FRAUD DETECTION DEVICE, FRAUD DETECTION METHOD, AND FRAUD DETECTION PROGRAM

Abstract

To detect a fraud activity by a fraudulent activity by an organization in an easy way.SOLUTION: A fraud detection apparatus that detects a fraudulent activity of a user who purchases a product in an electric commerce includes a first fraud determination unit that detects a fraudulent activity based on purchase amounts of all users who purchase the product in a first period, a second fraud determination unit that detects a fraudulent activity based on purchase amounts of all users who purchase the product in a second period by accesses from the same IP address, and a third fraud determination unit that detects a fraudulent activity base on the number of users who purchase the product in a third period.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to a technique for detecting fraudulent activities in electronic commerce, and more particularly to a fraud detection device, a fraud detection method, and a fraud detection program for detecting fraudulent activities by an organization. [Background technology]

[0002] Conventionally, there are known techniques for detecting fraudulent activities in electronic commerce that provides products and services via a communication network such as the Internet. For example, Patent Literature 1 discloses a technique for restricting the use of services by a user who uses an information processing terminal associated with a user who has committed a fraudulent act. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Publication No. 2021-33460 Summary of the Invention [Problem to be solved by the invention]

[0004] However, while conventional technologies are effective to a certain extent against fraudulent acts committed by individuals or other lone criminals, there is a problem in that they are not sufficient to deter fraudulent acts committed by criminal organizations, the number of which has been on the rise in recent years.

[0005] The present invention has been made in consideration of the above circumstances, and an object of the present invention is to provide a technique for detecting fraudulent activities by an organization in a simple manner. [Means for solving the problem]

[0006] In order to achieve the above object, a fraud detection device according to one aspect of the present invention is a fraud detection device that detects fraudulent behavior by a user who purchases a predetermined product or service (hereinafter, referred to as a "product") in an electronic commerce transaction, comprising: a first fraud determination unit that detects fraudulent activity based on the purchase amounts of all users who purchased the product during a predetermined first period; a second fraud determination unit that detects fraudulent activity based on the purchase amounts of all users who purchased the product during a second predetermined period and accessed from the same IP address; a third fraud determination unit that detects fraudulent activity based on the number of users who purchased the product during a third predetermined period; The present invention is characterized by comprising:

[0008] In addition, a fraud detection method according to one aspect of the present invention includes an information processing device that detects fraudulent behavior by a user who purchases a predetermined product or service (hereinafter, referred to as a "product") in electronic commerce, the information processing device comprising: a first fraud determination process for detecting fraudulent activity based on the purchase amounts of all users who purchased the product during a predetermined first period; a second fraud determination process for detecting fraudulent activity based on the purchase amounts of all users who purchased the product during a second predetermined period and accessed from the same IP address; a third fraud determination process for detecting fraudulent activity based on the number of users who purchased the product during a third predetermined period; The present invention is characterized by carrying out the following steps.

[0009] A fraud detection program according to one aspect of the present invention is provided for an information processing device that detects fraudulent behavior by a user who purchases a predetermined product or service (hereinafter, referred to as a "product") in electronic commerce, comprising: a first fraud determination process for detecting fraudulent activity based on the purchase amounts of all users who purchased the product during a predetermined first period; a second fraud determination process for detecting fraudulent activity based on the purchase amounts of all users who purchased the product during a second predetermined period and accessed from the same IP address; a third fraud determination process for detecting fraudulent activity based on the number of users who purchased the product during a third predetermined period; The present invention is characterized in that the above-mentioned is executed. Effect of the Invention

[0010] According to the present invention, fraudulent activities by an organization can be detected in a simple manner. [Brief description of the drawings]

[0011] [Figure 1] 1 is a schematic configuration diagram of an information processing system according to an embodiment. [Diagram 2] 11 is a flowchart illustrating an operation of a user when purchasing a gift certificate in an information processing system according to an embodiment. [Diagram 3] FIG. 2 is a functional configuration diagram of a server of an information processing system according to an embodiment. [Figure 4] 2 is a schematic diagram showing configurations of member data, member status data, and purchase data used in an information processing system according to an embodiment; FIG. [Diagram 5] 1 is a schematic diagram showing a configuration of condition management data used in an information processing system according to an embodiment; [Figure 6] 10 is a flowchart showing a flow of a purchase process in an information processing system according to an embodiment. [Figure 7] 10 is a flowchart showing a flow of hourly batch processing in an information processing system according to an embodiment. [Figure 8] 1 is a flowchart showing a flow of daily batch processing in an information processing system according to an embodiment. [Figure 9] 10 is a flowchart showing the flow of monthly batch processing in an information processing system according to an embodiment. [Figure 10] 11 is a flowchart showing a flow of IP control batch processing in the information processing system according to one embodiment. [Figure 11] FIG. 11 is a diagram illustrating an example of an email issued in an alert process of the information processing system according to an embodiment. [Figure 12] FIG. 1 is a hardware configuration diagram of an information processing device according to an embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] <Configuration of information processing system> Information processing system FIG. 1 is a schematic diagram of an information processing system 10 according to an embodiment. The information processing system 10 is a gift certificate purchase / transmission system in which a user purchases an electronic gift certificate online (hereinafter, the user who purchases the electronic gift certificate is referred to as the purchaser) and transmits the purchased electronic gift certificate to another user online (hereinafter, the user who receives the electronic gift certificate is referred to as the recipient). The information processing system 10 is also a gift certificate exchange system in which the recipient can exchange the received electronic gift certificate for multiple electronic money or products online. Hereinafter, an electronic gift certificate is a gift certificate that can be used in online services. Hereinafter, a service provided by the information processing system 10 is referred to as a gift certificate provision service. Note that the gift certificate provision service according to this embodiment employs a membership system, so that the purchaser needs to become a member (on the other hand, the recipient does not need to become a member). Hereinafter, a user who has registered as a member is referred to as a member.

[0013] As shown in FIG. 1, the information processing system 10 includes a server 1, a credit card payment system 2, a user terminal 3 used by a purchaser, and a user terminal 4 used by a recipient.

[0014] The server 1 is an information processing device 100 owned by a management company that manages the gift certificate provision service. Hereinafter, the person who manages the server 1 is referred to as the administrator. The server 1 is configured to be able to communicate with each of the credit card payment system 2, the user terminal 3, and the user terminal 4 via a communication network 5. The communication network 5 includes, for example, the Internet network, a public line network, and a dedicated communication network. The credit card payment system 2 is an information processing device 100 managed by an online payment agent that performs credit card payment services. In the gift certificate provision service of this embodiment, the purchaser is configured to purchase an electronic gift certificate by paying with a credit card. The user terminal 3 and the user terminal 4 are information processing devices 100 used by the user, and examples thereof include a personal computer, a smartphone, and a tablet terminal.

