Payment system, payment method, and program

Abstract

To enhance the convenience of a user of a settlement service while reducing the risk of the settlement service.SOLUTION: A user information acquisition unit (101) of a settlement system (1) acquires user information related to a user of a settlement service for performing a settlement based on electronic settlement means. A risk rating information acquisition unit (102) acquires risk rating information regarding the risk rating of the user in the settlement service on the basis of the user information. A service provision unit (103) provides the settlement service to the user on the basis of the risk rating information.SELECTED DRAWING: Figure 3

Description

Technical Field

[0001] The present disclosure relates to a payment system, a payment method, and a program.

Background Art

[0002] Conventionally, a payment service in which payments are made based on electronic payment means is known. In the payment service, various risks such as money laundering may occur. For example, Patent Document 1 describes a communication system that prevents unauthorized withdrawals by causing an ATM to accept an operation of inputting information for user identification when a user who has not performed user identification in the payment service performs an operation to withdraw money from the balance of their electronic money at an ATM.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] However, although various users use the payment service, the communication system of Patent Document 1 uniformly prohibits withdrawals for all users until user identification is successful, so the convenience of users cannot be improved. This is the same for payment services other than the payment service in which the communication system of Patent Document 1 is used. For this reason, there is a demand to increase the convenience of users using the payment service while reducing the risks in the payment service.

[0005] One of the objects of the present disclosure is to increase the convenience of users using the payment service while reducing the risks in the payment service.

Means for Solving the Problems

[0006] The settlement system according to the present disclosure includes a user information acquisition unit that acquires user information regarding a user who uses a settlement service in which settlement based on an electronic settlement means is performed, a risk rating information acquisition unit that acquires risk rating information regarding the risk rating of the user in the settlement service based on the user information, and a service providing unit that provides the settlement service to the user based on the risk rating information.

Effect of the Invention

[0007] The present disclosure can enhance the convenience of users who use the settlement service while reducing the risk in the settlement service.

Brief Description of the Drawings

[0008]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Mode for Carrying Out the Invention

[0009] [1. Hardware Configuration of Payment System] An example of an embodiment of a payment system, a payment method, and a program according to the present disclosure will be described. FIG. 1 is a diagram showing an example of the hardware configuration of a payment system. For example, the payment system 1 includes a server 10 and a user terminal 20. Each of the server 10 and the user terminal 20 is connected to a network N such as the Internet or a LAN.

[0010] The server 10 is a server computer. For example, the server 10 includes a control unit 11, a storage unit 12, and a communication unit 13. The control unit 11 includes at least one processor. The storage unit 12 includes at least one of a volatile memory such as a RAM and a non-volatile memory such as a flash memory. The communication unit 13 includes at least one of a communication interface for wired communication and a communication interface for wireless communication.

[0011] The user terminal 20 is a user's computer. For example, the user terminal 20 is a smartphone, a tablet, a personal computer, or a wearable terminal. The user terminal 20 includes a control unit 21, a storage unit 22, a communication unit 23, an operation unit 24, a display unit 25, and a photographing unit 26. The hardware configurations of the control unit 21, the storage unit 22, and the communication unit 23 may be the same as those of the control unit 11, the storage unit 12, and the communication unit 13, respectively. The operation unit 24 is an input device such as a touch panel or a mouse. The display unit 25 is a display such as a liquid crystal or an organic EL. The photographing unit 26 includes at least one camera.

[0012] Note that the programs stored in the storage units 12 and 22 may be supplied to the server 10 or the user terminal 20 via the network N. Further, at least one of a reading unit (e.g., a memory card slot) that reads a computer-readable information storage medium and an input / output unit (e.g., a USB port) for inputting / outputting data to / from an external device may be included in the server 10 or the user terminal 20. For example, a program stored in the information storage medium may be supplied to the server 10 or the user terminal 20 via at least one of the reading unit and the input / output unit.

[0013] Also, the payment system 1 may include at least one computer. The computer included in the payment system 1 is not limited to the example of FIG. 1. For example, the payment system 1 may include only the server 10. In this case, the user terminal 20 exists outside the payment system 1. For example, the payment system 1 may include the server 10 and another computer not shown in FIG. 1.

[0014] [2. Overview of the Payment System] In this embodiment, the user operates the user terminal 20 to use the payment service. The payment service is a service in which payment based on electronic payment means is performed. The payment service is a service different from financial services provided by financial institutions such as banks. The operator that operates the payment service is a person different from financial institutions such as banks.

[0015] The payment means is a means available for the user to make a payment. The payment means may be a known means. For example, the payment means may be electronic money, points, a credit card, cryptocurrency, a debit card, a wallet, an account, or other means. The payment means may also be referred to as a payment method. The payment in the payment service may also be called electronic payment or cashless payment.

[0016] For example, take the case where a user uses a payment service with a payment app installed on the user terminal 20. The payment app is an application provided by an operator who operates the payment service. When the user installs the payment app on the user terminal 20 and registers as a member of the payment service, the user can use the payment service. When the user completes the membership registration and launches the payment app, the user terminal 20 causes the display unit 25 to display the screen of the payment app.

[0017] Figure 2 is a diagram showing an example of the screen displayed on the user terminal 20. For example, when the payment app is launched, as shown in the upper left of Figure 2, the user terminal 20 causes the display unit 25 to display a code screen SC1 showing a code C10 generated based on a code ID that can temporarily identify the user. When the code C10 is read by a terminal such as a POS terminal or a handy terminal of a member (for example, a store handling goods or services) who joins the payment service, payment is executed based on the code ID obtained from the code C10. The processing for payment may be a known process.

[0018] In the example of Figure 2, the user has set electronic money as the payment source. The user can charge the electronic money based on a credit card or the like registered in the payment app. The processing for charging the electronic money may be a known process. In this embodiment, the case where the user uses online-type electronic money is taken as an example, but the electronic money may be of any type. For example, the electronic money may be of a type that uses the IC chip of the user terminal 20, or a type that uses an IC card or a magnetic card.

[0019] In this embodiment, when the user performs identity verification with the payment service, the user can withdraw electronic money. For example, when the user selects button B11, as shown in the upper right of FIG. 2, the user terminal 20 causes the display unit 25 to display a reception screen SC2 for receiving the input of user identity information regarding the user himself / herself. The user identity information is information input by the user at the time of identity verification or at any subsequent timing. For example, the user identity information is the user's personal information, the user's demographic information, the user's asset information, or other information.

[0020] For example, the user inputs at least one of nationality, visa status, visa expiration date, occupation, industry, purpose of using the payment service, business, etc., assets, income, and source of funds as the user identity information into the input form F20. The user may be allowed to omit the input of some items. When the user inputs the user identity information, the user terminal 20 uploads the user identity information to the server 10. When the user identity information is uploaded, as shown in the lower left of FIG. 2, the user terminal 20 causes the display unit 25 to display a shooting screen SC3 for shooting the identity verification document and the face photo.

[0021] The identity verification document is a document for identity verification. The identity verification document may be a document used for known identity verification. For example, the identity verification document may be a driver's license, a personal number card, a residence card, a passport, or other documents. In this embodiment, the case where the identity verification document is a document with a face photo is taken as an example, but the identity verification document may be a document without a face photo. When the user selects button B30 to select the identity verification document, the shooting unit 26 is activated.

[0022] For example, when the user takes pictures of the identity document and their own face with the imaging unit 26, the user terminal 20 uploads a document image indicating the identity document and a face image indicating the user's face to the server 10. When the document image and the face image are uploaded, as shown in the lower right of FIG. 2, the user terminal 20 causes the display unit 25 to display a completion screen SC4 indicating that the upload of the information necessary for identity verification has been completed. Identity verification is performed based on the user's personal information, document image, and face image uploaded to the server 10.

[0023] Note that the flow of identity verification may be the same as the flow adopted in various known services. For example, identity verification may be performed by visual confirmation by an operator of a payment service, or may be performed by an identity verification program. Also, the order of uploading the user's personal information and the document image and face image may be reversed. These uploads may be performed as separate procedures instead of a series of procedures.

[0024] In this embodiment, when identity verification is completed, the user can withdraw electronic money. For example, the user can withdraw the electronic money sent from another user or receive their salary in electronic money and then withdraw it, which improves the convenience for the user. On the other hand, a malicious user may use functions such as sending and withdrawing electronic money for purposes such as money laundering. For example, a user belonging to an organization such as an anti-social force may also violate the terms of use of the payment service. Various other risks may occur in the payment service.

[0025] Therefore, the payment system 1 of this embodiment performs a risk rating for each user based on the user's personal information and the like. The risk rating is information indicating the degree of risk. Details of the risk rating will be described later. By performing a risk rating for each user, the payment system 1 reduces the risk in the payment service while enhancing the convenience of users who use the payment service. Hereinafter, the details of the payment system 1 will be described.

[0026] [3. Functions Implemented by the Payment System] FIG. 3 is a diagram showing an example of functions implemented by the payment system 1.

[0027] [3-1. Functions Implemented by the Server] For example, the server 10 includes a data storage unit 100, a user information acquisition unit 101, a risk rating information acquisition unit 102, and a service provision unit 103. The data storage unit 100 is realized by the storage unit 12. Each of the user information acquisition unit 101, the risk rating information acquisition unit 102, and the service provision unit 103 is realized by the control unit 11. The server 10 or each unit can be configured by integrating them into one device or further dispersing the devices more finely.

