Information processing device, information processing method, and information processing program

Abstract

To prevent a credit card from being fraudulently used.SOLUTION: An information processing device includes: a user information acquisition part for acquiring user information including at least credit card information of a user; a use information acquisition part for providing a database that records use information of a security code associated with credit card information, with the credit card information acquired by the user information acquisition part, and acquiring the use information related to the credit card information from the database; a determination part for determining the validity of the user on the basis at least of the use information acquired by the use information acquisition part; and a determination result providing part for providing a determination result related to the validity determined by the determination part.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an information processing device, an information processing method, and an information processing program. [Background technology]

[0002] 2. Description of the Related Art Credit cards have been used for payments over the Internet when purchasing goods, etc. When making payments over the Internet using a credit card, the user may be required to enter a security code along with the credit card number.

[0003] The security code is called, for example, CVV (Card Verification Code), CVC (Card Verification Code), or CID (Card Identification) number, and is printed as a three or four digit number on the front or back of the credit card, separate from the credit card number. In other words, the security code is information that can be seen by the person who actually owns the credit card. Meanwhile, a server that approves a payment by credit card can determine whether the combination of the credit card number and the security code is correct by storing the credit card number and the security code in association with each other. When a payment is made by credit card, the authenticity of the credit card can be confirmed by inquiring of the server about the credit card number and the security code.

[0004] For example, Patent Document 1 describes a server that manages credit card numbers and security codes in association with each other.

[0005] Also, in Internet payments using credit cards, some servers determine whether the credit card number is valid and do not check the security code. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] JP 2002-366868 A Summary of the Invention [Problem to be solved by the invention]

[0007] However, in the conventional technology, since the security code is a three- or four-digit number, for example, by continuously inputting 1000 different security codes, from "000" to "999" as three-digit numbers, the correct combination of credit card number and security code may be found out. If the correct security code once found out is used, there are cases where it is not possible to prevent the misuse of the credit card.

[0008] Furthermore, if security codes are not checked during Internet payments, it may not be possible to prevent credit card misuse.

[0009] The present invention has been made in consideration of the above circumstances, and has as its object to provide an information processing device, an information processing method, and an information processing program that can prevent the misuse of credit cards. [Means for solving the problem]

[0010] (1) In order to solve the above problems, an information processing device includes a user information acquisition unit that acquires user information including at least the user's credit card information, a usage information acquisition unit that provides the credit card information acquired by the user information acquisition unit to a database that records usage information of a security code associated with the credit card information and acquires usage information related to the credit card information from the database, a judgment unit that judges the legitimacy of the user based at least on the usage information acquired by the usage information acquisition unit, and a judgment result providing unit that provides a judgment result related to the legitimacy judged by the judgment unit.

[0011] (2) In the information processing device of the embodiment, the usage information acquisition unit may acquire, as the usage information, information indicating that different security codes have been input in succession.

[0012] (3) In addition, in the information processing device of the embodiment, a user information recording unit may be further provided that records the user information acquired by the user information acquisition unit, and the judgment unit may judge the legitimacy of the user by comparing the user information previously recorded in the user information recording unit with the user information newly acquired by the user information acquisition unit.

[0013] (4) In the information processing device of the embodiment, the user information acquiring unit may acquire, as the user information, terminal information of the terminal that transmitted the credit card information.

[0014] (5) In the information processing device of the embodiment, the user information acquisition unit may acquire at least one of the following information as the terminal information: a network address, an operating system, a language used, and a time zone of the terminal.

[0015] (6) In order to solve the above problems, the information processing method is an information processing method executed on an information processing device, and includes a user information acquisition step of acquiring user information including at least the user's credit card information, a usage information acquisition step of providing the credit card information acquired in the user information acquisition step to a database that records usage information of a security code associated with the credit card information and acquiring usage information related to the credit card information from the database, a determination step of determining the legitimacy of the user based at least on the usage information acquired in the usage information acquisition step, and a determination result providing step of providing a determination result related to the legitimacy determined in the determination step.

