Information processing apparatus, information processing method, and information processing program

Abstract

Reduce the opportunity loss in a predetermined transaction means for conducting a monetary transaction. 【Solution means】The information processing apparatus according to the present application includes a classification unit and a determination unit. The classification unit classifies the type of fraud in a transaction where fraud has been detected. The determination unit determines the content to be provided to the user to be reviewed based on the review status of the type of fraud classified by the classification unit.

Description

Technical Field

[0001] The present invention relates to an information processing apparatus, an information processing method, and an information processing program.

Background Art

[0002] Techniques for monitoring money transaction information via financial institutions are known. For example, techniques for monitoring transaction information using classification conditions are known.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] Here, when a transaction is suspected of being fraudulent or when a transaction becomes a target of a predetermined review, the transaction cannot be conducted until the review is completed. However, in the conventional technology, only the fact that the review is in progress is provided to the user who conducts the transaction, so there is a risk that the user will select another transaction means and an opportunity loss will occur.

[0005] The present application has been made in view of the above, and an object thereof is to reduce an opportunity loss in a predetermined transaction means for conducting a money transaction.

Means for Solving the Problems

[0006] The information processing apparatus according to the present application includes a classification unit that classifies the type of fraud of a transaction in which fraud is detected, and a determination unit that determines content to be provided to a user who is a review target based on the review status of the type of fraud classified by the classification unit.

Effects of the Invention

[0007] According to one aspect of the embodiment, it is possible to achieve the effect of reducing the opportunity loss in a predetermined transaction means for conducting a monetary transaction.

Brief Description of the Drawings

[0008]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5A

Figure 5B

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Modes for Carrying Out the Invention

[0009] Hereinafter, embodiments for implementing the information processing apparatus, information processing method, and information processing program according to the present application (hereinafter referred to as "embodiments") will be described in detail with reference to the drawings. Note that the information processing apparatus, information processing method, and information processing program according to the present application are not limited by these embodiments. Also, in the following embodiments, the same parts are denoted by the same reference numerals, and redundant descriptions are omitted.

[0010] (Embodiment) [1. Overview of Information Processing] Conventionally, techniques for monitoring money transaction information via financial institutions are known. For example, techniques for monitoring transaction information using classification conditions are known.

[0011] Also, when fraud is detected, content CX as shown in FIG. 1 is displayed to notify that a transaction such as a payment has failed and that the use is restricted. Content CX is content that is uniformly displayed when fraud is detected regardless of the review status. Even when content CX is displayed, it is unclear to the user how to handle it, which can also be a source of stress.

[0012] In the conventional technology, it is not possible to distribute and display content to users subject to review according to the review status, and the content shown in FIG. 1 is not content according to the review status, so it was not possible to reduce the opportunity loss in a predetermined transaction means for conducting a money transaction.

[0013] In the following embodiments, the money transaction is a settlement (for example, a settlement at the time of purchasing a product, etc.), and the process when fraud is detected in the settlement will be described as an example. However, the money transaction can be any transaction in which money moves (for example, a transaction that affects not only a certain user but also the funds of other users), and can be, for example, a money transfer or a withdrawal. For example, it can be a money transfer that moves money from the financial account of a certain user to the financial account of another user. Also, for example, it can be a withdrawal by cashing electronic money via an ATM.

[0014] When the money transaction is a remittance, it is the detection of fraud for the remittance. When the money transaction is a withdrawal, it is the detection of fraud for the withdrawal. Even when the money transaction is a remittance or a withdrawal, the same processing as in the case of settlement is performed, but the content displayed to the user and the conditions for dividing the content may be different.

[0015] In the following embodiments, the settlement may be based on any settlement process, may be an electronic settlement via a predetermined application (which may also be a mini - application), or may be a settlement involving login.

[0016] In the following embodiments, when fraud is detected, the review (monitoring) is manually determined by an operator (reviewer). Here, it is determined whether it is a malicious transaction, a transaction of a legitimate user due to a simple false detection, etc. The review status such as the time required for monitoring may be observed regularly, for example, observed hourly.