[0028] [Data Storage Unit] The data storage unit 100 stores data necessary for the payment service. For example, the data storage unit 100 stores a user database DB1, an individual determination database DB2, and a comprehensive determination database DB3.

[0029] FIG. 4 is a diagram showing an example of a user database DB1. The user database DB1 is a database in which various types of information related to users are stored. For example, the user database DB1 stores a user ID, a password, a code ID, payment means information, identity verification information, user information, and risk rating information. Other data may be stored in the user database DB1. For example, the user database DB1 may store payment source information related to the payment means set by the user as a payment source, or charge source information related to the payment means set by the user as a charge source for electronic money.

[0030] The user ID is an example of user identification information that can identify a user. Separate from the user ID, there may be a login account. The login account may be allowed to be freely changed by the user. The password is information that is confirmed at the time of login. The code ID is also an ID that can identify the user in the payment service. The code ID is updated each time the code C10 is displayed. The payment means information is information that can identify the payment means available to the user in the payment service. For example, the payment means information is information such as a credit card number, information such as an electronic money number, or information such as the remaining balance of a point card number.

[0031] The identity verification information is information related to identity verification. For example, the identity verification information indicates whether identity verification has been completed. The identity verification information may indicate the status of identity verification. For example, the status of identity verification may be that document images and face images have been uploaded, waiting for identity verification on the payment service side, completion of identity verification, or other status. The server 10 updates the status indicated by the identity verification information based on the progress of identity verification.

[0032] User information is information about the user. In the present embodiment, the user information is information that correlates with the risk of the user violating the terms of use of the payment service. The user information can also be said to be information input into a risk rating program that determines a risk rating. The risk rating program is a program that determines the risk rating of a user when the user information of a certain user is input. In the present embodiment, cases where each of the user's personal information and the user's usage information corresponds to the user information will be taken as examples.

[0033] User's personal information is information about the user himself / herself. The user's personal information is static information that has nothing to do with the user's use of the payment service. In the present embodiment, an example is a case where the user himself / herself inputs the user's personal information. The user's personal information does not have to be information input by the user. The user's personal information may be information investigated by an investigation agency that investigates the user. For example, the user's personal information indicates at least one of nationality, visa status, period of stay, occupation, industry, purpose of using the payment service, business, etc., assets, income, source of funds, and income certificate.

[0034] User usage information is information related to the user's use of the payment service. The user usage information is dynamic information obtained in response to the user's use of the payment service. The use of the payment service is the execution of the functions that the payment service has. The execution of a payment is an example of the use of the payment service. The execution of a payment may also be called appropriation. The use of the payment service is not limited to the execution of a payment. For example, the recharge of electronic money, the transfer of electronic money, the receipt of electronic money, the withdrawal of electronic money, the grant of electronic money, the grant of points, or the operation on a payment application may correspond to the use of the payment service. The user usage information can also be said to be the user's usage history of the payment service or information indicating the usage history.

[0035] For example, when the execution of a settlement corresponds to the use of a settlement service, the user usage information indicates at least one of the settlement amount, the settlement date and time, the settlement location, and the settlement means information of the settlement means used in the settlement. When the recharge of electronic money corresponds to the use of a settlement service, the user usage information indicates at least one of the recharge amount, the recharge date and time, and the settlement means information of the settlement means used in the recharge.

[0036] For example, when the transfer of electronic money corresponds to the use of a settlement service, the user usage information indicates at least one of the transfer amount, the transfer date and time, and the user ID of the recipient. When the receipt of electronic money corresponds to the use of a settlement service, the user usage information indicates at least one of the receipt amount, the receipt date and time, and the user ID of the remitter. When the withdrawal of electronic money corresponds to the use of a settlement service, the user usage information indicates at least one of the withdrawal amount, the withdrawal date and time, and the withdrawal location. The user usage information may be other information related to the use of the settlement service.

[0037] For example, when a certain user inputs the user's own information, the server 10 stores the user's own information in the user database DB1 in association with the user ID of the user. The server 10 may update the user's own information based on the investigation results from an investigation institution that investigates a certain user. When a certain user uses a settlement service, the server 10 generates user usage information. The server 10 stores the user usage information in the user database DB1 in association with the user ID of the user.

[0038] The risk rating information is information related to risk rating. The risk rating information may be information indicating the degree of risk. In the present embodiment, a case where the risk rating information is expressed by a character indicating the degree of risk is taken as an example, but the risk rating information may be a numerical value (score) indicating the degree of risk. In this case, the higher the numerical value of the risk rating information, the higher the risk. When the risk rating information acquisition unit 102 described later acquires the risk rating information of a certain user, the risk rating information is stored in the user database DB1 in association with the user ID of the user.

[0039] FIG. 5 is a diagram showing an example of the individual determination database DB2. The individual database is a database showing the relationship between the level for determining the final risk rating and at least one of the user's personal information and the user's usage information. In the example of FIG. 5, both the user's personal information and the user's usage information are shown in the individual determination database DB2. Only either the user's personal information or the user's usage information may be shown in the individual determination database DB2.

[0040] The level is an example of an index indicating the user's risk. The level is an intermediate index used for determining the final risk rating. In the example of FIG. 5, the level is in four stages: "VH" (Very High), "H" (High), "M" (Middle), and "L" (Low). The level may be any number of stages. For example, the level may be two stages or three stages, or five or more stages. The level may be expressed by a numerical value or other symbols instead of letters.

[0041] For example, the individual determination database DB2 shows the personal conditions that are conditions related to the user's personal information. In the example of FIG. 5, the personal conditions show two items: the user's attributes and the user's country / region. The personal conditions are conditions that can be determined based on the value shown by the user's personal information or the presence or absence of the user's personal information. For example, at least one of the following may correspond to the personal conditions: the user's nationality is a predetermined nationality, the user's residence status is a predetermined type, the user's period of stay is a predetermined period, the user's occupation is a predetermined occupation, the user's industry is a predetermined industry, the purpose of using the payment service is a predetermined purpose, the user's business, etc. is a predetermined business, etc., the user's assets are a predetermined amount of assets, the user's income is a predetermined income, and the user's source of funds is a predetermined source of funds. In the example of FIG. 5, the user's personal information shows two items: attributes and country / region. Personal conditions are defined for each item.

[0042] For example, the individual determination database DB2 shows usage conditions, which are conditions related to user usage information. The usage conditions are conditions that can be determined based on the values indicated by the user usage information or the presence or absence of the user usage information. For example, at least one of the following may correspond to the usage conditions: a predetermined settlement is made, a predetermined charge is made with electronic money, a predetermined remittance is made with electronic money, a predetermined receipt is made with electronic money, a predetermined withdrawal is made with electronic money, and a predetermined operation is performed on the settlement application. The usage conditions may also be other conditions, such as whether fraud has been detected by a fraud detection model that detects fraud based on user usage information.

[0043] FIG. 6 is a diagram showing an example of the comprehensive determination database DB3. The comprehensive determination database DB3 is a database showing the relationship between the combination of levels determined from each of the user personal information and the user usage information and the risk rating information indicating the final risk rating. In the example of FIG. 6, the user personal information shows two items: the user's attributes and the user's country / region. A level is shown for each item. Therefore, the relationship between the combination of the three levels determined from the attributes of the user personal information, the level determined from the country / region of the user personal information, and the level determined from the user usage information, and the final risk rating is defined in the comprehensive determination database DB3.

[0044] Note that the data stored in the data storage unit 100 is not limited to the above example. The data storage unit 100 may store data necessary for the settlement service. For example, the data storage unit 100 may store data of various screens displayed on the settlement application.

[0045] [User Information Acquisition Unit] The user information acquisition unit 101 acquires user information regarding a user who uses a payment service in which payment is made based on an electronic payment means. In the present embodiment, the user information acquisition unit 101 acquires at least one of user personal information regarding the user himself / herself and user usage information regarding the use of the payment service by the user as user information. For example, the user information acquisition unit 101 acquires the user personal information and the user usage information as user information. In the present embodiment, since the user personal information and the user usage information are stored in the user database DB1, the user information acquisition unit 101 acquires each of the user personal information and the user usage information from the user database DB1.

[0046] In addition, when the user personal information and the user usage information are stored in a database other than the user database DB1, the user information acquisition unit 101 may acquire each of the user personal information and the user usage information from the other database. When the user personal information and the user usage information are stored in a computer other than the server 10 or an external information storage medium, the user information acquisition unit 101 may acquire each of the user personal information and the user usage information from the other computer or the external information storage medium.

[0047] [Risk rating information acquisition unit] The risk rating information acquisition unit 102 acquires risk rating information regarding the risk rating of the user in the payment service based on the user information. The risk rating information acquisition unit 102 can acquire the risk rating information at an arbitrary timing. It is assumed that the relationship data indicating the relationship between the user information and the risk rating information is stored in the data storage unit 100. The risk rating information acquisition unit 102 acquires the risk rating information associated with the user information based on the relationship data. In the present embodiment, the case where the individual determination database DB2 and the comprehensive determination database DB3 correspond to the relationship data is taken as an example.

[0048] Note that the related data is not limited to the individual determination database DB2 and the comprehensive determination database DB3. For example, the related data may be data that shows only the relationship between the user's personal information and the risk rating information without showing the user usage information. Conversely, the related data may be data that shows only the relationship between the user usage information and the risk rating information without showing the user's personal information. The related data may be any data as long as the relationship between the user information, such as the user's personal information and the user usage information, and the risk rating information is defined.