[0016] (7) In order to solve the above problem, the information processing program causes a computer to realize a user information acquisition function that acquires user information including at least the user's credit card information, a usage information acquisition function that provides the credit card information acquired by the user information acquisition function to a database that records usage information of a security code associated with the credit card information and acquires usage information related to the credit card information from the database, a judgment function that judges the legitimacy of the user based at least on the usage information acquired by the usage information acquisition function, and a judgment result providing function that provides a judgment result related to the legitimacy judged by the judgment function. Effect of the Invention

[0017] According to one embodiment of the present invention, an information processing device acquires user information including at least the user's credit card information, provides the acquired credit card information to a database that records usage information of security codes associated with the credit card information, acquires usage information related to the credit card information from the database, determines the legitimacy of the user based at least on the acquired usage information, and provides a determination result related to the determined legitimacy, thereby preventing misuse of credit cards. [Brief description of the drawings]

[0018] [Figure 1] FIG. 1 is a block diagram illustrating an example of a software configuration of an information processing device according to an embodiment. [Diagram 2] FIG. 2 is a sequence diagram showing an example of an information flow including an information processing device according to an embodiment. [Diagram 3] 5 is a flowchart illustrating an example of an operation of the information processing device according to the embodiment. [Figure 4] 1 is a block diagram showing an example of a hardware configuration of an information processing device according to an embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0019] An information processing apparatus, an information processing method, and an information processing program according to an embodiment of the present invention will be described in detail below with reference to the drawings.

[0020] First, the functions of the information processing device will be described with reference to Fig. 1. Fig. 1 is a block diagram showing an example of the software configuration of the information processing device in the embodiment.

[0021] In FIG. 1, an information processing device 1 is connected to a user terminal 2, a client server 3, and a card information management server 4 via a network 9 so as to be able to communicate with them. The user terminal 2 includes, for example, a Web browser 21, and enables the use of Web services provided by the client server 3. In this embodiment, a user refers to a person who uses a Web service provided by the client server 3 using a credit card. The user may be a credit card owner, or may be a person who has the right to use a credit card. The Web browser 21 displays, for example, a Web page provided by the client server 3 for purchasing a product, or applying for a service or membership registration. That is, the client server 3 may be a Web server that provides a Web page. The Web page may include a UI (User Interface) for inputting input items. The UI includes, for example, a text box for inputting characters, or a radio button or check box for selecting an option. For example, the user's name, address, phone number, age, product purchase details, service usage details, etc. are input into the text box. The user can use the Web service provided by the client server 3 by, for example, inputting text into a text box on a Web page displayed on the Web browser 21.

[0022] The card information management server 4 includes a usage information database 41. The usage information database 41 accumulates credit card usage information. The credit card usage information is credit card usage information associated with credit card information. The credit card information is, for example, information such as a card number written on a credit card, magnetic information recorded on a magnetic stripe, or a security code written on a credit card.

[0023] Credit card usage information is information about how a credit card has been used, and includes at least security code usage information, and may also include, for example, the credit card's past usage history (date and time of use, store used, amount used, etc.).

[0024] The usage status of the security code includes, for example, the date and time when the security code was used during credit card payment, the number of times it was used, the number of input errors, the interval between input errors, etc. For example, when different security codes are successively entered during a credit card payment (when the security code is input incorrectly multiple times), the usage information database 41 records the usage history of the security code.

[0025] For example, if different security codes are input consecutively, there is a high possibility that the credit card has been fraudulently used. For example, if a correct security code is input after an incorrect security code is input consecutively, the use of the credit card may not be suspended. Even if the use of the credit card is not suspended, the usage information database 41 records the usage history of the security code, making it possible to record credit card information that is likely to be fraudulently used. Note that the usage status of the security code may include information on whether or not the credit card has been suspended as a result of the successive inputs, in addition to whether or not the security code has been input consecutively.

[0026] The card information management server 4 provides credit card usage information to the information processing device 1 in response to a request from the information processing device 1. The card information management server 4, for example, acquires a credit card number from the information processing device 1 and provides the information processing device 1 with credit card usage information of the card number.

[0027] 1 shows an example of a device configuration connected by a network 9 including an information processing device 1, and does not limit the device configuration. For example, a plurality of user terminals 2, client servers 3, or card information management servers 4 may be connected. The network 9 is a wired or wireless network, such as the Internet. In the following embodiment, the network 9 will be described as being the Internet.

[0028] The information processing device 1 has various functional units, namely, a communication control unit 11, a user information acquisition unit 12, a user information recording unit 13, a usage information acquisition unit 14, a determination unit 15, and a determination result providing unit 16. Each of the above-mentioned functional units of the information processing device 1 in this embodiment will be described as a functional module realized by an information processing program (software) in this embodiment.

