activity. [Brief explanation of the drawing]

[0007] [Figure 1] Figure 1 shows an example of the configuration of a fraud detection system according to an embodiment. [Figure 2] Figure 2 shows an example of the hardware configuration of a POS terminal according to the present invention. [Figure 3] Figure 3 shows an example of the functional configuration of a POS terminal according to the embodiment. [Figure 4] Figure 4 shows an example of the functional configuration of an edge device according to the embodiment. [Figure 5] Figure 5 shows an example of display data according to the embodiment. [Figure 6] Figure 6 is a flowchart showing an example of the fraud detection process according to the present invention. [Modes for carrying out the invention]

[0008] The embodiments will be described in detail below with reference to the drawings. However, the invention is not limited to the embodiments described below.

[0009] Figure 1 shows an example of the configuration of the fraud detection system S according to this embodiment. The fraud detection system S is installed in stores such as supermarkets, drugstores, and convenience stores.

[0010] As shown in Figure 1, for example, the fraud detection system S includes a POS (Point of Sales) terminal 1, a camera 2, an edge device 3, and an attendant PC (Personal Computer) 4. The POS terminal 1, edge device 3, and attendant PC 4 are connected to each other via the in-store network N, for example, through network equipment such as a LAN (Local Area Network) hub 51 and a router 52. In Figure 1, the fraud detection system S includes one POS terminal 1, but the fraud detection system S may be configured to include multiple POS terminals 1. Although not shown in Figure 1, a store server and the like may also be connected to the in-store network N.

[0011] POS terminal 1 is a self-checkout system in which customers perform product registration and payment processing operations.

[0012] Camera 2 is, for example, a USB (Universal Serial Bus) camera installed around or on the POS terminal 1 itself. Camera 2 is connected to the edge device 3 for communication. Camera 2 transmits image data of the customer operating the POS terminal 1 to the edge device 3. The image data may be video data or multiple still images taken in chronological order. Camera 2 is an example of a sensing device in this embodiment.

[0013] For example, a dedicated camera 2 may be provided for each POS terminal 1. Alternatively, one camera 2 may be capable of simultaneously capturing customers from multiple POS terminals 1. Furthermore, camera 2 may also be used in conjunction with security cameras installed on the ceiling or elsewhere in the store.

[0014] Edge device 3 detects fraudulent activity by customers operating POS terminal 1 by performing image recognition on image data acquired from camera 2. Edge device 3 is an edge computer equipped with, for example, a processor such as a CPU (Central Processing Unit) or GPU (Graphics Processing Unit), memory, and an AI (Artificial Intelligence) accelerator. Edge device 3 is an example of an information terminal in this embodiment.

[0015] For example, edge device 3 recognizes the processing status of POS terminal 1 by acquiring POS events from POS terminal 1 via the in-store network N. POS events are information indicating the start or end of various processes performed on POS terminal 1. For example, there are POS events for the start of product registration, the end of product registration, the start of accounting, and the end of accounting.

[0016] Edge device 3 performs fraud detection processing when POS terminal 1 is performing product registration processing or accounting processing. The fraud detection processing performed by edge device 3 determines that a customer has engaged in fraudulent activity if the customer's actions captured in the image data acquired from camera 2 exceed a threshold for determining fraudulent activity. When edge device 3 determines that "a customer has engaged in fraudulent activity," this is also referred to as "detecting fraud."

[0017] The threshold used for fraud detection in edge device 3 is an example of a judgment threshold in this embodiment. The threshold used for fraud detection in edge device 3 can be changed by an instruction to change the threshold from attendant PC 4. More specifically, the threshold used for fraud detection in edge device 3 is normally set to a predetermined initial value, and can be changed to a value smaller than the initial value when an instruction to change the threshold is received from attendant PC 4. The smaller the threshold, the easier it is for edge device 3 to determine that the customer's behavior is "fraudulent." Conversely, the larger the threshold, the more difficult it is for edge device 3 to determine that the customer's behavior is "fraudulent." In other words, the smaller the threshold, the higher the level of vigilance against fraud.

[0018] Furthermore, the thresholds used for fraud detection on edge device 3 consist of at least two types: an "initial value" and a "value smaller than the initial value (higher alert level)." The "value smaller than the initial value (higher alert level)" may be set in stages.

[0019] Attendant PC4 is a management information terminal used by store employees (hereinafter, users of Attendant PC4 are referred to as "store employees") to manage POS terminal 1. If the fraud detection system S includes multiple POS terminals 1, Attendant PC4 manages all of these POS terminals 1 collectively. Furthermore, multiple Attendant PC4s with the same functionality may be included in the fraud detection system S.