[0049] Also, the related data may be in any data format. The related data is not limited to data in a table format (database format) such as the individual determination database DB2 and the comprehensive determination database DB3. For example, the related data may be data of a machine learning model in which training data showing the relationship between the training user information and the training risk rating information has been learned. In this case, the risk rating information acquisition unit 102 inputs the user information of the user to be estimated to the learned machine learning model and acquires the risk rating information output from the machine learning model.

[0050] For example, the related data may be a program that is not a machine learning model, but a risk rating program prepared for obtaining risk rating information. In this case, the user information is input as an argument to the risk rating program. The risk rating program includes code that outputs risk rating information based on the user information. The risk rating information acquisition unit 102 uses the user information of the user to be estimated as an argument of the risk rating program and acquires the risk rating information based on the code of the risk rating program.

[0051] In this embodiment, since at least one of the user's personal information and the user's usage information is acquired as user information, the risk rating information acquisition unit 102 acquires risk rating information based on at least one of the user's personal information and the user's usage information. Furthermore, in this embodiment, since both the user's personal information and the user's usage information are acquired as user information, the risk rating information acquisition unit 102 acquires risk rating information based on the user's personal information and the user's usage information.

[0052] For example, the risk rating information acquisition unit 102 determines whether the personal conditions shown in the individual determination database DB2 are satisfied based on the user's personal information. In this embodiment, since the user's personal information has two items, namely the user's attributes and the user's country / region, the risk rating information acquisition unit 102 determines whether the personal conditions of each of these two items are satisfied. The risk rating information acquisition unit 102 acquires the level associated with the personal conditions satisfied by the user's personal information.

[0053] For example, the risk rating information acquisition unit 102 determines whether the usage conditions shown in the individual determination database DB2 are satisfied based on the user's usage information. The risk rating information acquisition unit 102 acquires the level associated with the usage conditions satisfied by the user's usage information. The risk rating information acquisition unit 102 acquires risk rating information associated with a combination of three levels, such as the level corresponding to the user's attributes, the level corresponding to the user's country / region, and the level corresponding to the user's usage information, based on the comprehensive determination database DB3.

[0054] Note that it is also possible that only one of the user's personal information or the user's usage information is acquired. For example, even if both the user's personal information and the user's usage information are acquired, there may not be enough information acquired for the risk rating determination. In this case, the risk rating information acquisition unit 102 may acquire risk rating information by executing a first determination process related to risk rating based on either one of the user's personal information and the user's usage information.

[0055] For example, a user who has just started using a payment service may have no user usage information or may not have obtained sufficient user usage information. If the user skips entering their personal information, there may be no personal information or insufficient personal information may have been obtained. Further, when the risk rating information acquisition unit 102 acquires risk rating information based on the user usage information after the risk rating mechanism of the present embodiment is introduced, even if the user has used the payment service to a certain extent, sufficient user usage information may not have been obtained. Here, the post-service flow will be described as an example.

[0056] FIG. 7 is a diagram showing an example of the post-service flow of the risk rating mechanism. As shown in FIG. 7, after the service is installed, the payment system 1 guides the user to update their personal information. If the user updates their personal information by the deadline (the deadline for updating / guiding the user's personal information) a predetermined time after the service is installed, the risk rating information acquisition unit 102 tentatively sets the level corresponding to the user usage information to "M" and acquires the risk rating information. Then, when the deadline arrives, the risk rating information acquisition unit 102 acquires the level corresponding to the user usage information at that time and acquires the risk rating information. Note that the risk rating information is to be acquired based on the user usage information indicating usage after the service is installed, but it may also be acquired based on the user usage information indicating usage before the service is installed.

[0057] On the other hand, for a user who has not updated their personal information by the deadline, the risk rating information acquisition unit 102 tentatively sets the level corresponding to the user's personal information as "M". The risk rating information acquisition unit 102 acquires risk rating information based on the tentatively set level and the level corresponding to the user usage information indicating the user's usage when the deadline arrives. Thereafter, when the user updates their personal information, the risk rating information acquisition unit 102 acquires the level corresponding to the updated user personal information and acquires the risk rating information. When the user does not update their personal information, a payment service corresponding to the risk rating information acquired tentatively is provided to the user. Thereafter, when a predetermined update deadline arrives, the user may be requested to update their personal information.

[0058] For example, the risk rating information acquisition unit 102 executes a first determination process based on either one of the user personal information and the user usage information and predetermined information. The predetermined information is temporary information used until the other of the user personal information and the user usage information is acquired. In the example of FIG. 7, the tentatively set level corresponds to the predetermined information. The predetermined information may be not the tentatively set level but temporary user personal information or temporary user usage information. The temporary user personal information is user personal information in which all or some of the items of the user personal information are fixed values. The temporary user usage information is user usage information in which all or some of the items of the user usage information are fixed values. The first determination process is a process for determining a tentative risk rating. For example, the first determination process is a process for determining a risk rating as an initial value.

[0059] For example, a user who has just registered as a member may have personal information but may not have or may not have sufficient usage information. In the example of FIG. 7, a user who registered their personal information immediately after service entry may not have or may not have sufficient usage information. In this case, the risk rating information acquisition unit 102 acquires two levels based on the user's personal information. The risk rating information acquisition unit 102 sets the level corresponding to the usage information to a temporary value (for example, "M"). The level indicating the temporary value corresponds to the predetermined information. The risk rating information acquisition unit 102 acquires risk rating information corresponding to these three levels.

[0060] For example, if a user can skip or omit the registration of their personal information during identity verification, a user who has skipped or omitted the registration of their personal information may have usage information but may not have or may not have sufficient personal information. In this case, the risk rating information acquisition unit 102 acquires a level based on the usage information. The risk rating information acquisition unit 102 sets the two levels corresponding to the personal information to a temporary value (for example, "M"). The level indicating the temporary value corresponds to the predetermined information. The risk rating information acquisition unit 102 acquires risk rating information corresponding to these three levels.

[0061] For example, when a predetermined condition is satisfied in the payment service, the risk rating information acquisition unit 102 updates the risk rating information by executing a second determination process related to risk rating based on the other information of the user's personal information and the user's usage information. The predetermined condition is a condition that triggers the second determination process. For example, the risk rating information acquisition unit 102 determines whether the predetermined condition is satisfied by determining whether the other information has been acquired in the payment service. That is, the acquisition of the other information may correspond to the satisfaction of the predetermined condition. For example, the risk rating information acquisition unit 102 executes the second determination process when the other information indicating a value corresponding to the user is acquired. The second determination process is a process for the final risk rating determination. For example, the second determination process is a process for the risk rating determination that is not the initial value.

[0062] For example, the risk rating information acquisition unit 102 may determine whether a predetermined condition is satisfied by determining whether a predetermined period has elapsed in the payment service. That is, the elapse of a predetermined period may correspond to the satisfaction of a predetermined condition. The predetermined period is a period that triggers the second determination process. For example, the visit of a predetermined date and time, the visit of a date and time that is a predetermined time after the date and time when membership registration was performed, or the visit of a date and time that is a predetermined time after the date and time when the user requested identity verification, or the expiration of the identity verification documents submitted by the user may correspond to the elapse of a predetermined period. In the example of FIG. 7, the visit of the update / guidance deadline corresponds to the elapse of a predetermined period.

[0063] [Service providing unit] The service providing unit 103 provides a payment service to the user based on the risk rating information. For example, the service providing unit 103 determines whether to restrict the use of the payment service by a certain user based on the risk rating information of the user. Restriction of the use of the payment service means prohibiting the use of the payment service or restricting the scope of use of the payment service to a predetermined range. The service providing unit 103 does not restrict the use of the payment service by a certain user when the risk rating indicated by the risk rating information of the user indicates a risk less than a threshold value (for example, "VH" or "H"). The service providing unit 103 restricts the use of the payment service by a certain user when the risk rating indicated by the risk rating information of the user indicates a risk equal to or higher than the threshold value.

[0064] Note that the usage restriction data indicating the relationship between the risk rating information and the content of the usage restrictions is assumed to be stored in advance in the data storage unit 100. The usage restriction data may be in any format. For example, the usage restriction data may be in a table format, a mathematical formula format, a machine learning model, or a part of program code. The service providing unit 103 identifies the content of the usage restrictions associated with the risk rating information of a certain user based on the usage restriction data. The service providing unit 103 provides the settlement service to the user based on the identified content of the usage restrictions.

[0065] For example, the service providing unit 103 may restrict the use of the settlement service by a user with a relatively high risk rating more than the use of the settlement service by a user with a relatively low risk rating. When the risk rating indicated by the risk rating information of a certain user indicates a risk equal to or higher than the threshold, the service providing unit 103 restricts the withdrawal of electronic money by the user. When the risk rating indicated by the risk rating information of a certain user indicates a risk equal to or higher than the threshold, the service providing unit 103 restricts the execution of a settlement by the user. When the risk rating indicated by the risk rating information of a certain user indicates a risk equal to or higher than the threshold, the service providing unit 103 restricts the charging of electronic money by the user. The service providing unit 103 may also restrict other uses other than the withdrawal of electronic money, the execution of a settlement, or the charging of electronic money.