[0015] FIG. 12 is a hardware configuration diagram of the information processing device 100. As shown in FIG. 12, the information processing device 100 includes a processor 101, a memory 102, a storage 103, an input / output interface 104, and a communication interface 105. The processor 101 includes, for example, a central processing unit (CPU). The memory 102 includes, for example, a read only memory (ROM) and a random access memory (RAM). The storage 103 includes, for example, a hard disk drive (HDD) and a solid state drive (SSD). The input / output interface 104 includes, for example, a touch panel, a keyboard, a mouse, a camera, a microphone, and the like as an input device, and, for example, a display such as a liquid crystal display device or an electroluminescence (EL) display device, a speaker, and the like as an output device. The communication interface 105 can transmit and receive various data via a communication network 5, and may be either wired or wireless, and may use any communication protocol.

[0016] The information processing system 10 of this embodiment is characterized by a function for preventing fraudulent activities when a purchaser purchases an electronic gift certificate. Therefore, the following description will focus on this fraud prevention function, and will not explain the functions that occur after the purchaser purchases an electronic gift certificate, i.e., the functions by which the purchaser sends the electronic gift certificate to a recipient and the recipient exchanges the electronic gift certificate for a product.

[0017] · Purchase electronic gift certificates Before describing the configuration of the server 1 having a fraud prevention function in the information processing system 10, the process up to when a purchaser purchases an electronic gift certificate will be described with reference to Fig. 2. Fig. 2 is a flowchart showing the operation up to when a purchaser purchases an electronic gift certificate in the information processing system 10. The operation up to when a purchaser purchases an electronic gift certificate is performed by the purchaser accessing the server 1 using the user terminal 3.

[0018] Since the gift certificate provision service according to the present embodiment employs a membership system as described above, a user who wishes to purchase an electronic gift certificate must first register as a member (step S10). When registering as a member, the user first registers an email address and a password on a member registration screen (step S11). As a result, the server 1 sends a confirmation email to the registered email address, and the user accesses the confirmation link included in the confirmation email (step S12) to display the member information registration screen. Next, the user registers member information on the member information registration screen (step S13). The member information is composed of, for example, a mobile phone number, gender, date of birth, zip code, secret questions and answers, and the like. The mobile phone number is information for performing SMS (short message service) authentication, and information other than the mobile phone number is used as information for verifying the identity of the user in the event that a fraudulent act is suspected in the purchase of an electronic gift certificate at a later date. When registering member information, it is also possible to register information related to a credit card (for example, a card number, a cardholder name, an expiration date, a security code, and the like). As a result, the server 1 sends an SMS token according to the registered mobile phone number, and the user inputs the authentication code written on the received SMS token into the authentication code confirmation screen (step S14). The server 1 performs SMS authentication based on the input authentication code, and if the SMS authentication is successful, the user's membership information is registered in the server 1, and the membership registration process is completed.

[0019] In the information processing system 10 of this embodiment, when the member registration is completed, the user is automatically placed in a logged-in state (step S20). In other words, the user is not required to perform any operation to log in to the information processing system 10 after the member registration is completed. On the other hand, from the next time onwards, that is, when logging in to the information processing system 10 again after logging out once, the user needs to input an email address and a password on the login screen (S21). When the user inputs the email address and password, the server 1 performs user authentication based on the email address and password. If the user authentication is successful, the server 1 sends an SMS token according to the mobile phone number, and the user inputs the authentication code written on the received SMS token (step S22). The server 1 performs SMS authentication based on the input SMS code, and if the SMS authentication is successful, the user is placed in a logged-in state.

[0020] In this way, the information processing system 10 according to the present embodiment prevents unauthorized access by two-step authentication, that is, by authenticating the user by email address and password, and then authenticating the user by authentication code. Although not shown in Fig. 2, recaptcha is set on the member registration screen and login screen, and the system is configured to prevent access from bots.

[0021] Next, the user (member) purchases an electronic gift certificate (step S30). More specifically, the user inputs gift purchase information on the electronic gift purchase screen (step S31). The gift purchase information includes, for example, the design of the electronic gift certificate, a message to the recipient, the type and number of electronic gift certificates indicating the amount of the electronic gift certificate, and the like. If the information on the credit card has not yet been registered, the user also inputs information on the credit card. If there is no error in the pre-set check at the time of purchase (for example, a check to see if the purchase amount exceeds a pre-set upper limit) and there is no problem with the credit card in cooperation with the credit card payment system 2, the server 1 executes the purchase process of the electronic gift certificate and sends a purchase completion email to the user's email address to inform him or her that the purchase of the electronic gift certificate has been completed. The user accesses the server 1 based on the purchase completion screen URL included in the purchase completion email (step S32) and displays the purchase completion screen. Here, the purchase completion screen includes a receiving URL for receiving the electronic gift certificate, so the purchaser transfers this receiving URL to the recipient by a predetermined electronic communication means (step S33). Examples of the predetermined communication means include email, SNS (Social Networking Service), etc. Through the above steps, the recipient can receive the electronic gift certificate.

[0022] ·server Next, the fraud prevention function of the server 1 will be described with reference to Fig. 3. Fig. 3 is a functional configuration diagram of the server 1. The server 1 is also a fraud detection device that detects fraudulent activities in the purchase of the electronic gift certificate shown in Fig. 2.

[0023] As shown in FIG. 3, the server 1 is equipped with a memory unit 11 that stores data managed by the information processing system 10, a control unit 12 that controls the memory unit 11, transfers various data, performs various calculations, temporarily stores data, etc., to execute various processes described later in this embodiment (for example, various processes related to preventing fraudulent activities such as purchase processing, hourly batch processing, daily batch processing, monthly batch processing, IP control batch processing, etc.), and a communication unit 13 that transmits and receives data to and from each of the credit card payment system 2, user terminal 3, and user terminal 4 via the communication network 5.

[0024] More specifically, memory unit 11 is configured to include a member database (hereinafter referred to as member DB) 14, a member status database (hereinafter referred to as member status DB) 15, a purchase database (hereinafter referred to as purchase DB) 16, and a condition management database (hereinafter referred to as condition management DB) 17. Schematic diagrams of the data structures of member DB 14, member status DB 15, purchase DB 16, and condition management DB 17 are shown in Fig. 4(a), Fig. 4(b), Fig. 4(c), and Fig. 5, respectively.