[0020] Attendant PC4 is configured as a standard PC equipped with a CPU or other processor, memory, a display, and input devices. Input devices may include, for example, a keyboard, mouse, or touch panel. Alternatively, a tablet or similar device may be used as a management information terminal instead of Attendant PC4.

[0021] When a store employee or the like observes a customer operating the POS terminal 1 and anticipates a high likelihood of fraud based on the customer's behavior, they operate the attendant PC 4 to change the threshold value used for fraud detection in the edge device 3. After the change of the threshold value, the edge device 3 determines fraud using the changed threshold value. In other words, during the execution of product registration processing or accounting processing by the customer on the POS terminal 1, the store employee or the like can change the criteria for fraud detection in real time by operating the attendant PC 4.

[0022] In addition, the attendant PC 4 causes, for example, display data in which the POS terminal 1 and the setting state of the threshold value used for fraud detection of the POS terminal 1 are associated to be displayed on a display unit such as a display. Thereby, store employees or the like can easily grasp the setting state of the threshold value of the POS terminal 1 using the attendant PC 4. Details of the display data will be described later.

[0023] Also, the screen showing the setting state of the threshold value of each POS terminal 1 on which the display data is displayed may also serve as an operation screen for changing the threshold value. In this case, the user may select the POS terminal 1 that is the target for changing the threshold value on the screen showing the setting state of the threshold value of each POS terminal 1 and perform an operation to change the threshold value of the POS terminal 1.

[0024] Note that, as described above, among the threshold values used for fraud detection in the edge device 3, "values smaller than the initial value (higher alert level)" may be set in multiple steps. Therefore, store employees or the like may determine the magnitude of the threshold value according to the likelihood of fraud anticipated from the customer's behavior.

[0025] Here, the configuration of the POS terminal 1 in this embodiment will be described in connection with the connection. FIG. 2 is a diagram showing an example of the hardware configuration of the POS terminal 1 according to this embodiment.

[0026] As shown in Figure 2, the POS terminal 1 includes a CPU 101, ROM (Read Only Memory) 102, RAM (Random Access Memory) 103, storage unit 104, device interface 105, communication unit 106, deposit / withdrawal unit 107, scanner 108, card reader 109, printing unit 110, display unit 111, and operation unit 112, etc.

[0027] The CPU 101 is an example of a processor and comprehensively controls each part of the POS terminal 1. The CPU 101 is connected to each of the hardware components shown in Figure 2 via a bus or the like. The ROM 102 stores various programs. The RAM 103 is a workspace for displaying programs and various data. Here, the CPU 101, ROM 102, and RAM 103 constitute the control unit 100, which is an example of a computer.

[0028] The memory unit 104 has a storage medium such as an HDD (Hard Disk Drive) or flash memory, and retains its contents even when the power is cut off. The memory unit 104 stores various programs that the CPU 101 can execute, various setting information, and so on.

[0029] The storage unit 104 also stores the product master and the product registration file. The product master is a master file that stores product information such as the product name and price of the products to be sold. The product registration file is a file that stores registered product information (product name, price, etc.) associated with a transaction code that identifies a single transaction. The product master is referenced by the program during the product registration process. The product registration file is generated by the product registration process.

[0030] Device I / F105 is connected to a device connected to POS terminal 1 via wired or wireless communication. For example, device I / F105 may be connected to an electronic money reader / writer that performs electronic money payment processing for customers. The electronic money reader / writer may be included in the configuration of POS terminal 1.

[0031] The communication unit 106 is a communication interface that can connect to a network such as the in-store network N. The communication unit 106 may be connected via a wired or wireless connection. The communication unit 106 communicates with external devices such as the store server, attendant PC 4, and an electronic payment server that provides electronic payment services, for example, via the network.

[0032] The deposit and withdrawal unit 107, under the control of the control unit 100, deposits money received from customers and withdraws change to be paid to customers.

[0033] Scanner 108 is an imaging device such as a CCD (Charge Coupled Device) camera. Scanner 108 acquires an image of a product by photographing (scanning) the product. For example, Scanner 108 photographs the product through a reading window provided in the housing of POS terminal 1 and reads code symbols such as barcodes and two-dimensional codes attached to the product. Scanner 108 may also capture an image for image recognition of the product. Scanner 108 is also called a reading device. Note that in addition to, or instead of, Scanner 108, POS terminal 1 may be equipped with a handheld scanner or the like as a reading device capable of reading code symbols attached to products.