[0066] [3-2. Functions Implemented on the User Terminal] For example, the user terminal 20 includes a data storage unit 200, an operation reception unit 201, and a display control unit 202. The data storage unit 200 is realized by the storage unit 22. The operation reception unit 201 and the display control unit 202 are realized by the control unit 21.

[0067] [Data Storage Unit] The data storage unit 200 stores the data necessary for the user to use the settlement service. For example, the data storage unit 200 stores the settlement application. When the user uses the settlement service from a browser instead of the settlement application, the data storage unit 200 stores the browser.

[0068] [Operation Reception Unit] The operation reception unit 201 receives various operations of the user. For example, the operation reception unit 201 receives operations on the payment application. The operation reception unit 201 transmits the user's personal information input by the user to the server 10.

[0069] [Display Control Unit] The display control unit 202 causes various screens to be displayed on the display unit 25. For example, the display control unit 202 causes the code screen SC1, the reception screen SC2, the shooting screen SC3, the completion screen SC4, or other screens to be displayed on the display unit 25. The display control unit 202 communicates with the server 10 or other computers, receives data necessary for the display of these screens, and causes these screens to be displayed on the display unit 25.

[0070] [4. Processes Executed in the Payment System] FIG. 8 is a diagram showing an example of a process executed in the payment system 1. The control units 11 and 21 execute the programs stored in the storage units 12 and 22 respectively, whereby the process of FIG. 8 is executed.

[0071] As shown in FIG. 8, when the payment application is launched on the user terminal 20, the server 10 executes a process for displaying the code screen SC1 between the server 10 and the user terminal 20 (S1). When the user selects the button B11, the server 10 executes a process for displaying the reception screen SC2 between the server 10 and the user terminal 20 (S2). When the user inputs the user's personal information on the reception screen SC2, the server 10 executes a process for acquiring the user's personal information between the server 10 and the user terminal 20 (S3).

[0072] Server 10 executes a process for displaying the shooting screen SC3 with the user terminal 20 (S4). Server 10 executes a process for acquiring a document image and a face image with the user terminal 20 (S5). Server 10 executes a process for displaying the completion screen SC4 with the user terminal 20 (S6). When the identity verification is completed, server 10 updates the user's identity verification information (S7). Thereafter, the user can withdraw electronic money unless determined to be a high risk.

[0073] Server 10 determines whether a predetermined condition for risk rating determination is satisfied (S8). In S8, it may correspond to the satisfaction of the predetermined condition that a sufficient amount of user usage information is acquired, or it may correspond to the satisfaction of the predetermined condition that the deadline in FIG. 7 arrives. In S8, when it is determined that the predetermined condition is not satisfied (S8: N), server 10 acquires the user's personal information based on the user database DB1 (S9).

[0074] Server 10 acquires the risk rating information of the user based on the user's personal information acquired in S9, the individual determination database DB2, and the comprehensive determination database DB3 (S10). In S10, server 10 determines two levels of the user based on the user's personal information and the individual determination database DB2. The level corresponding to the user usage information is temporarily set to "M". Server 10 acquires the risk rating information based on the comprehensive determination database DB3 and the combination of the three levels. When server 10 acquires the risk rating information, it stores it in the user database DB1.

[0075] Server 10 executes a process for providing a settlement service to the user based on the risk rating information of the user with the user terminal 20 (S11), and this process ends. In S8, when it is determined that the predetermined condition is satisfied (S8: Y), server 10 acquires the user's personal information and the user usage information based on the user database DB1 (S12).

[0076] Based on the user's personal information and usage information obtained in S12, the individual judgment database DB2, and the comprehensive judgment database DB3, the server 10 obtains the risk rating information of the user (S13) and proceeds to the process of S11. In S13, the server 10 determines three levels of the user based on the user's personal information and usage information and the individual judgment database DB2. The server 10 obtains the risk rating information based on the comprehensive judgment database DB3 and the combination of the three levels.

[0077] [Summary of Embodiment] The settlement system 1 of this embodiment obtains risk rating information based on user information. The settlement system 1 provides a settlement service to the user based on the risk rating information. By obtaining risk rating information corresponding to the user, the settlement system 1 can reduce the risk in the settlement service and enhance the convenience of the users who use the settlement service. For example, even if various users are using the settlement service, the settlement system 1 does not uniformly restrict the use for all users, but can provide a flexible settlement service according to the risk rating information of each individual user. As a result, the settlement system 1 can prevent the abuse of settlement means such as electronic money in money laundering and the like by malicious users, and can prevent acts that violate the usage regulations of the settlement service. For example, if the user does not have the identity verification documents at hand or the identity verification fails due to a system error, if the user is unable to use the settlement service, it may lead to the loss of users. However, in the settlement system 1, even if the user skips or omits part of the identity verification, the user can use the settlement service based on his / her own risk rating, so it is also possible to prevent such loss of users.

[0078] In addition, the payment system 1 acquires at least one of the user's personal information and the user's usage information as user information. The payment system 1 acquires risk rating information based on at least one of the user's personal information and the user's usage information. Thereby, since the payment system 1 can acquire risk rating information based on at least one of the information directly related to the user himself / herself and the use of the payment service by the user, the accuracy of the risk rating can be improved.

[0079] In addition, the payment system 1 acquires the user's personal information and the user's usage information as user information. The payment system 1 acquires risk rating information based on the user's personal information and the user's usage information. Thereby, since the payment system 1 can acquire risk rating information based on both the information directly related to the user himself / herself and the use of the payment service by the user, the accuracy of the risk rating can be improved. By improving the accuracy of the risk rating information, the payment system 1 can effectively enhance the convenience of the users who use the payment service while reducing the risk in the payment service.

[0080] In addition, the payment system 1 acquires risk rating information by executing a first determination process based on either one of the user's personal information and the user's usage information. When a predetermined condition is satisfied in the payment service, the payment system 1 updates the risk rating information by executing a second determination process based on the other one of the user's personal information and the user's usage information. As a result, even if the predetermined condition is not satisfied, the payment system 1 can acquire risk rating information by the first determination process. For example, if risk rating information cannot be acquired when the predetermined condition is not satisfied, there is a risk that the payment service will be used for purposes such as money laundering during that time, but the payment system 1 can avoid such a risk by the first determination process. For example, if the usage restrictions on users with a relatively high risk rating become stricter, it becomes easier for the payment system 1 to detect fraud. If the payment system 1 delays the risk rating until the update period or the like without temporarily performing the risk rating, there is a risk that the detection of fraud will be delayed. Therefore, the payment system 1 can avoid such a risk by introducing a risk rating function according to the provisional level. The risk rating is comprehensively determined based on both the user's personal information and the user's transaction information, and the payment system 1 can realize the risk rating by provisional placement even if either information is missing.

[0081] In addition, the payment system 1 determines whether the predetermined condition is satisfied by determining whether the other information has been acquired in the payment service. As a result, when both the user's personal information and the user's usage information are acquired, the payment system 1 can acquire more accurate risk rating information. By improving the accuracy of the risk rating information, the payment system 1 can effectively improve the convenience of users who use the payment service while reducing the risk in the payment service.

[0082] In addition, the payment system 1 determines whether a predetermined condition is satisfied by determining whether a predetermined period has elapsed in the payment service. Thereby, when a predetermined period has elapsed, the payment system 1 can acquire risk rating information with higher accuracy. For example, when a period sufficient for accumulating user usage information has elapsed, the payment system 1 can acquire risk rating information with higher accuracy. By improving the accuracy of the risk rating information, the payment system 1 can effectively enhance the convenience of users who use the payment service while reducing the risk in the payment service.

[0083] In addition, the payment system 1 executes a first determination process based on either one of the user's personal information and the user usage information and predetermined information. Thereby, even if the other information of the user's personal information and the user usage information is not acquired or is insufficient, the payment system 1 can acquire risk rating information by the first determination process based on the predetermined information.

[0084] In addition, the payment system 1 restricts the use of the payment service by a user with a relatively high risk rating more than the use of the payment service by a user with a relatively low risk rating. Thereby, the payment system 1 can restrict the use of the payment service by a user with a relatively high risk. As a result, the payment system 1 can prevent the payment service from being used for purposes such as money laundering. The payment system 1 can also enhance the convenience of users with a relatively low risk.

[0085] [6. Modification Example] The present disclosure is not limited to the embodiments described above. The present disclosure can be appropriately changed without departing from the gist of the present disclosure.

[0086] FIG. 9 is a diagram showing an example of a function realized in a modified example. For example, server 10 includes an update request unit 104, an update guidance unit 105, a monitoring unit 106, and a lower limit setting unit 107. Each of the update request unit 104, the update guidance unit 105, the monitoring unit 106, and the lower limit setting unit 107 is realized by the control unit 11.

[0087] [6-1. Modified Example 1] For example, the payment system 1 may request the user to periodically update the user's personal information. In Modified Example 1, the user information acquisition unit 101 acquires the user's personal information as user information. The risk rating information acquisition unit 102 acquires risk rating information based on the user's personal information. In Modified Example 1, taking the case where user usage information is also acquired as in the embodiment as an example, the user usage information may not be acquired. That is, the risk rating information may be acquired based only on the user's personal information.

[0088] FIG. 10 is a diagram showing an example of an update cycle of the user's personal information according to the risk rating information. In FIG. 10, the processing of the guidance unit in Modified Example 2 described later is also shown, but in Modified Example 1, the processing of the guidance unit may not be executed. As shown in FIG. 10, when the user's personal information of a certain user is updated, an update cycle according to the risk rating information of the user is set. For example, when the risk rating information indicates "VH" or "H", the update cycle is one year. When the risk rating information indicates "M", the update cycle is two years. When the risk rating information indicates "L", the update cycle is three years.