[0025] The member DB 14 is a database that stores member information that can uniquely identify a member. The member DB 14 stores member data d14 that includes at least a member ID, an email address, a password, a mobile phone number, personal identification information, and credit card information, as shown in FIG. 4(a).

[0026] Here, the member ID is an ID that can uniquely identify a member within the information processing system 10. The email address, password, mobile phone number, identity verification information, and credit card information are information that the purchaser inputs when registering as a member. Identity verification information is composed of, for example, gender, date of birth, postal code, secret question, and secret answer. Credit card information is composed of, for example, card number, cardholder name, expiration date, security code, etc.

[0027] In this embodiment, a member can only have one email address, one mobile phone number, and one credit card information. Furthermore, the email address, mobile phone number, and credit card information registered in the member DB14 as the member data d14 of one member cannot be registered in duplicate as the member data d14 of another member. This is based on the viewpoint of preventing fraudulent activities by groups.

[0028] Member status DB15 is a database that manages whether a member can use the information processing system 10 and whether the member is logged in. Member status DB15 stores member status data d15 including at least a member ID, a status flag, and a login date and time, for example, as shown in Fig. 4(b).

[0029] Here, the status flag indicates whether or not the member can use the status information processing system 10. For example, the status flag may be configured as a valid status, a warning status, or an invalid status.

[0030] The valid state is a state in which the member can use the information processing system 10 without any problems, which is the so-called normal state.

[0031] The warning state is, for example, a state given to a member for whom an alert has been issued in various processes related to fraud prevention described below. An alert is issued to a member who is detected as being at risk of fraud. Note that even if the member is in the warning state, the member can still use the information processing system 10. However, based on the issued alert, the administrator of the server 1 can contact the relevant member (for example, by calling the member using a mobile phone number, etc.) to verify the member's identity. This allows the administrator to change the status flag to an active state, for example, if the suspicion of fraudulent activity regarding the purchase of an electronic gift certificate is resolved, or to change the status flag to an inactive state, for example, if the suspicion of fraudulent activity is not resolved.

[0032] The invalid state is, for example, a state given to a member who has been issued a suspension in various processes related to preventing fraudulent activities, which will be described later. The invalid state is issued to a member who is highly likely to have committed fraudulent activities. When a member is in the invalid state, he or she cannot use the information processing system 10. Based on the issued suspension, the administrator of the server 1 can contact the relevant member and verify the identity of the member who purchased the gift certificate. This allows the administrator to change the invalid state to a valid state or a warning state, for example, when suspicion of fraudulent activities regarding the purchase of an electronic gift certificate is resolved. Of course, if suspicion of fraudulent activities is not resolved, the status flag can remain in the invalid state.

[0033] The login date and time is information that is recorded when a member logs in to the information processing system 10. In other words, the date and time when the member most recently logged in to the information processing system 10 is recorded as the login date and time.

[0034] The purchase DB 16 is a database that records the purchase details when a member purchases an electronic gift certificate. The member DB 14 stores purchase data d16 that associates a member ID with purchase history information, as shown in FIG. 4(c).

[0035] Here, the purchase history information includes at least the purchase date and time, the purchase amount, etc. The purchase date and time is the date and time when the member purchased the electronic gift certificate, and the purchase amount when the member purchased the electronic gift certificate. The logged-in IP address (hereinafter also referred to as the login IP address) is the global IP address used for communication when the member logs in to the information processing system 10 using the user terminal 3. In this embodiment, the IP address of the user terminal 3 when the member purchased the electronic gift certificate is recorded.

[0036] The condition management DB17 is a database that stores condition values ​​for executing alert processing that issues an alert in various processes related to fraud prevention, which will be described later, and error processing that displays an error or issues a suspension. The condition management DB17 stores condition management data d17 that is configured with setting items for each day, setting items for each month, setting items for each IP address, setting items for all members, setting items for each hour, and the like, as shown in Fig. 5. The administrator of the server 1 can set each value of the condition management data d17 that triggers the execution of the alert processing and error processing on a management screen (not shown).

[0037] Here, the alert process is, for example, a process of sending an alert email indicating that an alert has been issued along with the contents of the alert to the administrator of server 1. When the alert process is executed, the status flag of the member status data d15 of the member who is the target of the alert becomes a warning status. By receiving this alert email, the administrator of server 1 can know that an alert has been issued for a specific member.

[0038] Error processing is a process in which an error display is output on the screen of the user terminal 3 and a suspension action email is sent to the administrator of the server 1 in various processes related to fraud prevention, which will be described later, along with the details of the error, indicating that a suspension action has been issued. When error processing is executed, the status flag in the member status data d15 of the member who has been suspended becomes invalid. By receiving this suspension action email, the administrator of the server 1 can know that a specific member has been suspended.

[0039] In detail, as shown in FIG. 5(a), the condition management DB17 may include condition management data d17 such as a daily purchase warning amount d17a and a daily purchase upper limit amount d17b as setting items on a daily basis. The daily purchase warning amount d17a is a threshold for determining whether or not to execute an alert process for the amount that a member purchases (or has purchased) in a day at the time of purchase or in batch processing, and the daily purchase upper limit amount d17b is a threshold for determining whether or not to execute an alert process or an error process for the amount that a member purchases (or has purchased) in a day at the time of purchase or in batch processing. For example, the daily purchase warning amount d17a may be 10,000 yen, and the daily purchase upper limit amount d17b may be 30,000 yen. The setting items on a daily basis are provided to detect large purchases by a single user.

[0040] Furthermore, as shown in FIG. 5(b), the condition management DB17 may include condition management data d17 such as a monthly purchase warning amount d17c and a monthly purchase upper limit amount d17d as setting items for each month. The monthly purchase warning amount d17c is a threshold for determining whether or not to execute an alert process for the amount purchased by one member in January at the time of purchase or in batch processing, and the monthly purchase upper limit amount d17d is a threshold for determining whether or not to execute an alert process or an error process for the amount purchased (or purchased) by one member in January. For example, the monthly purchase warning amount d17c may be 30,000 yen, and the monthly purchase upper limit amount d17d may be 100,000 yen. The setting items for each month are provided to detect large purchases by one user.