[0029] The communication control unit 11 controls communication with the client server 3 or the card information management server 4 connected via the network 9. The communication control unit 11 may, for example, control login from the client server 3 or control login to the card information management server 4.

[0030] The user information acquisition unit 12 acquires user information including at least the credit card information of the user. As described above, the credit card information is, for example, a card number written on a credit card, magnetic information recorded on a magnetic stripe, or security information written on a credit card. The user information includes at least the credit card information, and may include, for example, the user's address, name, or telephone number. For example, the user information acquisition unit 12 acquires, from the client server 3, user information transmitted from the user terminal 2 to the client server 3 when the user inputs credit card information when using a Web service provided by the client server 3. For example, the client server 3 may provide user information to the user information acquisition unit 12 when the user wants to check credit card usage information. When the client server 3 acquires credit card information from the user terminal 2, the client server 3 may transmit information such as the user's address together with the credit card information to the user information acquisition unit 12.

[0031] The user information acquisition unit 12 may also acquire, as user information, terminal information of the user terminal 2 that has transmitted the credit card information. The terminal information is information including at least one of the following information of the user terminal 2: network address, operating system, language used, and time zone. The terminal information is acquired by the client server 3 in HTML (HyperText Markup Language) communication between the Web server of the client server 3 and the Web browser 21. The network address of the user terminal 2 is, for example, an IP (Internet Protocol) address or a MAC (Media Access Control) address. The time zone refers to a standard time or time zone determined for each country or region based on UTC (Coordinated Universal Time). For example, Japan has a time zone that is nine hours earlier than UTC. The time zone of the user terminal 2 is set in the operating system.

[0032] The user information recording unit 13 records the user information acquired by the user information acquisition unit 12. For example, the user information recording unit 13 records the acquired user information every time the user information is acquired by the user information acquisition unit 12. That is, the user information recording unit 13 may record the user information acquired in the past. The user information recording unit 13 records the credit card information and the user information other than the credit card information in association with each other. For example, the user information recording unit 13 stores the credit card number and the address, name, telephone number, etc. of the user in association with each other. This allows the user information recording unit 13 to store the address, etc. of the user in a manner that allows the address, etc. of the user to be uniquely identified from the credit card number. Note that the credit card information and the other user information may be stored in a one-to-one correspondence, or may be stored in a one-to-many, many-to-one, or many-to-many correspondence. For example, when the address of the user is changed due to a move or the like, the user information recording unit 13 may record the address in association with one card number. Furthermore, when one user has multiple credit cards, the user information recording unit 13 may record multiple card numbers in association with one name.

[0033] The usage information acquisition unit 14 provides the credit card information acquired by the user information acquisition unit 12 to the card information management server 4 which has recorded the usage information of the security code associated with the credit card information, and acquires, in response, the usage information related to the credit card information provided from the card information management server 4. For example, if the card number of the credit card acquired by the user information acquisition unit 12 is a credit card to which different security codes have been input consecutively in the past, the usage information acquisition unit 14 can acquire from the card information management server 4 information that the credit card is a credit card to which different security codes have been input consecutively in the past.

[0034] The judgment unit 15 judges the legitimacy of the user who used the credit card based at least on the usage information acquired by the usage information acquisition unit 14. The legitimacy of the user who used the credit card refers to whether or not the legitimate owner of the credit card used the credit card. The judgment unit 15 may judge the legitimacy of the user by comparing user information previously recorded in the user information recording unit 13 with user information newly acquired by the user information acquisition unit 12. Examples of judgments made by the judgment unit 15 are illustrated below. Note that each of the judgment examples shown below may be used alone, or multiple judgment examples may be used together.

[0035] <Determination based on whether or not different security codes are entered consecutively> The determination unit 15 determines the legitimacy of the user when it is determined that there is no history of consecutive input of different security codes in the usage information acquired by the usage information acquisition unit 14. For example, when there is a history of consecutive input of three different security codes, the determination unit 15 determines that the credit card has been used fraudulently. This enables the determination unit 15 to determine new fraudulent use of the credit card.