[0034] Furthermore, the scanner 108 may also read a two-dimensional code displayed on the customer's smartphone screen or the like for payment using a two-dimensional code such as a QR code (registered trademark).

[0035] The card reader 109 is a reading device that reads information held on a card-type medium. The card reader 109 reads information from a card medium inserted into a card slot provided in the housing of the POS terminal 1. The card reader 109 may also support touch reading. In this case, the card reader 109 reads information from the card medium that it comes into contact with.

[0036] The printing unit 110 is, for example, a printing device such as a thermal printer. The printing unit 110 prints a receipt for the products purchased by the customer and outputs (issues) the printed receipt from the receipt issuing slot provided in the housing of the POS terminal 1.

[0037] The display unit 111 is composed of a display device such as an LCD (Liquid Crystal Display), and under the control of the control unit 100, it displays various information and images.

[0038] The operation unit 112 accepts various operations from the customer. The operation unit 112 is, for example, a touch panel superimposed on the display unit 111. The operation unit 112 outputs information to the control unit 100 based on the position touched by the customer on the operation unit 112. The operation unit 112 may also be a keyboard or physical buttons.

[0039] Note that the POS terminal 1 does not necessarily have to have all of the configurations shown in Figure 2; for example, some of the configurations shown in Figure 2 may be functions of an external device connected to the POS terminal 1. In addition, the POS terminal 1 may further include a speaker capable of outputting sound, an LED (Light Emitting Diode) lamp installed on the outside of the main body of the POS terminal 1, etc.

[0040] Next, with reference to Figure 3, the functional configuration of POS terminal 1 will be explained.

[0041] Figure 3 shows an example of the functional configuration of the POS terminal 1 according to this embodiment. As shown in Figure 3, the POS terminal 1 is functionally configured to include a product registration unit 201, an acquisition unit 202, a display control unit 203, a transmission unit 204, a reception unit 205, and an accounting processing unit 206.

[0042] The product registration unit 201 registers the products that the customer intends to purchase. More specifically, the product registration unit 201 identifies the product code by recognizing and decoding the symbol information of the code symbol attached to the product from the image of the product acquired from the scanner 108. Alternatively, the product registration unit 201 may identify the product code by image recognition of the product itself. Furthermore, the product registration unit 201 may identify the product code entered via the operation unit 112. The product registration unit 201 searches the product master using the identified product code and obtains the product information corresponding to that product code from the product master. Based on the product code and product information, the product registration unit 201 registers the product information of the products that the customer intends to purchase in the product registration file.

[0043] The acquisition unit 202 acquires a fraud notification from the edge device 3 indicating that fraudulent activity by the customer has been detected.

[0044] The display control unit 203 controls the display unit 111 to display various screens. For example, the display control unit 203 displays the product registration screen that the customer operates when registering products, and the accounting screen that the customer operates when checking out, on the display unit 111.

[0045] Furthermore, if the acquisition unit 202 acquires a fraud notification from the edge device 3, the display control unit 203 will display a warning or alert message to the customer on the display unit 111.

[0046] The transmission unit 204 transmits POS events to the edge device 3 according to the phase of various processes performed on the POS terminal 1.

[0047] The reception unit 205 receives operations performed by the customer via the operation unit 112. For example, the reception unit 205 receives operations such as the customer's operation to start product registration processing, the operation to start accounting processing, and the operation to select a payment method in accounting processing.

[0048] The accounting processing unit 206 performs accounting processing for the price of registered goods. For example, the accounting processing unit 206 accepts the customer's payment according to the payment method selected by the customer on the accounting screen.

[0049] Next, the functional configuration of the edge device 3 will be described with reference to Figure 4. Figure 4 is a diagram showing an example of the functional configuration of the edge device 3 according to this embodiment. As shown in Figure 4, the edge device 3 includes an acquisition unit 301, a determination unit 302, a threshold modification unit 303, a generation unit 304, and a transmission unit 305.

[0050] The acquisition unit 301 acquires image data of the customer captured by the camera 2 while the customer is performing product registration or accounting processing at the POS terminal 1. The acquisition unit 301 is an example of an image acquisition means in this embodiment.

[0051] Furthermore, the acquisition unit 301 acquires POS events transmitted from the POS terminal 1. Also, the acquisition unit 301 acquires instructions for changing thresholds transmitted from the attendant PC 4.

[0052] The determination unit 302 determines that a customer has engaged in fraudulent activity if a specific action of the customer captured in the image data acquired by the acquisition unit 301 exceeds a threshold. The determination unit 302 is an example of a fraudulent activity determination means in this embodiment.