[0041] 5(c), the condition management DB17 may include condition management data d17 such as a purchase warning amount per IP d17e and a purchase upper limit amount per IP d17f as setting items for each IP address. The purchase warning amount per IP d17e is a threshold for determining whether or not to execute an alert process for the total purchase amount for each IP address in a predetermined time in batch processing, and the monthly purchase upper limit amount d17f is a threshold for determining whether or not to execute an alert process or an error process for the total purchase amount for each IP address in a predetermined time in batch processing. In this embodiment, the predetermined time is 30 minutes, but the predetermined time is not limited to 30 minutes and may be another value. The setting items for each IP address are provided to detect large-scale purchases by a group from one location.

[0042] Furthermore, as shown in FIG. 5(d), the condition management DB17 may include condition management data d17 such as a total purchase warning amount d17g and a total purchase upper limit amount d17h as setting items for the total purchase amount of all members. The total purchase warning amount d17g is a threshold for determining whether or not to execute an alert process for the total amount purchased by all members during a specified period at the time of purchase or in batch processing, and the monthly purchase upper limit amount d17h is a threshold for determining whether or not to execute an error process for the amount purchased by all members during a specified period at the time of purchase or in batch processing. Here, the specified time may be, for example, one hour. The administrator may also be able to set the specified time. The setting items for the total purchase amount of all members are provided to detect large-scale purchases by groups.

[0043] The IP address here refers to a global IP address, but is not limited to this, and a local IP address may be added to the global IP address to further limit the IP address. Alternatively, the IP address may be a local IP address, and the server 1 may be set to be able to obtain the location information of the user terminal 4, and the combination of the location information of the user terminal 4 and the local IP address may be set as the condition.

[0044] 5(e), the condition management DB17 may include condition management data d17 such as the 1-hour login member upper limit d17i, the 3-hour login member upper limit d17j, the 1-hour purchase member upper limit d17k, the 3-hour purchase member upper limit d17l, the 1-hour purchase upper limit amount reached member upper limit d17m, and the 3-hour purchase upper limit amount reached member upper limit d17h as setting items for each hour. The 1-hour login member upper limit d17i is a threshold for determining whether or not to execute an alert process for the number of members who have logged in to the information processing system 10 in 1 hour, and the 3-hour login member upper limit is a threshold for determining whether or not to execute an alert process for the number of members who have logged in to the information processing system 10 in 3 hours. The 1-hour purchase member upper limit d17k is a threshold for determining whether or not to execute an alert process for the number of members who have purchased an electronic gift certificate in 1 hour, and the 3-hour purchase member upper limit d17l is a threshold for determining whether or not to execute an alert process for the number of members who have purchased an electronic gift certificate in 3 hours. The upper limit number of members who have reached the upper limit amount of purchases in one hour d17m is a threshold value for determining whether or not to execute an alert process for the number of members whose purchase amount of electronic gift certificates in one hour has reached the upper limit amount A, and the upper limit number of members who have reached the upper limit amount of purchases in three hours d17n is a threshold value for determining whether or not to execute an alert process for the number of members whose purchase amount of electronic gift certificates in three hours has reached the upper limit amount B. In this embodiment, the time units are set to one hour and three hours, but the time units are not limited to these values ​​and may be other values. The upper limit amounts of purchases A and B may be fixed values ​​determined in advance or may be condition management data d17 that can be set by the administrator. The set value for the number of people per hour is set to detect large-scale logins and large-scale purchases by a group.

[0045] The storage unit 11 stores a program for implementing the functions of the control unit 12 of the server 1. The program is stored in a storage device configured, for example, of the server 1's Read Only Memory (ROM), Read Access Memory (RAM), or Hard Disk Unit (HDD). The program may also be recorded in a computer-readable recording medium. Examples of computer-readable recording media include a hard disk, a flexible disk, a Compact Disc Read Only Memory (CD-ROM), a Magneto Optical Disk (MO), and a Digital Versatile Disc Read Only Memory (DVD-ROM). The program may also be distributed via the communication network 5.

[0046] Functionally, the control unit 12 is configured to include a member registration unit 18, a login authentication unit 19, a gift certificate purchasing unit 20, a condition value setting unit 21, a fraud determination unit 22, an alert processing unit 23, and an error processing unit 24.

[0047] The member registration unit 18 is a function that registers the member information of a user when the user registers as a member in the information processing system 10. The member registration unit 18 registers the member information input by the user using the user terminal 3 in the member DB 14. The member information includes an email address, a password, a mobile phone number, personal identification information, credit card information, etc. (see FIG. 4(a)).

[0048] The login authentication unit 19 is a function that authenticates the legitimacy of a user when the user logs in to the information processing system 10. The login authentication unit 19 authenticates the legitimacy of the user by using the member information registered in the member DB 14, the email address and password entered by the user using the user terminal 3, and the pre-registered mobile phone number.

[0049] Based on the gift purchase information entered by the member, the gift certificate purchasing unit 20 registers the purchase details in the purchase DB 16. The gift purchase information includes the design of the electronic gift certificate, a message to the recipient, the purchase amount of the electronic gift certificate, and the like.

[0050] The condition value setting unit 21 is a function for setting condition values ​​for detecting fraudulent activities when purchasing an electronic gift certificate. The condition value setting unit 21 registers various condition values ​​in the condition management DB 17 by an administrator setting the various condition values ​​using a management screen. The various condition values ​​are setting items such as by day, by month, by IP address, by hour, etc. (see Figs. 5(a) to (e)).

[0051] The fraud determination unit 22 has a function of determining fraudulent activity using the condition value set by the condition value setting unit 21. The fraud determination unit 22 detects events that match an alert processing execution condition or an error processing execution condition depending on the level of the fraudulent activity. In particular, the fraud determination unit 22 according to this embodiment also functions as a collective fraud detection unit that can detect events related to the fraudulent activity of a criminal group based on collective fraud detection conditions.

[0052] In detail, the collective fraud detection unit detects fraudulent acts by multiple users based on a preset collective fraud detection condition. The collective fraud detection condition here uses user behavior information within a preset range. The user behavior information is the number of users. That is, in this embodiment, the threshold value of the collective fraud detection condition is set based on the number of users related to the behavior information. Note that the targets of collective fraud detection are not only members who have registered as members, but also members who have just registered as members and those who are in the process of registering as members, so when explaining collective fraud detection, members and non-members are collectively referred to as users.