[0089] The payment system 1 in Modified Example 1 includes an update request unit 104. The update request unit 104 issues an update request regarding the update of the user's personal information to the user based on the risk rating information. The update request is data in a predetermined format indicating a request to update the user's personal information to the user. The update request is notified to the user. In Modified Example 1, taking the case where the update request is notified by the notification function of the payment application as an example, the notification means of the update request is not limited to the notification function of the payment application. For example, the update request may be notified by other notification means such as an email or SMS.

[0090] For example, the update request unit 104 determines the update timing of the user's personal information based on the risk rating information. The higher the risk indicated by the risk rating information, the more frequently the update timing of the user's personal information is determined by the update request unit 104. The data storage unit 100 stores update timing data indicating the relationship between the risk rating information and the update timing. The update timing data may be in a table format, a mathematical formula format, a machine learning model, or a part of program code. The update request unit 104 determines the update timing of a user based on the risk rating information of the user and the update timing data.

[0091] In Modification 1, it is assumed that the update timing data indicates the time interval at which the update timing occurs for each of the four levels of the risk rating information. For example, when the risk rating information indicates "VH" or "H", the update timing data indicates one year. When the risk rating information indicates "M", the update timing data indicates two years. When the risk rating information indicates "L", the update timing data indicates three years. When the risk rating information has a number of levels other than four, it is assumed that the update timing data indicates the time interval of the update timing corresponding to the other number of levels. The time interval may be of any length and is not limited to the above example.

[0092] For example, the update request unit 104 sets the update timing of each user based on the risk rating information of the user. The data indicating the update timing may be stored in the user database DB1. The update request unit 104 determines whether the update timing or any previous deadline has occurred for each user based on the update timing set for the user. When it is determined that the update timing or any previous deadline has occurred, the update request unit 104 makes an update request to the user. The update request may be made on a screen such as the lower side of FIG. 11 described later, or may be made by any medium such as an email.

[0093] Note that the update request unit 104 may vary the items requested for updating the user's personal information, rather than varying the update timing, based on the risk rating information. For example, the update request unit 104 may request the user to update more of the user's personal information as the risk indicated by the risk rating information is higher. The update request unit 104 may request the user to update a specific item of the user's personal information when the risk indicated by the risk rating information is equal to or higher than a threshold value.

[0094] The payment system 1 of Modification Example 1 makes an update request regarding the update of the user's personal information to the user based on the risk rating information. Thereby, since the payment system 1 can acquire the risk rating information based on the new user's personal information, the accuracy of the risk rating information is improved. For example, when the payment system 1 acquires the risk rating information based on the old user's personal information, there is a risk that an act such as money laundering may be carried out, but such a risk can be avoided by acquiring the risk rating information based on the new user's personal information.

[0095] [6-2. Modification Example 2] For example, in addition to making an update request as in Modification Example 1, the payment system 1 may also guide the user to update the user's personal information. The update request and the update guidance are similar concepts to each other, but the update guidance is such that the user can arbitrarily select whether to update the user's personal information or not. For example, even if the user holds off on the guided update of the user's personal information, the user can use the payment service. On the other hand, for the update request, it is assumed that the user cannot use the payment service unless the user updates the user's personal information.

[0096] The settlement system 1 of Modification Example 2 includes an update guidance unit 105. The update guidance unit 105 guides the user to update the user's personal information. The update guidance unit 105 uses a predetermined means to guide the update of the user's personal information. For example, the update guidance unit 105 may guide the update of the user's personal information based on a certain screen such as the code screen SC1 on the payment application, the notification function on the payment application, the pop-up modal on the payment application, an email, an SMS, or the push notification function of the user terminal 20. For example, the update guidance unit 105 may guide the update on a screen related to the use of the payment service (for example, a screen on which a button for money transfer is displayed, a screen after the button for money transfer is selected, or a screen indicating the completion of money transfer).

[0097] FIG. 11 is a diagram showing an example of how the update of the user's personal information is guided. For example, when the user tries to use the money transfer or withdrawal function in the payment application, the update guidance unit 105 causes the guidance screen SC5 to be displayed on the user terminal 20. For example, if it is within the update deadline and the risk rating indicated by the risk rating information is less than the threshold (for example, "H"), as shown in the upper part of FIG. 11, the update guidance unit 105 causes the guidance screen SC5 including the button B50 for updating the user's personal information and the button B51 indicating that it can be updated later to be displayed on the user terminal 20. The update deadline is the deadline in FIG. 10. The deadline for updating the user's personal information and the deadline for guiding the update may not be the same. Note that the button B51 is not limited to the state shown in FIG. 11. For example, it may be a "close" button or an "x" button, etc. As long as the user can use the payment application while keeping the update of the user's personal information on hold when the user selects the button B50.

[0098] For example, when the user selects button B50, the user's personal information is updated according to the same process as in FIG. 2. When the user selects button B51, the user can use the remittance or withdrawal function in the payment application while postponing the update of the user's personal information. On the other hand, if it is not within the update deadline or the risk rating indicated by the risk rating information is equal to or higher than the threshold, as shown in the lower part of FIG. 11, the update guidance unit 105 causes the user terminal 20 to display a guidance screen SC5 that does not include button B51. Note that when the user is filing a declaration of assets or the like, the update guidance unit 105 may cause the user terminal 20 to display a guidance screen SC5 that includes button B51.

[0099] For example, when the user uses the payment service in the payment application, the update guidance unit 105 may guide the update of the user's personal information on the payment application. When the user makes a remittance in the payment application, the update guidance unit 105 may guide the update of the user's personal information by means of a pop-up modal on the payment application. When the user performs other operations such as payment or recharge in the payment application, the update guidance unit 105 may guide the update of the user's personal information by means of a pop-up modal on the payment application. These guides may be provided not in a pop-up modal but on any screen displayed when using the payment service.

[0100] For example, the update guidance unit 105 may vary the content of the guidance based on the user's risk rating information. When the risk rating indicated by the user's risk rating information is relatively high, the update guidance unit 105 may guide the update of the user's personal information with more emphasis than when the risk rating indicated by the user's risk rating information is relatively low. Further, when the risk rating indicated by the user's risk rating information is relatively low, the update guidance unit 105 may display an image for the user to update the user's personal information later.

[0101] For example, when the risk rating indicated by the user's risk rating information is relatively high, the update proposal section 105 may not display an image (button B51 in FIG. 11) for the user to update the user's own information later. In this case, if the user does not update the user's own information, the payment service may not be available. Further, for users with a medium risk rating, the payment service may be made available if some items of the user's own information are updated.

[0102] The payment system 1 of Modification 2 guides the user to update the user's own information. As a result, it becomes easier for the user to notice that it is necessary to update the user's own information. For example, when the user tries to make a payment at a franchise of the payment service, the payment system 1 can easily prevent the situation where the payment cannot be made because the user's own information has not been updated.

[0103] [6-3. Modification 3] For example, in Modification 2, when the risk rating indicated by the risk rating information is a predetermined risk rating (for example, a risk rating less than "H"), the service providing section 103 may provide the payment service based on the user's operation without updating the user's own information. When a certain user uses the payment service, the service providing section 103 refers to the user database DB1 and determines whether the risk rating indicated by the risk rating information of the user is the predetermined risk rating. When it is determined that the risk rating is not the predetermined risk rating (for example, when the risk rating is "H" or higher), the service providing section 103 does not provide the payment service unless the user's own information is updated. When it is determined that the risk rating is the predetermined risk rating, the service providing section 103 provides the payment service based on the user's operation without updating the user's own information.

[0104] In Modification 3, similar to Modifications 1 and 2, a predetermined update deadline is set for the update of the user's personal information. The user only needs to update their personal information by the update deadline. The update deadline of the user may be stored in the user database DB1. The operation of the user is an operation for using the payment service without updating the user's personal information. In the example of FIG. 11, the selection of button B51 corresponds to the operation of the user. The operation of the user may be an arbitrary operation and is not limited to the selection of button B51. For example, the operation of the user may be an operation of selecting an image other than button B51.

[0105] For example, when a certain user uses the payment service, the service providing unit 103 refers to the user database DB1 to identify the update deadline of the user. The service providing unit 103 determines whether the update deadline has passed. When it is determined that the update deadline has not passed and the user performs an operation such as selecting button B51, the service providing unit 103 provides the payment service to the user based on the current risk rating information without updating the user's personal information. When it is determined that the update deadline has passed, the service providing unit 103 provides the payment service to the user based on the latest risk rating information on the condition that the user's personal information has been updated.

[0106] When the risk rating indicated by the risk rating information in the payment system 1 of Modification 3 is a predetermined risk rating, the payment service is provided based on the operation of the user without updating the user's personal information. Since the payment system 1 can delegate the timing of updating the user's personal information to the user, the convenience of the user is improved.

[0107] [6-4. Modification 4] For example, in Modification 2, when the risk rating indicated by the risk rating information is a predetermined risk rating (for example, a risk rating less than "H"), the service providing unit 103 provides the settlement service without performing an update based on the usage content of the settlement service by the user. The usage content is the content of the settlement service that the user intends to use in the future. For example, the usage content may be the settlement amount, settlement date and time, settlement location, charge amount, charge date and time, settlement means used for the charge, remittance amount, remittance date and time, remittance recipient, principal amount, withdrawal date and time, withdrawal location, or other content.