[0053] For example, the determination unit 302 detects the customer's hands and objects (products, etc.) held in the customer's hands from the image data. By tracking the movement of the detected hands and objects, the determination unit 302 detects when the customer removes products from the shopping basket and places them in a shopping bag or reusable bag. The determination unit 302 also recognizes specific customer actions from the image data through image processing. Specific customer actions are actions that may be fraudulent. Examples of potentially fraudulent actions include placing items in a shopping bag or reusable bag without scanning them with the scanner 108, not scanning some items with the scanner 108 when purchasing multiple identical items, the customer moving away from the POS terminal 1 for a specified distance and time before the payment is completed during the checkout process, and transferring discount stickers attached to products to other products. Alternatively, actions such as the customer's hands moving back and forth between the shopping basket and the customer's bag may also be recognized as specific actions.

[0054] The determination unit 302 adds a value (score) indicating the degree of likelihood of fraud each time it recognizes a specific customer action from the image data. The determination unit 302 determines that a customer has engaged in fraudulent activity if the sum of the values ​​indicating the degree of likelihood of fraud in a single transaction exceeds a threshold.

[0055] The value indicating the degree of likelihood of fraud may differ for each specific recognized action. For example, the action of a customer's hand moving back and forth between a shopping basket and their handbag is not necessarily immediately fraudulent, so the value indicating the degree of likelihood of fraud added by this action may be small, and this action alone may not exceed the initial threshold. Even if an action has a small value indicating the degree of likelihood of fraud, if it is repeated multiple times and the total exceeds the threshold, it will be judged as fraudulent.

[0056] Furthermore, if a customer moves away from POS terminal 1 for a specified distance and time before the settlement of payment in the accounting process is completed, this action is highly likely to be fraudulent and result in non-payment. In cases of such highly fraudulent actions, even a single action may be considered to exceed the initial threshold value.

[0057] Furthermore, even if a specific action cannot be clearly recognized from the image data, if the determination unit 302 recognizes that the customer may be performing a specific action, it may add a value indicating the degree of possibility of fraud according to the likelihood that the recognized action is a specific action. Note that the method for recognizing a specific customer action from image data through image processing and the method for determining a value indicating the degree of possibility of fraud are not limited to the examples described above, and publicly known methods can be used. For example, the determination unit 302 may use a publicly known machine learning trained model to recognize a specific customer action and output a value indicating the degree of possibility of fraud.

[0058] Furthermore, the determination unit 302 performs fraud detection in response to POS events transmitted from the POS terminal 1. For example, the determination unit 302 starts fraud detection when the acquisition unit 301 acquires a POS event from the POS terminal 1 indicating the start of the product registration process, and stops fraud detection when it acquires a POS event from the POS terminal 1 indicating the end of the accounting process. Since the product registration process and accounting process for a single transaction are executed consecutively in the POS terminal 1, even if the acquisition unit 301 acquires a POS event indicating the end of the product registration process and a POS event indicating the start of the accounting process, the determination unit 302 continues the fraud detection process.

[0059] The threshold change unit 303 changes the threshold used for fraud detection from its initial value while the POS terminal 1 is performing product registration or accounting processing. More specifically, the threshold change unit 303 changes the threshold used for fraud detection of a specified POS terminal 1 based on an operation by a user to change the threshold by specifying the POS terminal 1 while the POS terminal 1 is performing product registration or accounting processing. In this case, the user is a store employee operating the attendant PC 4. When the acquisition unit 301 acquires an instruction to change the threshold transmitted from the attendant PC 4, the threshold change unit 303 changes the threshold based on that instruction. If the fraud detection system S includes multiple POS terminals 1, the threshold applied to each POS terminal 1 can be set individually. For this reason, the memory or other storage unit of the edge device 3 stores each POS terminal 1 in association with the threshold currently applied to each POS terminal 1.

[0060] The threshold change unit 303 resets the threshold used for fraud detection to its initial value for each accounting transaction. Each accounting transaction includes one product registration and accounting process performed by a customer. In other words, a change in the threshold used for fraud detection applied to one customer will not be applied to other customers who subsequently perform product registration and accounting processes at the POS terminal 1.

[0061] The generation unit 304 generates display data that associates the POS terminal 1 with a threshold used for detecting fraudulent activity at the POS terminal 1. The generation unit 304 is an example of a generation means in this embodiment.