[0017] [2. Configuration of the Information Processing System] The information processing system 1 shown in FIG. 2 will be described. As shown in FIG. 2, the information processing system 1 includes a terminal device 10 and an information processing device 100. The terminal device 10 and the information processing device 100 are communicably connected by wire or wirelessly via a predetermined communication network (network N). FIG. 2 is a diagram showing a configuration example of the information processing system 1 according to the embodiment.

[0018] The terminal device 10 is an information processing device used by a user who has been detected as having fraud and is subject to review. For example, when attempting to make a settlement for a commodity purchase (for example, when pressing the purchase button), it is an information processing device used by a user who has been detected as having fraud for that settlement and is subject to review. By monitoring whether it is an illegal transaction, if fraud is detected, the transaction can be changed to a state where transactions cannot be made on a user - by - user basis.

[0019] The terminal device 10 may be any device as long as it can implement the processing in the embodiment. Further, the terminal device 10 may be a device such as a smartphone, a tablet terminal, a notebook PC, a desktop PC, a mobile phone, or a PDA. In FIG. 2, the case where the terminal device 10 is a smartphone is shown.

[0020] The terminal device 10 is a smart device such as a smartphone or a tablet, and is a portable terminal device that can communicate with any server device via a wireless communication network such as 4G to 5G (Generation) or LTE (Long Term Evolution). Further, the terminal device 10 has a screen such as a liquid crystal display, and has a screen having a touch panel function, and may receive various operations on display data such as content, such as a tap operation, a slide operation, and a scroll operation, by a finger or a stylus from the user. In FIG. 3, the terminal device 10 is used by the user U1.

[0021] The information processing device 100 is an information processing device aimed at reducing the opportunity loss in a predetermined transaction means for conducting a monetary transaction, and may be any device as long as it can implement the processing in the embodiment. The information processing device 100 is realized by, for example, a server device or a cloud system, and executes the information processing according to the embodiment.

[0022] The information processing device 100 performs processing for distributing and displaying content to the user to be reviewed according to the review status such as the required time for monitoring. For example, the information processing device 100 detects fraud, classifies the types of fraud, and determines the content to be provided to the user to be reviewed based on the review status for each classified type of fraud. Since the review content (review scenario) is determined by the classified type of fraud, the type of fraud may be appropriately read as "review scenario" or the like as appropriate.

[0023] As a variation, the information processing apparatus 100 may perform processing for distributing and displaying content to the user to be reviewed according to the time-series change of the required time for monitoring (time-series change based on two or more pieces of data).

[0024] Furthermore, as a variation, the information processing apparatus 100 may perform processing for distributing and displaying content to the user to be reviewed in consideration of user attributes, settlement store information (such as store location and category), settlement amount, and the like.

[0025] [3. An Example of Information Processing] FIG. 3 is a diagram showing an example of information processing according to the embodiment. In FIG. 3, it is assumed that the user U1 performs a settlement operation for purchasing a product at the store P1 (which may be a physical store or an online store) (step S1), and fraud is detected.

[0026] The information processing apparatus 100 determines whether or not the conditions of the fraud rule are met, rejects (rejects) the transactions that meet the conditions, and permits (establishes) the transactions that do not meet the conditions. In FIG. 3, it is assumed that the information processing apparatus 100 acquires the settlement information of the settlement transaction D1 of the user U1 (step S11), and determines that the settlement transaction D1 meets the fraud rule (step S12).

[0027] The information processing apparatus 100 individually determines whether or not the conditions of one or more pre-selected fraud rules are met for each condition. In step S12, it is assumed that the information processing apparatus 100 determines that the settlement transaction D1 of the user U1 meets the fraud rule R1 among the two pre-selected fraud rules. Thereby, the information processing apparatus 100 can identify the type of fraud. For example, when the information processing apparatus 100 meets the fraud rule R1, it can identify that the type of fraud is "Fraud 1".

[0028] For illegal rules, time is pre-associated for distributing the content provided to users determined to meet the conditions of the illegal rules. This time is the required time for the monitoring to determine whether it is illegal. For example, it is the time set based on the review status for each type of illegality. For example, it is the time calculated in advance based on the data obtained during a predetermined period.