[0108] For example, when a certain user uses the settlement service, the service providing unit 103 refers to the user database DB1 and determines whether the risk rating indicated by the risk rating information of the user is a predetermined risk rating. When it is determined that the risk rating is not a predetermined risk rating (for example, when the risk rating is "H" or higher), the service providing unit 103 does not provide the settlement service unless the user's personal information is updated. When it is determined that the risk rating is a predetermined risk rating, the service providing unit 103 provides the settlement service without performing an update of the user's personal information based on the usage content of the settlement service by the user.

[0109] For example, the service providing unit 103 determines whether the usage content of the settlement service by the user satisfies a predetermined condition. The predetermined condition is a condition under which the use of the settlement service is restricted. For example, the settlement amount, settlement date and time, settlement location, charge amount, charge date and time, settlement means used for the charge, remittance amount, remittance date and time, remittance recipient, withdrawal amount, withdrawal date and time, withdrawal location, or other conditions may correspond to the predetermined conditions. When it is determined that the user usage information does not satisfy the predetermined condition, the service providing unit 103 does not restrict the use of the settlement service by the user. When it is determined that the user usage information satisfies the predetermined condition, the service providing unit 103 restricts the use of the settlement service by the user.

[0110] For example, when the settlement amount, recharge amount, transfer amount, or withdrawal amount is less than the threshold value, the service providing unit 103 may allow the user to use the settlement service without updating the user's personal information. When the settlement amount, recharge amount, transfer amount, or withdrawal amount is equal to or greater than the threshold value, the service providing unit 103 may execute the settlement on the condition that the user's personal information is updated. The service providing unit 103 may also determine whether to allow the user to use the settlement service without updating the user's personal information based on other conditions such as the settlement date and time or the settlement location.

[0111] In the settlement system 1 of Modification Example 4, when the risk rating indicated by the risk rating information is a predetermined risk rating, the settlement service is provided to the user based on the usage content of the settlement service by the user without performing an update. As a result, in the settlement system 1, when the risk rating indicated by the risk rating information is a predetermined risk rating, the user is not allowed to use the settlement service without restriction, but can use the settlement service without restriction under certain conditions. As a result, the settlement system 1 can reduce the risk in the settlement service and improve the convenience for the user.

[0112] [6-5. Modification Example 5] For example, the service providing unit 103 may provide the settlement service to the user based on the usage range corresponding to the risk rating information. The usage range may be the settlement amount, settlement date and time, settlement location, recharge amount, recharge date and time, settlement means used for recharge, transfer amount, transfer date and time, transfer recipient, withdrawal amount, withdrawal date and time, withdrawal location, or other ranges. The usage range may be the usage range per use or the usage range during a period such as one week or one month.

[0113] Note that it is assumed that the usage range data indicating the relationship between the risk rating information and the usage range is stored in the data storage unit 100. The usage range data may be in any format, for example, in a table format, a mathematical formula format, a machine learning model, or a part of program code. The service providing unit 103 identifies the usage range associated with the risk rating information of a certain user based on the usage range data. The service providing unit 103 provides a settlement service to the user based on the identified usage range.

[0114] For example, the service providing unit 103 provides a settlement service to the user such that the higher the risk rating indicated by the risk rating information, the narrower the usage range of the user (for example, the upper limit of the user's settlement amount, charge amount, remittance amount, or withdrawal amount becomes smaller). The service providing unit 103 provides a settlement service to the user such that the lower the risk rating indicated by the risk rating information, the wider the usage range of the user (for example, the upper limit of the user's settlement amount, charge amount, remittance amount, or withdrawal amount becomes larger).

[0115] The settlement system 1 of Modification Example 5 provides a settlement service to the user based on the usage range according to the risk rating information. By providing a more flexible usage range to the user, the settlement system 1 can reduce the risk in the settlement service while enhancing the convenience of the user.

[0116] [6-6. Modification Example 6] For example, the settlement system 1 may monitor the actions of the user for the purpose of detecting fraud in the settlement service. In this case, if the settlement system 1 monitors the actions of the user based on a uniform monitoring condition for all users, there is a possibility that the monitoring may be insufficient for users with relatively high risks. Conversely, the settlement system 1 may perform unnecessary monitoring on users with relatively low risks. Therefore, the settlement system 1 may perform monitoring according to the risk rating information.

[0117] The settlement system 1 of Modification Example 6 includes a monitoring unit 106. The monitoring unit 106 monitors the use of the settlement service by the user based on the monitoring conditions according to the risk rating information. It is assumed that the monitoring condition data indicating the relationship between the risk rating information and the monitoring conditions is stored in the data storage unit 100. The monitoring condition data may be in any format. For example, the monitoring condition data may be in table format, mathematical formula format, a machine learning model, or a part of program code.

[0118] The monitoring conditions are conditions that can be determined based on user information (for example, at least one of the user's personal information and the user's usage information). The monitoring conditions can also be said to be the criteria for determining fraud in the settlement service. Whether the monitoring conditions are met is determined based on the values of at least some of the multiple items included in the user information. For example, in the monitoring condition data, the monitoring conditions are defined such that the higher the risk indicated by the risk rating information, the more monitoring items there are. In the monitoring condition data, the monitoring conditions are defined such that the lower the risk indicated by the risk rating information, the fewer monitoring items there are. The monitoring items may include, for example, system monitoring and human monitoring.

[0119] For example, the monitoring conditions may be that the nationality is a predetermined nationality, the visa status is a predetermined status, the period of stay is a predetermined period, the occupation is a predetermined occupation, the industry type is a predetermined industry type, the purpose of using the settlement service is a predetermined purpose, the business, etc. is a predetermined business, the assets are a predetermined amount of assets, the income is a predetermined amount of income, the source of funds is a predetermined source of funds, or a combination thereof. For example, the monitoring conditions may be that the settlement amount is a predetermined settlement amount, the settlement date and time is a predetermined date and time, the settlement location is a predetermined location, a predetermined settlement method is used in the settlement, or a combination thereof.

[0120] For example, based on the monitoring condition data, the monitoring unit 106 identifies the monitoring conditions associated with the risk rating information of the user to be monitored. The monitoring unit 106 monitors the use of the payment service by the user based on the identified monitoring conditions and the user information of the user to be monitored (for example, at least one of the user's own information and the user usage information). The monitoring unit 106 increases the number of monitoring condition items as the risk indicated by the risk rating information of the user to be monitored is higher. The monitoring unit 106 increases the number of monitoring condition items as the risk indicated by the risk rating information of the user to be monitored is lower. For example, when the risk indicated by the risk rating information of the user to be monitored is relatively high (for example, when the risk is equal to or higher than the threshold), the monitoring unit 106 may monitor the user based on the monitoring conditions including items that would not be targeted when the risk is relatively low.

[0121] For example, when it is determined that the monitoring conditions are not satisfied, the monitoring unit 106 does not execute a predetermined process, and when it is determined that the monitoring conditions are satisfied, the monitoring unit 106 executes a predetermined process. The predetermined process executed by the monitoring unit 106 is a process triggered by the satisfaction of the monitoring conditions. The predetermined process may be any predetermined process. For example, notification to the administrator of the payment service, output to a list indicating users who require attention, restriction of the use of the payment service, or other processes may correspond to the predetermined process.

[0122] The payment system 1 of Modification Example 6 monitors the use of the payment service by the user based on the monitoring conditions according to the risk rating information. Thereby, the payment system 1 can detect fraud occurring in the payment service or prevent fraud from occurring. For example, the payment system 1 can more easily prevent fraud by monitoring users with relatively high risks indicated by the risk rating information under detailed monitoring conditions. The payment system 1 can prevent unnecessary monitoring from being performed by monitoring users with relatively low risks indicated by the risk rating information under simple monitoring conditions.

[0123] [6-7. Modification Example 7] For example, the service providing unit 103 may provide a payment service to the user based on a period corresponding to the risk rating information. Assume that the data storage unit 100 of Modification Example 7 stores period data indicating the relationship between the risk rating information and the period during which the payment service is provided. The period data may be in any format. For example, the period data may be in a table format, a mathematical formula format, a machine learning model, or a part of program code.

[0124] For example, in the period data, the period is defined such that the higher the risk indicated by the risk rating information, the shorter the period during which the payment service is provided. In the period data, the period is defined such that the lower the risk indicated by the risk rating information, the longer the period during which the payment service is provided. The period indicated by the period data may be the same as the update period described in Modification Example 1 or the like, or may be a period different from the update period.

[0125] For example, the service providing unit 103 identifies a period associated with the user's risk rating information based on the period data. The service providing unit 103 provides a payment service to the user based on the identified period. If the time when the user attempts to use the payment service is not included in the identified period, the service providing unit 103 does not provide the payment service to the user. If the time when the user attempts to use the payment service is included in the identified period, the service providing unit 103 provides the payment service to the user.

[0126] The payment system 1 of Modification Example 7 provides a payment service to the user based on a period corresponding to the risk rating information. Thereby, the payment system 1 can provide the payment service to the user during an appropriate period according to the user's risk. For example, the payment system 1 can restrict the use of the payment service by a user who has not updated their personal information for a long time.