[0053] The above-mentioned behavioral information is, for example, member registration information related to the number of users who register as members, and the collective fraud detection condition is set with a threshold value for the number of users related to the member registration information. The behavioral information is, for example, login behavior information related to the number of users who log in, and the collective fraud detection condition is set with a threshold value for the number of users related to the login behavior information. The behavioral information is, for example, purchase behavior information related to the number of users who purchase products, and the collective fraud detection condition is set with a threshold value for the number of users related to the purchase behavior information. Note that the behavior referred to here refers to the behavior of a user transmitting predetermined data from the user terminal 3 to the server 1, etc. in the information processing system 10 in order to perform various behaviors, and the number of users related to the behavioral information is calculated based on the transmission records of various behaviors.

[0054] In this embodiment, the behavioral information includes member registration information, login behavior information, and purchase behavior information, but is not limited to these, and may be other behavioral information that is the behavior of a user when using the gift certificate provision service according to this embodiment. For example, it may be member information change information regarding the number of users who change their member information. In this case, group fraud detection can be performed against group fraud such as organized crime, in which multiple pieces of member information are changed.

[0055] The above-mentioned preset range is a time-based period, an area based on location information, or a communication environment based on an IP address. A time-based period refers to a finite period of time, such as one hour. An area based on location information refers to a geographical area based on pre-set geographical information, such as an area that includes an event venue based on location information or an area that includes a building based on location information. An IP address-based communication environment refers to the same IP address.

[0056] As described above, collective fraud detection refers to detecting whether or not fraudulent input has been made using multiple user terminals 4 based on collective fraud detection conditions. Here, collective fraud detection is exemplified as collective fraud detection related to the number of users, with the number of users related to behavioral information being the target. In other words, the total amount of behavior of multiple users (accounts) is the subject of fraud detection.

[0057] On the other hand, individual fraud detection (hereinafter also referred to as individual fraud detection), which is different from collective fraud detection, detects fraudulent use at one user terminal 4. For example, individual fraud detection means detecting whether or not a purchase up to the purchase upper limit has been made within a period based on a preset time using one user terminal 4. In individual fraud detection, the target of fraud detection is not the amount of user behavior related to behavioral information, but the amount of purchases targeting the purchase upper limit, etc. In this way, collective fraud detection and individual fraud detection have different detection targets, and in order to detect collective fraud, it is difficult to detect fraud by only detecting the amount of purchases targeting the purchase upper limit, etc., and it is necessary to detect the amount of user behavior related to behavioral information.

[0058] Thus, the detection conditions for collective fraud detection and individual fraud detection are different, but there are also fraud detection conditions that relate to both collective fraud detection and individual fraud detection. For example, the number of user terminals 4 (users) that reach the upper purchase limit within a period based on a preset time (e.g., one hour) can be mentioned. In this case, the detection target is the amount of user behavior related to the behavior information plus the purchase amount, which allows for more accurate collective fraud detection.

[0059] The alert processing unit 23 executes alert processing when the fraud determination unit 22 detects an event that meets the alert processing execution conditions. The alert processing unit 23 according to this embodiment is configured to execute alert processing when an electronic gift certificate is purchased or during batch processing. The alert processing is, for example, processing to send an alert email indicating the content of the event, the target member, etc. to the administrator of the server 1. In addition, the status flag of the member status data d15 of the target member is set to a warning status.

[0060] Fig. 11(a) shows the content of the alert email when the amount of electronic gift certificates purchased per day by a member reaches the daily purchase limit d17b. Fig. 11(b) shows the content of the alert email when the number of members who logged in during the past hour is equal to or exceeds the hourly login member limit d17i. If the administrator would like to know more detailed information, the administrator can access the link in the email, which will display the relevant management screen, where the administrator can check the detailed information.

[0061] When the fraud determination unit 22 detects an event that meets the error processing execution condition, the error processing unit 24 executes the error processing. The error processing unit 24 according to the present embodiment is configured to execute the error processing when purchasing an electronic gift certificate or during batch processing. The error processing is, for example, a process of displaying an error on the user terminal 3 when a member purchases an electronic gift to notify the member that the purchase is not possible, disabling the target member from using the information processing system 10 when the target member logs in to the information processing system 10, or disabling the entire information processing system 10. Of course, even in this case, the error processing unit 24 sends, for example, a suspension disposition email indicating the content of the event, the target member, etc., to the administrator of the server 1. Also, the status flag of the member status data d15 of the target member is set to an invalid state.

[0062] In addition, the server 1 having the functions described above may be composed of a single physical device, or may be composed of a system in which multiple devices are connected to a network. If it is composed of multiple devices, they may all be installed in the same location, or may be installed in multiple locations.

[0063] <Operation of information processing system> Next, various types of processing related to preventing fraudulent activities in the information processing system 10 will be described with reference to FIGS.

[0064] Purchase Processing 6 is a flowchart showing the flow of the purchase process executed by the server 1. The purchase process is executed when a member purchases an electronic gift certificate.

[0065] First, the server 1 judges whether the daily purchase amount of electronic gift certificates of a member exceeds the daily purchase upper limit d17b (step S110). Here, the daily purchase amount of electronic gift certificates of a member is calculated based on the total purchase amount of the corresponding purchase data d16. The daily purchase upper limit d17b is obtained by referring to the condition management DB17.

[0066] If the member's daily electronic gift certificate purchase amount exceeds the daily purchase upper limit d17b (step S110: YES), the server 1 executes error process A (step S120). In error process A in step S120, an error message is displayed on the user terminal 3, informing the member that the member's daily electronic gift certificate purchase amount exceeds the daily purchase upper limit d17b and that the purchase is not possible. This prevents the member from purchasing an electronic gift certificate with the purchase details entered. On the other hand, if the member's electronic gift certificate purchase amount is equal to or less than the daily purchase upper limit d17b (step S110: NO), the process proceeds to step S130.

[0067] Although not shown in the flowchart of Fig. 6, in more detail, when the purchase amount of electronic gift certificates by one member per day is the daily purchase upper limit amount d17b, or when the purchase amount of electronic gift certificates by one member per day exceeds the daily purchase warning amount d17b, the server 1 may send an alert email to the administrator indicating the content of the event and the affected member (see Fig. 11(a)). This is to detect possible fraudulent activities in advance.

[0068] Next, the server 1 judges whether the purchase amount of electronic gift certificates for one member in one month exceeds the monthly purchase upper limit d17d (step S130). Here, the purchase amount of electronic gift certificates for one member in one month is calculated based on the total purchase amount of the corresponding purchase data d16. The monthly purchase upper limit d17d is obtained by referring to the condition management DB17.