[0062] Figure 5 shows an example of display data according to this embodiment. For illustrative purposes, Figure 5 illustrates the state in which the display data is shown on the display 41 of the attendant PC 4. In the example shown in Figure 5, the fraud detection system S includes six POS terminals 1. The arrangement of the six POS terminals 1 (POS1 to POS6) shown in Figure 5 represents the arrangement of the six POS terminals 1 in an actual store.

[0063] Furthermore, in the example shown in Figure 5, there are three types of thresholds used for fraud detection: an initial value, a first threshold smaller than the initial value, and a second threshold smaller than the first threshold. If we consider the fraud detection alert level of POS terminal 1 with the initial value set as the standard, then POS terminal 1 with the first threshold set will have a "low" level of enhanced fraud detection alertness, and POS terminal 1 with the second threshold set will have a "high" level of enhanced fraud detection alertness.

[0064] The display data visually distinguishes the threshold settings (in other words, the degree of fraud detection alertness) of each POS terminal 1 installed in the store. In the example shown in Figure 5, the display data shows the six POS terminals 1 in different colors according to the threshold settings of each POS terminal 1. In the example shown in Figure 5, the thresholds of POS2-POS5 are at their initial values. The threshold of POS6 is the first threshold. The threshold of POS1 is the second threshold.

[0065] Note that in Figure 5, the legend showing the threshold setting status of each POS terminal 1 is not included in the display data, but the legend may also be included in the display data. If the legend is included in the display data, the legend will also be displayed on the attendant PC 4's display 41. Furthermore, as described above, a store employee or other user of the attendant PC 4 may select the POS terminal 1 whose threshold is to be changed on the screen showing the threshold setting status of each POS terminal 1 displayed on the display 41, and then change the threshold of that POS terminal 1. In the example shown in Figure 5, POS 6 is selected by the user.

[0066] Note that the structure of the display data is not limited to the example shown in Figure 5. For example, the display data may be a list that associates each POS terminal 1 with the threshold setting status of each POS terminal 1.

[0067] Returning to Figure 4, the transmission unit 305 notifies the POS terminal 1 that fraud has been detected when the determination unit 302 determines that the customer's actions are fraudulent. Notifying the POS terminal 1 of fraud is one example of notification. The transmission unit 305 is an example of notification means in this embodiment.

[0068] Furthermore, the transmission unit 305 transmits the display data generated by the generation unit 304 to the attendant PC 4.

[0069] The programs executed by the POS terminal 1, edge device 3, and attendant PC 4 of this embodiment (hereinafter, when referring to the POS terminal 1, edge device 3, and attendant PC 4 collectively, they are referred to as "each device") may be provided as installable or executable files recorded on computer-readable recording media such as flash memory, CD-ROM, flexible disk (FD), CD-R, or DVD (Digital Versatile Disk). Alternatively, the programs executed by each device of this embodiment may be stored on a computer connected to a network such as the Internet and provided by downloading them via the network. Furthermore, the programs executed by each device of this embodiment may be provided or distributed via a network such as the Internet.

[0070] Furthermore, the program to be executed by each device of this embodiment may be pre-installed and provided in the memory of each device (for example, ROM102, etc.).

[0071] Each device in this embodiment has a modular configuration that includes the functions described above. The processor (CPU101, GPU, etc.) of each device reads a program from the storage medium and loads the functions of each device into the main memory of that device. As a result, the functions of each device described above are generated in the main memory. Note that the hardware and software configurations of each device are not limited to the examples described above.

[0072] Next, we will describe the flow of the fraud detection process performed on the edge device 3 of this embodiment, which is configured as described above.

[0073] Figure 6 is a flowchart showing an example of the fraud detection process flow according to this embodiment. The process shown in Figure 6 starts, for example, when the acquisition unit 301 of the edge device 3 acquires a POS event from the POS terminal 1 indicating the start of the product registration process. Furthermore, if multiple POS terminals 1 are installed in the store, the process shown in Figure 6 is executed individually for each POS terminal 1. In other words, the edge device 3 can execute fraud detection processes for multiple POS terminals 1 in parallel.

[0074] First, the threshold change unit 303 executes a threshold initialization process (S1) to set the threshold used for fraud detection to its initial value. Through this threshold initialization process, even if the threshold was changed in the fraud detection process for the previous transaction, the fraud detection process executed this time can start with the threshold at its initial value.

[0075] Then, the threshold change unit 303 executes a threshold change confirmation process to check whether it has received an instruction to change the threshold from the attendant PC 4 (S2). In this case, the generation unit 304 generates display data that associates the POS terminal 1 with the changed state of the threshold used for fraud detection at the POS terminal 1. The transmission unit 305 transmits the generated display data to the attendant PC 4.