[0127] [6-8. Modification Example 8] For example, when a user with a risk rating indicated by the risk rating information performs a predetermined action and the risk rating is a predetermined risk rating, the service providing unit 103 may permit the user to use the payment service. The predetermined risk rating is at least one of a plurality of levels of risk ratings. In Modification Example 8, the case where the risk rating of "H" or higher is the predetermined risk rating is taken as an example.

[0128] The predetermined action is an action for which the use of the payment service is permitted. In Modification Example 8, the case where the predetermined action is the declaration of assets or the like is taken as an example. That is, the user's act of seriously considering a specific item of the user's personal information corresponds to the user performing the predetermined action. The predetermined action is not limited to the declaration of assets or the like. For example, the predetermined action may be the re-uploading of identity verification documents, the re-uploading of a face photo, the execution of eKYC, or other actions.

[0129] When a certain user attempts to use the payment service, the service providing unit 103 of Modification Example 8 determines whether the risk rating indicated by the risk rating information of the user is the predetermined risk rating. If the service providing unit 103 determines that the risk rating of the user attempting to use the payment service is not the predetermined risk rating, it permits the user to use the payment service without the user performing the predetermined action.

[0130] For example, when the service providing unit 103 determines that the risk rating of the user attempting to use the payment service is the predetermined risk rating, it determines whether the user has performed the predetermined action based on the data received from the user terminal 20 of the user or the data stored in a database such as the user database DB1. If the service providing unit 103 determines that the user has not performed the predetermined action, it does not permit the user to use the payment service. If the service providing unit 103 determines that the user has not performed the predetermined action, it permits the user to use the payment service.

[0131] The settlement system 1 of Modification Example 8 permits a user whose risk rating indicated by risk rating information is a predetermined risk rating to use the settlement service when the user takes a predetermined action. As a result, the settlement system 1 can prevent a situation where a user with a predetermined risk rating cannot use the settlement service, thereby enhancing the convenience for the user. The settlement system 1 can reduce the risk of the user engaging in fraud or the like by requiring a predetermined action from a user with a predetermined risk rating.

[0132] [6-9. Modification Example 9] For example, for a certain specific user, it may not be possible to accurately determine the risk only based on the risk rating determination logic. If the risk rating of such a user is determined using the same determination logic as other users, the risk rating of the user may be lower than expected. Therefore, for a certain specific user, a lower limit of the risk rating may be set so that the risk rating does not become lower than the lower limit.

[0133] The settlement system 1 of Modification Example 9 includes a lower limit setting unit 107. The lower limit setting unit 107 sets the lower limit of the risk rating of the user based on the risk rating information. For example, the lower limit setting unit 107 sets the lower limit of the risk rating for a user designated by the administrator of the settlement service. In Modification Example 9, it is assumed that the lower limit of the risk rating is associated with the user ID and stored in the user database DB1, but it may be stored in other databases. Note that the user for whom the lower limit is to be set may be determined based on a predetermined algorithm instead of being designated by the administrator. The lower limit may vary depending on the user. In Modification Example 9, it is assumed that the lower limit is "M". By default, the lower limit for all users may be "L".

[0134] The risk rating information acquisition unit 102 of Modification Example 9 updates the risk rating information based on the lower limit of the user. The risk rating information acquisition unit 102 acquires the risk rating information in the same manner as in the embodiment. If the risk rating indicated by the acquired risk rating information is equal to or higher than the lower limit, the risk rating information acquisition unit 102 acquires the acquired risk rating information as the final risk rating information. If the risk rating indicated by the acquired risk rating information is less than the lower limit, the risk rating information acquisition unit 102 acquires the lower limit set for the user as the final risk rating information. That is, the risk rating information acquisition unit 102 acquires the risk rating information so as not to fall below the lower limit for the user for whom the lower limit is set.

[0135] The settlement system 1 of Modification Example 9 sets the lower limit of the user's risk rating based on the risk rating information. The settlement system 1 updates the risk rating information based on the lower limit of the user. The settlement system 1 can prevent a situation where risk rating information that is too low is acquired for a specific user. For example, the settlement system 1 can prevent a situation where risk rating information that is too low is acquired for a user who requires attention.

[0136] [6-10. Modification Example 10] For example, in the embodiment, the case where the user information acquisition unit 101 acquires the user information managed by the settlement service is taken as an example. The user information acquisition unit 101 may acquire the user information from another service different from the settlement service based on the user ID. The other service may be any service that cooperates with the settlement service. For example, the other service may be a financial service, a communication service, an e-commerce service, or another settlement service. Assume that the user is using another service.

[0137] In Modification 10, a case where the user ID of the payment service is the same as the user ID of another service is taken as an example. The system of the other service can identify which user's user information should be sent to the payment system 1 based on the same user ID as the payment service. Note that the user ID of the payment service and the user ID of the other service may be different from each other. When these user IDs are different from each other, it is assumed that the association of these user IDs is managed by the payment service or the other service. The identity of the user may be specified by the said association.

[0138] The user information of the other service may be risk rating information in the other service, or may be the user's personal information and user transaction information of the other service. The risk rating information acquisition unit 102 acquires risk rating information based on the user information of the other service. For example, when the user information of the other service is the risk rating information of the other service itself, the risk rating information acquisition unit 102 may acquire the risk rating information of the other service as the risk rating information of the payment service.

[0139] For example, when the user information of the other service is the user's personal information and user transaction information of the other service, the risk rating information acquisition unit 102 acquires the risk rating information of the payment service based on the user's personal information and user transaction information of the other service. Although it is different from the embodiment in that the user's personal information and user transaction information are those of the other service, other aspects may be the same as those of the embodiment. The risk rating information acquisition unit 102 may acquire the risk rating information of the payment service based on both the user's personal information and user transaction information of the payment service and the user's personal information and user transaction information of the other service.

[0140] The payment system 1 of Modification Example 10 can reduce the burden on the user because it can reuse the user information of other services and eliminate the need for the user to input new information. By linking the user information, the payment system 1 can obtain accurate risk rating information. The payment system 1 can also determine the authenticity of the user information provided by the user using the payment service by comparing the user information of other services with the user information of the payment service.

[0141] [6-11. Other Modification Examples] For example, the above modification examples may be combined.

[0142] For example, the functions described as being realized by the server 10 may be realized by the user terminal 20 or other computers. The processes described as being realized by the server 10 may be shared by a plurality of computers.

[0143] [7. Supplementary Note] For example, the system may also be configured as follows. (1) A user information acquisition unit that acquires user information regarding a user who uses a payment service in which payment based on an electronic payment means is performed, A risk rating information acquisition unit that acquires risk rating information regarding the risk rating of the user in the payment service based on the user information, A service providing unit that provides the payment service to the user based on the risk rating information, A payment system including the above. (2) The user information acquisition unit acquires at least one of user personal information regarding the user himself / herself and user usage information regarding the use of the payment service by the user as the user information, The risk rating information acquisition unit acquires the risk rating information based on at least one of the user personal information and the user usage information, The payment system according to (1). (3) The risk rating information acquisition unit acquires the risk rating information by executing a first determination process related to the risk rating based on either one of the user personal information and the user usage information, and updates the risk rating information by executing a second determination process related to the risk rating based on the other one of the user personal information and the user usage information when a predetermined condition is satisfied in the payment service. The payment system according to (2). (4) The risk rating information acquisition unit determines whether the predetermined condition is satisfied by determining whether the other information has been acquired in the payment service. The payment system according to (3). (5) The risk rating information acquisition unit determines whether the predetermined condition is satisfied by determining whether a predetermined period has elapsed in the payment service. The payment system according to (3) or (4). (6) The risk rating information acquisition unit executes the first determination process based on the one information and predetermined information. The payment system according to any one of (3) to (5). (7) The user information acquisition unit acquires user personal information regarding the user as the user information. The risk rating information acquisition unit acquires the risk rating information based on the user personal information. The payment system further includes an update request unit that makes an update request regarding the update of the user personal information to the user based on the risk rating information. The payment system according to any one of (2) to (6). (8) The user information acquisition unit acquires user personal information regarding the user as the user information. The risk rating information acquisition unit acquires the risk rating information based on the personal information of the user. The payment system further includes an update guidance unit that guides the user to update the personal information of the user. The payment system according to any one of (2) to (7). (9) When the risk rating indicated by the risk rating information is a predetermined risk rating, the service providing unit provides the payment service based on the operation of the user without performing the update. The payment system according to (8). (10) When the risk rating indicated by the risk rating information is a predetermined risk rating, the service providing unit provides the payment service based on the usage content of the payment service by the user without performing the update. The payment system according to (8) or (9). (11) The service providing unit provides the payment service to the user based on the usage range according to the risk rating information. The payment system according to any one of (1) to (10). (12) The payment system further includes a monitoring unit that monitors the use of the payment service by the user based on the monitoring conditions according to the risk rating information. The payment system according to any one of (1) to (11). (13) The service providing unit provides the payment service to the user based on the period according to the risk rating information. The payment system according to any one of (1) to (12). (14) When the user with the predetermined risk rating indicated by the risk rating information performs a predetermined action, the service providing unit permits the use of the payment service by the user. The payment system according to any one of (1) to (13). (15) The payment system further includes a lower limit setting unit that sets a lower limit of the risk rating of the user based on the risk rating information. The risk rating information acquisition unit updates the risk rating information based on the lower limit of the user. The payment system according to any one of (1) to (14). (16) The service providing unit restricts the use of the payment service by the user with a relatively high risk rating more than the use of the payment service by the user with a relatively low risk rating. The payment system according to any one of (1) to (15). (17) The user information acquisition unit acquires the user information from another service different from the payment service based on user identification information capable of identifying the user. The payment system according to any one of (1) to (16).