[0036] <Decision based on user information> The determination unit 15 determines the legitimacy of the user when it is determined that the user information newly acquired by the user information acquisition unit 12 is not user information that has been fraudulently used in the past. For example, when the user's address, telephone number, etc. have been fraudulently used in the past, the determination unit 15 determines that the credit card has been fraudulently used. The user information may include a history of changing communication carriers using the number portability system of mobile phones, a contract period of a SIM (Subscriber Identity Module) card, call records, communication records, years of residence at the address, or contract status of electricity, gas, water, etc. These user information may include false information or unnatural information. For example, when the user information includes the address of an uninhabited residence, there may be cases where no contract for electricity, etc. has been made, or only the basic fee has been charged. When the user information includes unnatural information, the determination unit 15 determines that the credit card has been fraudulently used.

[0037] <Decision based on discrepancy in user information> The determination unit 15 compares the user information previously recorded in the user information recording unit 13 with the user information newly acquired by the user information acquiring unit 12, and if it is determined that there is no mismatch between the two, it determines the legitimacy of the user. For example, if the previously recorded address of the user is Hokkaido and the newly acquired address is Okinawa Prefecture, the determination unit 15 determines that the credit card has been fraudulently used. As described above, the user information may include the terminal information of the user terminal 2. For example, if the time zone in the previously recorded terminal information is Japan and the time zone in the newly acquired terminal information is Russia, the determination unit 15 determines that the credit card has been fraudulently used.

[0038] The judgment result providing unit 16 provides the client server 3 with the judgment result relating to the legitimacy judged by the judgment unit 15. The judgment result is, for example, judgment information on whether or not the credit card has been used fraudulently, and may be the usage information itself. The judgment result may also include past usage information of the credit card user. For example, the judgment result providing unit 16 provides the judgment result to the client server 3 that has provided the user information acquired by the user information acquiring unit 12. The judgment result providing unit 16 may provide the judgment result to another device or system. By acquiring the judgment result from the judgment result providing unit 16, the client server 3 can acquire information relating to the legitimacy of the user, and can prevent the misuse of the credit card.

[0039] Note that the above-mentioned functional units of the information processing device 1 are merely examples of the functional units of the information processing device 1, and do not limit the functions of the information processing device 1. For example, the information processing device 1 does not need to have all of the functional units described above, and may have only some of the functional units. The information processing device 1 may also have functions other than those described above. For example, the information processing device 1 may have an input function for inputting information and an output function for notifying the operating status of the device by an LED lamp or the like.

[0040] As described above, each of the functional units of the information processing device 1 is described as being realized by software. However, at least one of the functional units of the information processing device 1 may be realized by hardware.

[0041] Also, any of the above-mentioned functional units of the information processing device 1 may be implemented by dividing one functional unit into a plurality of functional units. Also, any two or more of the above-mentioned functional units of the information processing device 1 may be implemented by integrating them into one functional unit. That is, Fig. 1 shows the functions of the information processing device 1 as functional blocks, and does not indicate, for example, that each functional unit is composed of a separate program file or the like.

[0042] The information processing device 1 may be a device realized by one housing, or may be a system realized by multiple devices connected via a network or the like. For example, the information processing device 1 may be realized by another virtual device, such as a cloud service provided by a cloud computing system, for some or all of its functions. That is, the information processing device 1 may be configured to realize at least one or more of the above-mentioned functional units in another device. The information processing device 1 may be a general-purpose computer, such as a desktop PC, or may be a dedicated device with limited functions.

[0043] Next, the flow of information in a system including the information processing device 1 will be described with reference to Fig. 2. Fig. 2 is a sequence diagram showing an example of the flow of information including the information processing device 1 in the embodiment.

[0044] 2, the user terminal 2 provides user information including credit card information to the client server 3 in order to use a Web service provided by the client server 3 (step S1). A part or all of the user information may be provided in an encrypted form.

[0045] After the process of step S1 is executed, the client server 3 provides the user information acquired from the user terminal 2 to the information processing device 1 (step S2).

[0046] After the process of step S2 is executed, the information processing device 1 provides the credit card information acquired from the client server 3 to the card information management server 4 (step S3).

[0047] After the process of step S3 is executed, the card information management server 4 provides the information processing device 1 with credit card usage information including at least security code usage information corresponding to the acquired credit card information (step S4).

[0048] After the process of step S4 is executed, the information processing device 1 provides the client server 3 with a determination result based on the credit card usage information acquired from the card information management server 4 (step S5). Note that the information processing device 1 may provide a determination result based on user information, for example.