[0076] Furthermore, if the acquisition unit 301 has received an instruction to change the threshold from the attendant PC 4 (S3 "Yes"), the threshold change unit 303 executes a threshold change process to change the threshold based on the acquired instruction (S4). In this case, the generation unit 304 also changes the display data based on the changed threshold. The transmission unit 305 transmits the changed display data to the attendant PC 4.

[0077] Then, the acquisition unit 301 executes an image acquisition process to acquire image data of the customer taken from the camera 2 (S5). Although not shown in Figure 6, the image acquisition process may continue to run until the end of the accounting process.

[0078] Then, the determination unit 302 performs fraud detection processing based on the image data acquired by the acquisition unit 301 (S6). For example, the determination unit 302 recognizes the customer and the customer's actions from the image data through image processing, and adds a value indicating the degree of possibility of fraud each time a specific action of the customer is recognized. The determination unit 302 compares the sum of the values ​​indicating the degree of possibility of fraud in a single transaction with the currently set threshold.

[0079] The determination unit 302 determines that a customer has engaged in fraudulent activity if the sum of values ​​indicating the degree of possibility of fraud in a single transaction exceeds the currently set threshold. If the determination unit 302 detects fraud (S7 "Yes"), the transmission unit 305 executes a fraud notification process to notify the POS terminal 1 that fraud has been detected (S8).

[0080] Upon receiving a notification of fraud, the POS terminal 1 displays, for example, a cautionary or warning message to the customer on the display unit 111. The notification method may vary depending on the type of fraud detected. For example, the fraud notification transmitted from the edge device 3 to the POS terminal 1 may include information indicating the type of specific customer behavior recognized by the determination unit 302 of the edge device 3. For example, if the specific customer behavior recognized by the determination unit 302 includes placing items in a shopping bag or reusable bag without scanning them with the scanner 108, the control unit 100 of the POS terminal 1 may display a cautionary message to the customer on the display unit 111, such as "Are there any items that haven't been scanned?". Furthermore, if the specific customer behavior recognized by the determination unit 302 includes the customer moving away from the POS terminal 1 for a specified distance and time before the completion of payment in the accounting process, the control unit 100 of the POS terminal 1 may provide notification by outputting a warning sound from the speaker or by flashing an LED lamp installed on the outside of the POS terminal 1.

[0081] Then, if the acquisition unit 301 has not received a POS event from the POS terminal 1 indicating the end of the accounting process (S9 "No"), the determination unit 302 of the edge device 3 returns to the process of S2. Processes S2 to S9 are repeatedly executed until a POS event indicating the end of the accounting process is received. Note that since the fraud detection process continues as long as a transaction is ongoing, even if the acquisition unit 301 receives POS events indicating the end of the product registration process and the start of the accounting process while the fraud detection process is in progress, the fraud detection process does not terminate.

[0082] Furthermore, if the sum of the values ​​indicating the degree of possibility of fraud in a single transaction does not exceed the currently set threshold, the determination unit 302 does not detect fraud (S7 "No"). In this case, the fraud notification process is not executed, and the process proceeds to S9.

[0083] Then, the determination unit 302 terminates the processing of this flowchart when the acquisition unit 301 acquires a POS event from the POS terminal 1 indicating the completion of the accounting process (S9 "Yes"). Note that in Figure 6, the threshold initialization process was executed at the beginning of the fraud detection process, but the threshold change unit 303 may also execute the threshold initialization process at the end of the fraud detection process.

[0084] As described above, the fraud detection system S of this embodiment acquires image data of a customer from camera 2 while the customer is performing product registration or accounting processing at POS terminal 1, and determines that the customer has committed fraudulent activity if the customer's actions captured in the image data exceed a threshold used for fraud detection. Furthermore, the fraud detection system S of this embodiment allows the threshold used for fraud detection to be changed from its initial value while the product registration or accounting processing is in progress. Therefore, according to the fraud detection system S of this embodiment, fraud can be determined using appropriate criteria tailored to each customer, rather than using a uniform threshold to determine fraud for all customers.

[0085] Furthermore, the fraud detection system S of this embodiment changes the threshold used for fraud detection based on a change operation performed by the user to specify the POS terminal 1 and change the threshold while the customer is performing product registration or accounting processing. Therefore, according to the fraud detection system S of this embodiment, for example, if a store employee senses from the customer's behavior that "they might be committing fraud," the level of fraud detection alert can be increased in real time while the product registration or accounting processing is being performed. In this way, by combining the fraud detection process using image recognition processing by the edge device 3 with the human intuition of store employees who feel "they might be committing fraud" or "something seems suspicious," tacit knowledge that has not been verbalized or institutionalized, and human intuition that is difficult to systematize, can be incorporated into fraud detection. In addition, according to the fraud detection system S of this embodiment, by specifying the POS terminal 1 to which the threshold change will be made, it is possible to avoid an unnecessarily increased level of fraud alert on other POS terminals 1 when multiple POS terminals 1 are installed in the store.