Description of Signs

[0144] 1 Payment system, N Network, 10 Server, 11, 21 Control unit, 12, 22 Storage unit, 13, 23 Communication unit, 20 User terminal, 24 Operation unit, 25 Display unit, 26 Photographing unit, 100 Data storage unit, 101 User information acquisition unit, 102 Risk rating information acquisition unit, 103 Service providing unit, 104 Update request unit, 105 Update guidance unit, 106 Monitoring unit, 107 Lower limit setting unit, 200 Data storage unit, 201 Operation reception unit, 202 Display control unit, B11, B30 Button, C10 Code, DB1 User database, DB2 Individual determination database, DB3 Comprehensive determination database, F20 Input form, SC1 Code screen, SC2 Reception screen, SC3 Photographing screen, SC4 Completion screen, SC5 Guidance screen.

Claims

1. A user information acquisition unit that acquires user information regarding a user, including the nationality of the user who uses a payment service in which payment based on an electronic payment means is performed; A risk rating information acquisition unit that acquires risk rating information regarding the risk rating of fraud by the user in the payment service based on the nationality of the user included in the user information; A service providing unit that provides the payment service by restricting the withdrawal, charging, sending, or receiving of electronic money to the user based on the risk rating information; comprising; The user information acquisition unit acquires at least one of user personal information regarding the user himself / herself and user usage information regarding the use of the payment service by the user as the user information; The risk rating information acquisition unit acquires the risk rating information based on at least one of the user personal information and the user usage information; A payment system.

2. A user information acquisition unit that acquires at least one of user personal information regarding the user himself / herself and user usage information regarding the use of the payment service by the user as user information regarding the user who uses a payment service in which payment based on an electronic payment means is performed; A risk rating information acquisition unit that acquires risk rating information regarding the risk rating of the user in the payment service based on at least one of the user personal information and the user usage information; A service providing unit that provides the payment service to the user based on the risk rating information; comprising; When the user information acquisition unit acquires either one of the user personal information and the user usage information, the risk rating information acquisition unit executes a first determination process regarding the risk rating based on the one piece of information to acquire the first risk rating information, and the service providing unit provides the payment service to the user based on the first risk rating information; When the user information acquisition unit acquires, in addition to the one piece of information, the other piece of information among the user's own information and the user usage information, the risk rating information acquisition unit executes a second determination process regarding the risk rating based on the one piece of information and the other piece of information, thereby acquiring the second risk rating information, and the service providing unit provides the payment service to the user based on the second risk rating information. Payment system.

3. A user information acquisition unit that acquires user's own information regarding the user as user information regarding a user who uses a payment service based on an electronic payment means, A risk rating information acquisition unit that acquires risk rating information regarding the risk rating of the user in the payment service based on the user's own information, A service providing unit that provides the payment service to the user based on the risk rating information, An update guidance unit that outputs guidance for updating the user's own information to the user, Including, When the risk rating of the user's risk rating information satisfies a predetermined requirement, the update guidance unit outputs guidance indicating that the update of the user's own information can be postponed to the user, and the service providing unit also provides the payment service to the user when the update of the user's own information has been postponed by the user. When the risk rating of the user's risk rating information does not satisfy the predetermined requirement, the update guidance unit does not output guidance indicating that the update of the user's own information can be postponed to the user, and the service providing unit restricts the provision of the payment service to the user until the user's own information is updated by the user. Payment system.

4. A user information acquisition unit that acquires at least one of user's own information regarding the user and user usage information regarding the user's use of the payment service as user information regarding a user who uses a payment service based on an electronic payment means, A risk rating information acquisition unit that acquires risk rating information regarding the risk rating of the user in the payment service based on at least one of the user's own information and the user usage information, A service providing unit that provides the settlement service to the user based on the risk rating information; comprising; When the user information acquisition unit acquires either one of the user's own information and the user usage information, the risk rating information acquisition unit executes a first determination process related to the risk rating based on the one information and predetermined information that is provisional information related to the other information, thereby acquiring the first risk rating information, and the service providing unit provides the settlement service to the user based on the first risk rating information. A settlement system.

5. The user information acquisition unit acquires at least one of user's own information related to the user himself / herself and user usage information related to the use of the settlement service by the user as the user information. The risk rating information acquisition unit acquires the risk rating information based on at least one of the user's own information and the user usage information. The settlement system according to claim 3.

6. The risk rating information acquisition unit acquires the risk rating information by executing a first determination process related to the risk rating based on either one of the user's own information and the user usage information, and updates the risk rating information by executing a second determination process related to the risk rating based on the other information of the user's own information and the user usage information when a predetermined condition is satisfied in the settlement service. The settlement system according to claim 1 or 5.

7. The risk rating information acquisition unit determines whether the predetermined condition is satisfied by determining whether the other information has been acquired in the settlement service. The settlement system according to claim 6.

8. The risk rating information acquisition unit determines whether the predetermined condition is satisfied by determining whether a predetermined period has elapsed in the settlement service. The settlement system according to claim 6.

9. The risk rating information acquisition unit executes the first determination process based on the one information and the predetermined information. The settlement system according to claim 2.

10. The risk rating information acquisition unit executes the first determination process based on the one information and the predetermined information. The settlement system according to claim 6.

11. The user information acquisition unit acquires user personal information regarding the user himself / herself as the user information, the risk rating information acquisition unit acquires the risk rating information based on the user personal information, the payment system further includes an update request unit that makes an update request regarding the update of the user personal information to the user based on the risk rating information, The payment system according to any one of Claims 1, 2, and 4.

12. The user information acquisition unit acquires user personal information regarding the user himself / herself as the user information, the risk rating information acquisition unit acquires the risk rating information based on the user personal information, the payment system further includes an update guidance unit that guides the user to update the user personal information, The payment system according to any one of Claims 1, 2, and 4.

13. When the risk rating indicated by the risk rating information is a predetermined risk rating, the service providing unit provides the payment service based on the operation of the user without performing the update. The payment system according to Claim 3.

14. When the risk rating indicated by the risk rating information is a predetermined risk rating, the service providing unit provides the payment service based on the operation of the user without performing the update. The payment system according to Claim 12.

15. When the risk rating indicated by the risk rating information is a predetermined risk rating, the service providing unit provides the payment service based on the usage content of the payment service by the user without performing the update. The payment system according to Claim 3.

16. When the risk rating indicated by the risk rating information is a predetermined risk rating, the service providing unit provides the payment service based on the usage content of the payment service by the user without performing the update. The payment system according to Claim 12.

17. The service providing unit provides the payment service to the user based on the usage range corresponding to the risk rating information. The payment system according to any one of Claims 1 to 4.

18. The payment system further includes a monitoring unit that monitors the use of the payment service by the user based on the monitoring conditions corresponding to the risk rating information. The settlement system according to any one of claims 1 to 4.

19. The service providing unit provides the settlement service to the user based on a period according to the risk rating information. The settlement system according to any one of claims 1 to 4.

20. When the user, for whom the risk rating indicated by the risk rating information is a predetermined risk rating, performs a predetermined action, the service providing unit permits the user to use the settlement service. The settlement system according to any one of claims 1 to 4.

21. The settlement system further includes a lower limit setting unit that sets a lower limit of the risk rating of the user based on the risk rating information. The risk rating information acquisition unit updates the risk rating information based on the lower limit of the user. The settlement system according to any one of claims 1 to 4.

22. The service providing unit restricts the use of the settlement service by the user with a relatively high risk rating more than the use of the settlement service by the user with a relatively low risk rating. The settlement system according to any one of claims 1 to 4.

23. The user information acquisition unit acquires the user information from another service different from the settlement service based on user identification information capable of identifying the user. The settlement system according to any one of claims 1 to 4.

24. A user information acquisition step in which a user information acquisition unit acquires user information regarding the user, including the nationality of the user who uses a settlement service in which settlement is performed based on an electronic settlement means; A risk rating information acquisition step in which a risk rating information acquisition unit acquires risk rating information regarding the risk rating of fraud by the user in the settlement service based on the nationality of the user included in the user information; A service providing step in which a service providing unit restricts the withdrawal, charging, sending or receiving of electronic money to the user based on the risk rating information and provides the settlement service; including In the user information acquisition step, the user information acquisition unit acquires at least one of user personal information regarding the user himself and user usage information regarding the use of the settlement service by the user as the user information. In the risk rating information acquisition step, the risk rating information acquisition unit acquires the risk rating information based on at least one of the user personal information and the user usage information. Payment method.

25. A user information acquisition unit that acquires user information regarding a user, including the nationality of the user who uses a payment service in which payment based on an electronic payment means is performed. A risk rating information acquisition unit that acquires risk rating information regarding risk rating of fraud by the user in the payment service based on the nationality of the user included in the user information. A service providing unit that provides the payment service by restricting withdrawal, charging, sending, or receiving of electronic money to the user based on the risk rating information. Function the computer as, The user information acquisition unit acquires at least one of user personal information regarding the user himself / herself and user usage information regarding the use of the payment service by the user as the user information. The risk rating information acquisition unit acquires the risk rating information based on at least one of the user personal information and the user usage information. Program.

Images