[0069] If the member's electronic gift certificate purchase amount for one month exceeds the monthly purchase upper limit d17d (step S130: YES), the server 1 executes error process A (step S140). In error process A in step S140, an error message is displayed on the user terminal 3, and a notice is given that the member's cumulative electronic gift certificate purchase amount for one month exceeds the monthly purchase upper limit d17d and the purchase is not possible. This prevents the member from purchasing an electronic gift certificate with the purchase details entered. On the other hand, if the member's electronic gift certificate purchase amount for one month is equal to or less than the monthly purchase upper limit d17d (step S130: NO), the process proceeds to step S150.

[0070] Although not shown in the flowchart of Fig. 6, in more detail, when the purchase amount of the electronic gift certificate of the member is the monthly purchase upper limit amount d17d or exceeds the monthly purchase warning amount d17c, the server 1 may send an alert mail indicating the content of the event and the affected member to the administrator in order to detect the possibility of fraudulent activity in advance.

[0071] Next, the server 1 judges whether the total purchase amount of electronic gift certificates for all members in the last hour exceeds the total purchase upper limit d17h (step S150). Here, the total purchase amount of electronic gift certificates for all members in the last hour is calculated based on the total purchase amount of the corresponding purchase data d16. The total purchase upper limit d17h is obtained by referring to the condition management DB17.

[0072] If the total purchase amount of electronic gift certificates by all members in the last hour exceeds the total purchase upper limit d17h (step S150: YES), the server 1 executes error process B (step S160). In error process B in step S160, for example, the user terminal 3 is transitioned to a top screen, an error is displayed, and a notice is given that the information processing system 10 cannot be used. In addition, in error process B in step S160, for example, a suspension action email indicating the content of the event is sent to the administrator. This is because there is a very high probability of fraudulent activity by a group.

[0073] As described above, according to the purchase process of this embodiment, the purchase amount is checked when an electronic gift certificate is purchased, making it possible to prevent fraudulent activities.

[0074] Hourly batch processing Fig. 7 is a flowchart showing the flow of the hourly batch process executed by the server 1. The hourly batch process is a batch process executed every hour. For example, the execution time may be 00 minutes 00 seconds every hour. The hourly batch process shown in Fig. 7 is also a process for detecting fraudulent activities by groups.

[0075] The server 1 determines whether it is time to execute the hourly batch process (step S210). If it is time to execute the hourly batch process (step S210: YES), the server 1 executes the processes defined in steps S220 to S300, and if it is not time to execute the hourly batch process (step S210: NO), the server 1 returns to step S210.

[0076] If it is time to execute the hourly batch process (step S210: YES), first, the server 1 calculates the number of members who have logged in during the last hour and the last three hours (step S220). The number of members who have logged in during the last hour and the last three hours is calculated based on the login dates and times of the member status data d15 registered in the member status DB15.

[0077] The server 1 determines whether the number of members who have logged in during the last hour calculated in step S210 is greater than or equal to the one-hour login member upper limit number d17i, and whether the number of members who have logged in during the last three hours calculated in step S210 is greater than or equal to the three-hour login member upper limit number d17j (step S230).

[0078] If the number of logged-in members in the last hour calculated in step S220 is equal to or greater than the 1-hour login member upper limit number d17i (step S230: YES), or if the number of logged-in members in the last three hours calculated in step S220 is equal to or greater than the 3-hour login member upper limit number d17j (step S220: YES), the server 1 executes an alert process according to the relevant condition. In the alert process, an alert email (see FIG. 11(b)) indicating the content of the event that meets the condition is sent to the administrator. After executing the alert process, the process proceeds to step S250. By checking this alert email, the administrator can check the status of the information processing system 10 from the management screen and take action against the fraudulent activity. For example, if the likelihood of fraudulent activity by a group is extremely high, the use of the information processing system 10 by all members may be suspended.

[0079] On the other hand, if the number of members who have logged in during the last hour calculated in step S220 is less than the one-hour upper limit number of members who have logged in during the last hour d17i, and if the number of members who have logged in during the last three hours calculated in step S210 is less than the three-hour upper limit number of members who have logged in during the last three hours d17j (step S230: NO), the alert process is not executed and the process proceeds to step S250.

[0080] Next, the server 1 calculates the number of members who have purchased electronic gift certificates in the last hour and the last three hours (step S250). The number of members who have purchased electronic gift certificates in the last hour and the last three hours is calculated based on the purchase date and time of the purchase data d16 registered in the purchase DB16.

[0081] If the number of members who have purchased electronic gift certificates in the last hour calculated in step S250 is equal to or greater than the upper limit number of members purchasing electronic gift certificates in one hour d17k (step S260: YES), or if the number of members who have purchased electronic gift certificates in the last three hours calculated in step S250 is equal to or greater than the upper limit number of members purchasing electronic gift certificates in three hours d17l (step S260: YES), the server 1 executes an alert process according to the corresponding condition. In the alert process, an alert email indicating the content of the event that meets the condition is sent to the administrator. After executing the alert process, the process proceeds to step S280. By checking this alert email, the administrator can check the status of the information processing system 10 from the management screen and take action against the fraudulent activity. For example, if the likelihood of fraudulent activity by a group is extremely high, the use of the information processing system 10 by all members may be suspended.

[0082] On the other hand, if the number of members who have purchased electronic gift certificates in the last hour calculated in step S250 is less than the one-hour purchase limit d17k, and if the number of members who have purchased electronic gift certificates in the last three hours calculated in step S250 is less than the three-hour purchase limit d17l (step S260: NO), then the alert process is not executed and the program proceeds to step S280.

[0083] Next, the server 1 calculates the number of members who have reached the upper purchase limit A or B among the number of members who have purchased electronic gift certificates in the last hour and the last three hours (step S280). The number of members who have reached the upper purchase limit A or B in the last hour and the last three hours is calculated based on the purchase date and time and the purchase amount of the purchase data d16 registered in the purchase DB16.

[0084] The server 1 determines whether the number of members who have reached the purchase upper limit A in the last hour calculated in step S280 is equal to or greater than the upper limit number d17m of members who have reached the purchase upper limit in one hour, and whether the number of members who have reached the purchase upper limit B in the last three hours calculated in step S280 is equal to or greater than the upper limit number d17n of members who have reached the purchase upper limit in three hours (step S290).