[0086] Furthermore, the fraud detection system S of this embodiment resets the threshold used for fraud detection to its initial value for each accounting transaction, including product registration and accounting processing. Therefore, even if the threshold was changed in the fraud detection process of the previous transaction, the fraud detection system S of this embodiment allows the fraud detection process to be executed this time to start with the threshold at its initial value. In other words, the change in the threshold used for fraud detection in this embodiment is temporary and does not permanently change the overall level of fraud vigilance for the entire store. If the fraud vigilance level for the entire store is raised because of one customer that store employees feel "might be committing fraud" or "seems suspicious," other customers who would normally be judged not to be committing fraud may also be judged as committing fraud, potentially leading to false positives. By changing the threshold only for a specific POS terminal 1 and a specific transaction, as in the fraud detection system S of this embodiment, the targets for raising the level of fraud vigilance can be limited with high accuracy.

[0087] Furthermore, in the fraud detection system S of this embodiment, an edge device 3, which is connected to the POS terminal 1 for communication, performs fraudulent activity determination processing. Since fraudulent activity determination processing involves image recognition processing, it requires a lot of processing resources. Therefore, by having the edge device 3 perform fraudulent activity determination processing, the processing load on the POS terminal 1 and attendant PC 4 is reduced, and real-time fraud detection can be achieved through high-speed fraudulent activity determination processing.

[0088] (Variation 1) In the above-described embodiment, the user operated the attendant PC4 to change the threshold used for fraud detection. However, instead of the user changing the threshold, the threshold used for fraud detection may be automatically changed based on conditions such as the start or end of a specific period.

[0089] For example, the threshold changing unit 303 of the edge device 3 may uniformly change the threshold used for fraud detection at the POS terminal 1 in the store to a value smaller than the initial value, but only during specific time periods such as evenings when there are many customers. In this case, when the specific time period ends, the threshold changing unit 303 returns the threshold used for fraud detection to its initial value. If the threshold used for fraud detection is automatically changed according to the time period, the changed threshold will continue until the end of the specific time period, regardless of whether the transaction is completed.

[0090] Even if the threshold used for fraud detection is automatically changed, if the user specifies POS terminal 1 and sets the threshold, the threshold change unit 303 will prioritize the user's setting. If the threshold used for fraud detection at POS terminal 1 in the store has been uniformly changed to a value smaller than the initial value, the user may specify POS terminal 1 and change the threshold to an even smaller value, or revert it to the initial value. Threshold changes based on user operations are reset by the threshold change unit 303 after each transaction, and after the reset, the threshold automatically returns to the uniformly set value.

[0091] (Modification 2) Furthermore, in the above-described embodiment, the threshold changing unit 303 of the edge device 3 is capable of changing the threshold used for fraud detection to a value smaller than the initial value when it receives instructions from the attendant PC 4, but it may also be capable of changing it to a value larger than the initial value.

[0092] In other words, store staff may operate the attendant PC4 to lower the level of vigilance against fraud in the fraud detection process of the edge device 3. For example, if a customer exhibits behavior that would generally be judged as potentially fraudulent, but the store staff are aware that the customer is a regular and unlikely to commit fraud, the store staff may operate the attendant PC4 to change the fraud detection threshold of the POS terminal 1 used by that customer to a value greater than the initial value.

[0093] (Variation 3) Furthermore, in the above-described embodiment, a camera 2 installed around the POS terminal 1 or on the POS terminal 1 itself was used as an example of a sensing device, but a product reading camera provided as a scanner 108 in the POS terminal 1 may also be an example of a sensing device.

[0094] (Modification 4) Furthermore, in the above-described embodiment, the determination unit 302, which is a function realized by the edge device 3, was used as an example of fraudulent activity determination means, but the entire edge device 3 may also be used as an example of fraudulent activity determination means.

[0095] (Variation 5) Furthermore, in the above-described embodiment, the threshold changing unit 303, which is a function realized by the edge device 3, was used as an example of the threshold changing means, but the attendant PC 4 may also be used as an example of the threshold changing means.