[0049] After the process of step S5 is executed, the client server 3 provides information based on the determination result to the user terminal 2. The information based on the determination result is, for example, a display indicating that the credit card cannot be used, a display encouraging the use of another credit card, or a display encouraging the input of additional information.

[0050] The user information may be provided to the information processing device 1 without going through the client server 3. In other words, the client server 3 may provide the user terminal 2 with a Web page including a process for providing the user information directly to the information processing device 1 (for example, a script for automatically changing the connection destination).

[0051] Furthermore, the information processing device 1 may provide user information to a plurality of card information management servers 4 and obtain usage information from each of them.

[0052] Next, the operation of the information processing device 1 will be described with reference to Fig. 3. Fig. 3 is a flowchart showing an example of the operation of the information processing device 1 in the embodiment. Note that, although the operation in the flowchart shown below will be described as being executed by the information processing device 1, each operation can be executed by each functional unit of the information processing device 1 described above.

[0053] 3, the information processing device 1 determines whether or not user information including at least credit card information has been acquired from the client server 3 (step S11). If it cannot be determined that the user information has been acquired (step S11: NO), the information processing device 1 repeats the process of step S11 and waits for the user information to be acquired.

[0054] On the other hand, when it is determined that the user information has been acquired (step S11: YES), the information processing device 1 records the acquired user information (step S12). Note that, when the recorded user information is different from the user information previously stored, the information processing device 1 may record the user information by adding it to the previous user information without erasing the previous user information.

[0055] After executing the process of step S12, the information processing device 1 provides the acquired credit card information to the card information management server 4 (step S13).

[0056] After executing the process of step S13, the information processing device 1 determines whether or not the usage information has been acquired from the card information management server 4 (step S14). If it cannot be determined that the usage information has been acquired (step S14: NO), the information processing device 1 repeats the process of step S14 and waits for the usage information to be acquired.

[0057] On the other hand, when it is determined that the usage information has been acquired (step S14: YES), the information processing device 1 determines the validity based at least on the acquired usage information (step S15).

[0058] After executing the process of step S15, the information processing device 1 provides the result of the determination of validity to the client server 3 (step S16). After executing the process of step S16, the information processing device 1 ends the operation shown in the flowchart.

[0059] It should be noted that the illustrated flowchart shows an example of the operation of the information processing device 1, and does not limit the order of operations in the information processing device 1.

[0060] Next, a hardware configuration of the information processing device 1 will be described with reference to Fig. 4. Fig. 4 is a block diagram showing an example of a hardware configuration of the information processing device 1 in the embodiment.

[0061] The information processing device 1 includes a CPU (Central Processing Unit) 101, a RAM (Random Access Memory) 102, a ROM (Read Only Memory) 103, an I / O device 104, and a communication I / F (Interface) 105. The information processing device 1 is a device that executes the information processing program described in FIG.

[0062] The CPU 101 controls the user terminal by executing an information processing program stored in the RAM 102 or the ROM 103. The information processing program is obtained, for example, from a recording medium on which the program is recorded or a program distribution server via a network, and installed in the ROM 103, and is read out and executed by the CPU 101.

[0063] The I / O device 104 has an operation input function and a display function (operation display function). The I / O device 104 is, for example, a touch panel. The touch panel enables the user of the information processing device 1 to input operations using a fingertip, a touch pen, or the like. In the present embodiment, the I / O device 104 is described as using a touch panel having an operation display function, but the I / O device 104 may have a display device having a display function and an operation input device having an operation input function separately. In that case, the display screen of the touch panel can be implemented as the display screen of the display device, and the operation of the touch panel can be implemented as the operation of the operation input device. The I / O device 104 may be realized in various forms such as a head-mounted type, a glasses type, or a wristwatch type display.

[0064] The communication I / F 105 is an I / F for communication. The communication I / F 105 executes short-distance wireless communication such as wireless LAN, wired LAN, infrared, etc. Although the figure illustrates only the communication I / F 105 as an I / F for communication, the information processing device 1 may have an I / F for each of a plurality of communication methods.

[0065] The above-mentioned various processes of the present embodiment may be performed by recording a program for realizing the functions constituting the device described in the present embodiment in a computer-readable recording medium, and reading and executing the program recorded in the recording medium into a computer system. The "computer system" referred to here may include hardware such as an OS and peripheral devices. In addition, if a WWW system is used, the "computer system" also includes a homepage providing environment (or display environment). In addition, the "computer-readable recording medium" refers to a storage device such as a flexible disk, a magneto-optical disk, a ROM, a writable non-volatile memory such as a flash memory, a portable medium such as a CD-ROM, or a hard disk built into a computer system.