[0029] Figure 4 is a diagram showing the relationship between illegal rules, types of illegality, required time, and the number of interfering users. In Figure 4, illegal rules such as R1 to R4 are included in the illegal rule list L1. The type of illegality of illegal rule R1 is "Illegality 1", and the required time for the monitoring to determine whether it corresponds to Illegality 1 is "Required t1". Note that the type of illegality of illegal rule R2 is "Illegality 2", and the required time for the monitoring to determine whether it corresponds to Illegality 2 is "Required t2". Required t1, required t2, etc. are predetermined fractions. For example, required t1, required t2, etc. are the average review required fractions. For example, required t1, required t2, etc. are the average review required fractions calculated in advance based on the data obtained during a predetermined period. Required t1, required t2, etc. may vary according to the review status of other types of illegality. Also, the number of interfering users is, for example, the average number of interfering users per month. The average number of interfering users obstructed by Illegality 1 is "Interference 1", and the average number of interfering users obstructed by Illegality 2 is "Interference 2".

[0030] The information processing apparatus 100 determines the required time for the current monitoring (step S13) using the required time associated with the determined matching illegal rule as a reference (threshold). The information processing apparatus 100 determines whether the required time for the current monitoring exceeds the required t1 associated with the illegal rule R1 that matched in the settlement transaction D1 of the user U1. The required time for the current monitoring depends on the status (backlog status) of the operations of the operator who determines whether it corresponds to illegality. For example, in a busy situation, the status of the operations is likely to be backlogged, and the required time for the monitoring is likely to be longer than usual.

[0031] The information processing apparatus 100 distributes the content based on whether the required time exceeds the required time t1. When the required time does not exceed the required time t1, the information processing apparatus 100 provides the content C1 that notifies that the payment operation will be performed again after the time tx close to the required time t1 (step S14a). The time tx may be a time adjusted to be at least greater than the required time t1. The information processing apparatus 100 provides the content C1 that notifies, for example, as shown in FIG. 5A, that a transaction such as a payment has failed and is under review, and that the payment operation will be performed again after the time tx.

[0032] On the other hand, when the required time exceeds the required time t1, it is considered that the situation is busier than usual and the operator's business situation is stagnant. In this case, the information processing apparatus 100 provides the content C2 that notifies that the payment operation will be performed again after the time ty away from the required time t1 (step S14b). The time ty may be a time adjusted to be at least greater than the time tx. The information processing apparatus 100 provides the content C2 that notifies, for example, as shown in FIG. 5B, that a transaction such as a payment has failed and is under review, and that the payment operation will be performed again after the time ty.

[0033] By distributing the content based on whether it exceeds the required time t1, the information processing apparatus 100 can effectively prevent the user's opportunity loss. In the content CX as shown in FIG. 1, it is unclear to the user how to handle it, and especially in a busy situation, the same operation may be performed many times in a short time and fail, which may also cause stress to the user. By distributing the content, it is clear how long to wait before performing the payment operation again, so the user can perform the payment operation at the time according to the notification, and the stress can be reduced.

[0034] In the above embodiment, the required time t1, the time tx, and the time ty can be any values and can be determined in any way. The required time t1, the time tx, and the time ty may be appropriately set according to, for example, tests or evaluations of actual deliveries. For example, they may be set to optimal values (values with the highest evaluations or values estimated to have the highest evaluations, etc.) according to tests or evaluations of actual deliveries.

[0035] Hereinafter, Variation 1 of information processing will be described. In step S13, the information processing apparatus 100 may perform content allocation according to the time-series change of the required time for monitoring.

[0036] The information processing apparatus 100 may determine the required time for monitoring at a plurality of recent time points based on the required time associated with the fraud rule determined to match. Hereinafter, the information processing apparatus 100 will determine the required time for monitoring at two time points (which may also be ranges), that is, the required time for monitoring at the most recent z1 time point (which may also be a range based on the z1 time point) and the required time for monitoring at the most recent z2 time point (which may also be a range based on the z2 time point). The number of time points (which may also be ranges) to be determined is not limited to this example. For example, content allocation may be performed considering the time-series change of the required time at three time points, namely, the most recent z1 time point, the most recent z2 time point, and the most recent z3 time point.