[0096] (Experimental variation 6) Furthermore, in the above-described embodiment, the transmission unit 305, which is a function realized by the edge device 3, was used as an example of a notification means, but the display unit 111, speaker, LED lamp, etc. of the POS terminal 1 may also be used as an example of a notification unit.

[0097] Furthermore, the transmission unit 305 of the edge device 3 may notify the attendant PC 4 that fraud has been detected. In this case, the attendant PC 4 may display information on the display 41 or the like indicating the POS terminal 1 in which fraud was detected. For example, the attendant PC 4 may display an image indicating the POS terminal 1 in which fraud was detected on the screen showing the threshold setting status of each POS terminal 1 as shown in Figure 5, by flashing it. This display is just one example of notification.

[0098] (Example 7) Furthermore, in the above-described embodiment, the generation unit 304, which is a function realized by the edge device 3, generates the display data, but the attendant PC 4 may also generate the display data. In this case, the attendant PC 4 is an example of a generation means. In this case, the generation unit 304 of the edge device 3 generates threshold setting state data that associates each POS terminal 1 with the threshold setting state of each POS terminal 1, and the transmission unit 305 transmits the threshold setting state data to the attendant PC 4. The attendant PC 4 generates display data to be displayed on the display 41 based on the threshold setting state data, for example.

[0099] (Variation 8) Furthermore, the POS terminal 1 or attendant PC 4 may also have the functions of the edge device 3 in the above-described embodiment. In this case, the POS terminal 1 or attendant PC 4 may be an example of an image acquisition means, a fraudulent behavior detection means, a threshold changing means, and a notification means.

[0100] While several embodiments of the present invention have been described, these embodiments are presented as examples only and are not intended to limit the scope of the invention. These novel embodiments can be carried out in a variety of other forms, and various omissions, substitutions, modifications, and combinations are possible without departing from the spirit of the invention. These embodiments and their variations are included in the scope and spirit of the invention, as well as in the claims of the invention and its equivalents. [Explanation of symbols]

[0101] 1 POS terminal 2 cameras 3 Edge devices 4 Attendant PC 41 displays 51 LAN Hubs 52 Routers 100 Control Unit 101 CPU 102 ROM 103 RAM 104 Storage section 105 Device I / F 106 Communications Department 107 Deposit and Withdrawal Department 108 Scanners 109 Card reader 110 Printing section 111 Display section 112 Operation section 201 Product Registration Department 202 Acquisition Department 203 Display Control Unit 204 Transmitter 205 Reception Desk 206 Accounting Processing Section 301 Acquisition Department 302 Judgment section 303 Threshold Change Section 304 Generation part 305 Transmitter N In-store network S Fraud Detection System [Prior art documents] [Patent Documents]

[0102] [Patent Document 1] Japanese Patent Publication No. 2013-152634

Claims

1. Image acquisition means that acquires image data of the customer captured by a sensing device while the customer is performing product registration or accounting processing at a POS terminal, A fraudulent behavior determination means determines that a customer has committed fraudulent behavior if the customer's actions captured in the image data acquired by the image acquisition means exceed a threshold for determining fraudulent behavior. A threshold changing means for changing the judgment threshold from its initial value during the execution of the product registration process or the accounting process, A notification means that notifies when the fraudulent activity detection means determines that the customer has engaged in fraudulent activity, A fraud detection system equipped with the following features.

2. The threshold changing means changes the determination threshold based on an operation by the user to change the determination threshold by specifying the POS terminal during the execution of the product registration process or the accounting process. The fraud detection system according to claim 1.

3. The threshold changing means resets the determination threshold to the initial value for each accounting transaction, including the product registration process and the accounting process. The fraud detection system according to claim 1.

4. The fraudulent activity detection means is an information terminal that is connected to the POS terminal in a manner that enables communication. The fraud detection system according to claim 1.

5. The system further comprises a generation means for generating display data that associates the POS terminal with the determination threshold used for detecting fraudulent activity on the POS terminal. The fraud detection system according to any one of claims 1 to 4.

6. An image acquisition step in which, while a customer is performing product registration or accounting processing at a POS terminal, image data of the customer is captured from a sensing device is acquired. A fraudulent behavior determination step determines that the customer has committed fraudulent behavior if the customer's actions captured in the image data acquired in the image acquisition step exceed a threshold for determining fraudulent behavior, During the execution of the product registration process or the accounting process, a threshold change step is performed to change the judgment threshold from its initial value. A notification step which notifies if the customer is determined to have engaged in fraudulent activity in the fraudulent activity determination step, A program that causes a computer to execute something.

Images