[0066] Furthermore, the term "computer-readable recording medium" includes a memory that holds a program for a certain period of time, such as a volatile memory (e.g., DRAM (Dynamic Random Access Memory)) inside a computer system that becomes a server or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. The above-mentioned program may be transmitted from a computer system that stores the program in a storage device or the like to another computer system via a transmission medium, or by a transmission wave in the transmission medium. Here, the "transmission medium" that transmits the program refers to a medium that has a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. The above-mentioned program may also be a program for realizing part of the above-mentioned functions. Furthermore, the above-mentioned function may be realized in combination with a program already recorded in the computer system, that is, a so-called difference file (difference program).

[0067] Although an embodiment of the present invention has been described above with reference to the drawings, the specific configuration is not limited to this embodiment, and various modifications are also included within the scope that does not deviate from the spirit of the present invention. [Explanation of symbols]

[0068] 1. Information processing device 11 Communication control section 12 User information acquisition department 13 User Information Record Section 14 Usage information acquisition section 15 Judgment section 16 Judgment result provision department 2. User terminal 21 Web Browser 3 Client Server 4. Card information management server 41 Usage information database 9 Network 101 CPU 102 RAM 103 ROM 104 I / O equipment 105 Communication I / F

Claims

1. a user information acquiring unit for acquiring user information including at least credit card information of the user; a usage information acquisition unit that provides the credit card information acquired by the user information acquisition unit to a database that records usage information of a security code associated with credit card information, and acquires the usage information related to the credit card information from the database, and acquires information indicating that different security codes have been input consecutively as the usage information; a determination unit that determines the authenticity of the user when it is determined that the usage information does not include information indicating that the different security codes have been input consecutively; a determination result providing unit that provides a determination result relating to the legitimacy determined by the determining unit; Equipped with The user information acquisition unit, acquiring terminal information of the terminal that transmitted the credit card information as the user information; At least one of the following information is acquired as the terminal information: a network address, an operating system, a language used, or a time zone of the terminal; A user information recording unit that records the user information acquired by the user information acquisition unit, the determination unit determines the legitimacy of the user by comparing the user information previously recorded in the user information recording unit with the user information newly acquired by the user information acquisition unit; Information processing device.

2. An information processing method executed in an information processing device, a user information acquiring step of acquiring user information including at least credit card information of the user; a usage information acquisition step of providing the credit card information acquired in the user information acquisition step to a database that records usage information of a security code associated with credit card information, and acquiring the usage information related to the credit card information from the database, the usage information acquisition step acquiring information indicating that different security codes have been input consecutively as the usage information; a determining step of determining the authenticity of the user when it is determined that the usage information does not include information indicating that the different security codes have been input consecutively; a determination result providing step of providing a determination result relating to the legitimacy determined in the determining step; Including, The user information acquisition step includes: acquiring terminal information of the terminal that transmitted the credit card information as the user information; Acquire at least one of the following information about the terminal: a network address, an operating system, a language used, or a time zone; and a user information recording step of recording the user information acquired in the user information acquiring step, the determining step determines the authenticity of the user by comparing the user information previously recorded in the user information recording step with the user information newly acquired in the user information acquisition step; Information processing methods.

3. On the computer, A user information acquisition function for acquiring user information including at least the user's credit card information; a usage information acquisition function that provides the credit card information acquired by the user information acquisition function to a database that records usage information of a security code associated with credit card information, and acquires the usage information related to the credit card information from the database, and acquires information indicating that different security codes have been input consecutively as the usage information; a determination function for determining the authenticity of the user when it is determined that there is no information in the usage information indicating that the different security codes have been input consecutively; a judgment result providing function for providing a judgment result relating to the legitimacy judged by the judgment function; Realize this, The user information acquisition function is acquiring terminal information of the terminal that transmitted the credit card information as the user information; Acquire at least one of the following information about the terminal: a network address, an operating system, a language used, or a time zone; and A user information recording function is further provided for recording the user information acquired by the user information acquisition function, the determination function determines the legitimacy of the user by comparing the user information previously recorded in the user information recording function with the user information newly acquired in the user information acquisition function; Information processing program.

Images