[0085] If the number of members who have reached the purchase upper limit A in the last hour calculated in step S280 is equal to or greater than the upper limit number d17m of members who have reached the purchase upper limit in one hour (step S290: YES), or if the number of members who have reached the purchase upper limit B in the last three hours calculated in step S280 is equal to or greater than the upper limit number d17n of members who have reached the purchase upper limit in three hours (step S290: YES), an alert process is executed according to the corresponding condition (step S300). In the alert process, an alert email indicating the content of the event that meets the condition is sent to the administrator. After executing the alert process, the process returns to step S210. By checking this alert email, the administrator can check the status of the information processing system 10 from the management screen and take action against the fraudulent activity. For example, if the likelihood of fraudulent activity by a group is extremely high, the use of the information processing system 10 by all members may be stopped.

[0086] On the other hand, if the number of members who have purchased electronic gift certificates in the last hour calculated in step S280 is less than the upper limit number of members who have reached the one-hour purchase upper limit d17m, and if the number of members who have purchased electronic gift certificates in the last three hours calculated in step S280 is less than the upper limit number of members who have reached the three-hour purchase upper limit d17n (step S290: NO), then the alert process is not executed and the process returns to step S210.

[0087] In this embodiment, when a user registers as a member, the user is automatically logged in, so the number of people who have registered as members at a given time (number of registered members) is actually checked. However, the number of registered members for the last hour and last three hours may also be checked separately to check for the possibility of group fraud.

[0088] As described above, according to the hourly batch processing of this embodiment, an alert is issued based on the number of people who have used the information processing system 10 in the last few hours, making it possible to detect the possibility of group fraudulent activity at an early stage.

[0089] Daily batch processing 8 is a flowchart showing the flow of daily batch processing executed by the server 1. The daily batch processing is batch processing executed every day. For example, the execution time may be after midnight every day.

[0090] The server 1 determines whether it is time to execute the daily batch process (step S310). If it is time to execute the daily batch process (step S310: YES), the server 1 executes the processes defined in steps S320 to S340, and if it is not time to execute the daily batch process (step S310: NO), the server 1 returns to step S310.

[0091] If it is time to execute daily batch processing (step S310: YES), first, the server 1 calculates the purchase amount for each of the members for each day of the last three days (3 days ago, 2 days ago, 1 day ago) (step S320). The purchase amount for each of the members for each day of the last three days (3 days ago, 2 days ago, 1 day ago) is calculated based on the purchase date and time and purchase amount in the purchase data d16 registered in the purchase DB16.

[0092] Next, the server 1 extracts members whose purchase amounts are equal to the daily purchase limit amount d17b on all days of the most recent three days (all of the days three days ago, two days ago, and one day ago) (step S330), and executes an alert process for the extracted members (step S340). In the alert process, the status flag of the member status data d15 of the corresponding member is set to a warning state, and an alert email indicating the content of the event that meets the conditions is sent to the administrator. After executing the alert process, the process returns to step S310. The administrator can check the status of the information processing system 10 from the management screen by checking this alert email, and take action against the fraudulent activity.

[0093] As described above, according to the daily batch processing of this embodiment, an alert email is sent to the administrator indicating members who are making purchases close to the daily purchase limit even if they have not exceeded the daily purchase limit d17b, so that purchasers who are at high risk of committing fraud can be discovered early on.

[0094] Monthly batch processing 9 is a flowchart showing the flow of the monthly batch process executed by the server 1. The monthly batch process is executed once a month. For example, the execution time may be the first day of every month.

[0095] The server 1 determines whether it is time to execute the monthly batch process (step S410). If it is time to execute the monthly batch process (step S410: YES), the server 1 executes the processes defined in steps S420 to S440, and if it is not time to execute the monthly batch process (step S410: NO), the server 1 returns to step S410.

[0096] If it is time to execute monthly batch processing (step S410: YES), the server 1 first calculates the purchase amounts for each of the most recent two months (step S420) for all members. The purchase amounts for each of the most recent two months (step S420) are calculated based on the purchase dates and times and purchase amounts in the purchase data d16 registered in the purchase DB16.

[0097] Next, the server 1 extracts members whose purchase amounts are equal to the monthly purchase limit amount d17d in all of the most recent two months (all of the months before February and January) (step S430), and executes error processing for the extracted members (step S440). In the error processing, the status flag in the member status data d15 of the corresponding member is set to an invalid state, and the member is not allowed to use the information processing system 10. In addition, in the error processing, a suspension action email is sent to the administrator indicating the corresponding member and the details of the corresponding event. After executing the error processing, the process returns to step S310.

[0098] By checking this suspension email, the administrator can check the status of the information processing system 10 from the management screen and take action against the fraudulent activity. For example, if the administrator contacts the invalid member and the suspicion of the fraudulent activity is resolved, the invalid status may be changed to a valid status, or if the suspicion of the fraudulent activity is not resolved, the invalid status may be maintained.

[0099] In this manner, according to the monthly batch processing of the present embodiment, the use of a member who is making purchases close to the monthly purchase limit d17d can be automatically suspended, so that the spread of fraudulent acts can be prevented. Also, since a suspension mail indicating a member who is making purchases close to the limit, even if the monthly purchase limit d17d is not exceeded, can be sent to the administrator, purchasers who are highly likely to commit fraud can be discovered early on.

[0100] IP control batch processing FIG. 10 is a flowchart showing the flow of IP control batch processing executed by the server 1. The IP control batch processing is a batch processing executed at a predetermined cycle, and in this embodiment, it is executed once every 30 minutes. However, the predetermined cycle is not limited to 30 minutes, and may be, for example, one hour or one day. The predetermined cycle may also be variable and can be set by an administrator. In this case, it is desirable that the calculation period of the purchase amount, which will be described later, is also changed according to the cycle.

[0101] The server 1 determines whether it is time to execute the IP control batch process (step S510). If it is time to execute the IP control batch process (step S510: YES), the server 1 executes the processes defined in steps S520 to S560, and if it is not time to execute the IP control batch process (step S510: NO), the server 1 returns to step S510.

[0102] If it is time to execute the IP control batch process (step S510: YES), the server 1 first calculates the purchase amount for the last 30 minutes for each IP address (step S520). The purchase amount for the last 30 minutes for each IP address is calculated based on the purchase date and time, purchase amount, and login IP address of the purchase data d16 registered in the purchase DB 16.

[0103] Members corresponding to IP addresses whose purchase amounts for the most recent 30 minutes for each IP address calculated in step S520 exceed the purchaser warning amount per IP d17e and are equal to or less than the purchaser upper limit amount per IP d17f are extracted (step S530), and an alert process is executed for the extracted members (step S540). In the alert process, the status flag of the member status data d15 of the corresponding member is set to a warning status, and an alert email indicating the contents of the event that met the conditions is sent to the administrator. After executing the alert process, the process proceeds to step S550. The administrator can check the status of the information processing system 10 from the management screen by checking this alert email, and take action against the fraudulent activity.

[0104] Members corresponding to IP addresses whose purchase amounts for the last 30 minutes for each IP address calculated in step S520 exceed the purchaser upper limit amount per IP d17f are extracted (step S550), and error processing is performed for the extracted members (step S560). In the error processing, the status flag of the member status data d15 of the corresponding member is set to an invalid state, and the use of the information processing system 10 is disabled. In addition, in the error processing, a suspension action email is sent to the administrator indicating the corresponding member and the details of the corresponding event. After the error processing is performed, the process returns to step S510.

[0105] By checking this suspension email, the administrator can check the status of the information processing system 10 from the management screen and take action against the fraudulent activity. For example, if the administrator contacts the invalid member and the suspicion of the fraudulent activity is resolved, the invalid status may be changed to a valid status, or if the suspicion of the fraudulent activity is not resolved, the invalid status may be maintained.

[0106] In this way, the IP batch processing according to the present embodiment can automatically halt the use of members who exceed the upper limit of purchase amount for each IP address, thereby preventing the spread of fraudulent acts by groups from the same location. Also, if a situation occurs where the purchase warning amount for each IP address is exceeded, an email can be sent to the administrator, making it possible to quickly discover purchasers who are highly likely to be committing fraudulent acts by groups from the same location.

[0107] As described above, according to the information processing system 10, the server 1 executes various processes related to fraud prevention (e.g., purchase processing, hourly batch processing, daily batch processing, monthly batch processing, IP control batch processing), so that fraudulent activities by organizations can be detected in a simple manner. As a result, fraudulent activities by organizations can be prevented as much as possible, and the spread of fraudulent activities by organizations can be prevented as much as possible.

[0108] In addition, according to the information processing system 10, when alert processing or error processing is performed, an email is issued to the administrator, so that the administrator can understand the status of the information processing system 10 and deal with any misconduct by the organization.

[0109] Furthermore, according to the information processing system 10, a member can only register one email address, one mobile phone number, and one credit card information, and the email address, mobile phone number, and credit card information are not permitted to overlap with those of other members, so that fraudulent activities by organizations can be prevented in advance based on the membership rules.

[0110] - Application to other information processing systems In the above embodiment, an example in which the fraud prevention function of the present invention is applied to the information processing system 10 that provides a gift certificate provision service has been described, but the information processing system 10 to which the fraud prevention function of the present invention is applied is not limited to this. The fraud prevention function of the present invention is applicable to all information processing systems 10 that purchase predetermined products or services in electronic commerce. It is particularly suitable for electronic commerce that handles values ​​that can be converted into cash electronically.

[0111] Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments, and various modifications and changes can be made to the embodiments of the present invention without departing from the gist of the present invention, and configurations involving such modifications and changes are also included in the technical scope of the present invention. [Explanation of symbols]

[0112] 1 Server 2. Credit card payment system 3,4 User terminal 5. Communication Network 11 Storage section 12 Control section 13. Communications Department 14 Membership Database 15 Membership status DB 16 Purchase DB 17 Condition management DB 18 Membership Registration Department 19 Login authentication section 20 Gift Certificate Purchase Department 21 Condition value setting section 22 Fraud Determination Department 23 Alert Processing Section 24 Error handling section

Claims

1. A fraud detection device that detects fraudulent behavior by a user who purchases a specific product or service (hereinafter referred to as a "product") in electronic commerce, comprising: a first fraud determination unit that detects fraudulent activity based on the purchase amounts of all users who purchased the product during a predetermined first period; a second fraud determination unit that detects fraudulent activity based on the purchase amounts of all users who purchased the product during a second predetermined period and accessed from the same IP address; a third fraud determination unit that detects fraudulent activity based on the number of users who purchased the product during a third predetermined period; A fraud detection device comprising:

2. The fraud detection device according to claim 1 , wherein the third fraud determination unit detects fraudulent activity based on the number of users who logged in during the third period.

3. A member information registration unit that registers identification information and payment information that can uniquely identify a user as member information, The fraud detection device according to claim 1 , wherein the third fraud determination unit detects fraudulent activity based on the number of users who registered as members during the third period.

4. The fraud detection device according to claim 1 , wherein the third fraud determination unit detects fraudulent activity based on the number of users who have purchased the products during the third period and who have reached a predetermined upper purchase limit amount.

5. The fraud detection device according to any one of claims 1 to 4, further comprising an alert processing unit that executes an alert process to output an alert notification indicating the basis for the judgment and the target user when the first fraud judgment unit, the second fraud judgment unit, or the third fraud judgment unit judges that there is a risk of fraudulent activity.

6. A fraud detection device as described in any one of claims 1 to 5, further comprising an error processing unit that, when the first fraud judgment unit, the second fraud judgment unit, or the third fraud judgment unit judges that the likelihood of fraudulent activity is extremely high, executes error processing that prevents the target user from using the system and outputs a suspension notice indicating the basis for the judgment and the target user.

7. further comprising a period setting unit capable of setting the first period, the second period, and the third period; The fraud detection device according to claim 1 , wherein the period setting unit is capable of setting one or a plurality of types of periods for each of the first period, the second period, and the third period.

8. An information processing device that detects fraudulent behavior of a user who purchases a predetermined product or service (hereinafter referred to as a "product") in electronic commerce, a first fraud determination process for detecting fraudulent activity based on the purchase amounts of all users who purchased the product during a predetermined first period; a second fraud determination process for detecting fraudulent activity based on the purchase amounts of all users who purchased the product during a second predetermined period and accessed from the same IP address; a third fraud determination process for detecting fraudulent activity based on the number of users who purchased the product during a third predetermined period; A fraud detection method that performs

9. An information processing device that detects fraudulent behavior by a user who purchases a predetermined product or service (hereinafter referred to as "product") in electronic commerce, a first fraud determination process for detecting fraudulent activity based on the purchase amounts of all users who purchased the product during a predetermined first period; a second fraud determination process for detecting fraudulent activity based on the purchase amounts of all users who purchased the product during a second predetermined period and accessed from the same IP address; a third fraud determination process for detecting fraudulent activity based on the number of users who purchased the product during a third predetermined period; A fraud detection program that runs

Images