[0037] The plurality of time points to be the object of this determination are preset and may be set for each fraud rule. When set for each fraud rule, the time point associated with the fraud rule R1 that matched in the settlement transaction D1 of the user U1 will be applied. For example, in the fraud rule R1, the most recent z1 time point and the most recent z2 time point are applied, while in the fraud rule R2, the most recent z3 time point and the most recent z4 time point may be applied.

[0038] In Variation 1, the time required for monitoring at these two time points is compared with the reference time required. Specifically, a combination of the comparison result between the time required for monitoring at the most recent time point z1 and the reference time required, and the comparison result between the time required for monitoring at the most recent time point z2 and the reference time required is determined. Then, the content is sorted based on this combination.

[0039] The information processing apparatus 100 determines whether the time required for monitoring at the most recent time point z1 exceeds the required time t1 associated with the fraud rule R1 that matched in the settlement transaction D1 of the user U1, and also determines whether the time required for monitoring at the most recent time point z2 exceeds the required time t1 associated with the fraud rule R1 that matched in the settlement transaction D1 of the user U1.

[0040] The information processing apparatus 100 sorts the content based on the combination of whether it exceeds the required time t1. Specifically, when the comparison result between the time required for monitoring at a plurality of time points and the reference time required reverses at a certain time point among the plurality of time points, the information processing apparatus 100 performs content switching processing. For example, when it does not exceed the required time t1 at the most recent time point z1 but exceeds the required time t1 at the most recent time point z2, or when it exceeds the required time t1 at the most recent time point z1 but does not exceed the required time t1 at the most recent time point z2.

[0041] On the other hand, when the comparison result between the time required for monitoring at a plurality of time points and the reference time required does not reverse at a plurality of time points, the information processing apparatus 100 does not perform content switching processing. In this case, the same content will be displayed. For example, when it does not exceed the required time t1 at the most recent time point z1 and also does not exceed the required time t1 at the most recent time point z2, or when it exceeds the required time t1 at the most recent time point z1 and also exceeds the required time t1 at the most recent time point z2.

[0042] The information processing apparatus 100 determines whether to perform content switching processing by determining whether the comparison result between the required time for monitoring at a plurality of time points and the reference required time reverses at a certain time point among the plurality of time points, thereby performing content differentiation. When the number of determination time points is two, there are four combinations of content switching processing, and the differentiable content is two types (content in the busy case and content in the non-busy case).

[0043] When the required time t1 is not exceeded at the most recent z1 time point and the required time t1 is not exceeded at the most recent z2 time point either, the information processing apparatus 100 provides content notifying that a payment operation will be performed again after a time tx close to the required time t1. Even when the required time t1 is exceeded at the most recent z1 time point but the required time t1 is not exceeded at the most recent z2 time point, the information processing apparatus 100 provides content notifying that a payment operation will be performed again after a time tx close to the required time t1. However, in the latter case, the information processing apparatus 100 involves content switching processing. For example, as shown in FIG. 5A, the information processing apparatus 100 provides content C1 notifying that a transaction such as a payment has failed and is under transaction review, and notifying that a payment operation will be performed again after a time tx.

[0044] When the required time t1 is exceeded at the most recent z1 time point and the required time t1 is exceeded at the most recent z2 time point as well, the information processing apparatus 100 provides content notifying that a payment operation will be performed again after a time ty away from the required time t1. Even when the required time t1 is not exceeded at the most recent z1 time point but the required time t1 is exceeded at the most recent z2 time point, the information processing apparatus 100 provides content notifying that a payment operation will be performed again after a time ty away from the required time t1. However, in the latter case, the information processing apparatus 100 involves content switching processing. For example, as shown in FIG. 5B, the information processing apparatus 100 provides content C2 notifying that a transaction such as a payment has failed and is under transaction review, and notifying that a payment operation will be performed again after a time ty.

[0045] As a result, the information processing apparatus 100 can automatically switch the content. The information processing apparatus 100 may automatically switch the content by associating a database that records the required time for monitoring with a flag that instructs to switch the content when crossing the required time t1. For example, the information processing apparatus 100 may assign a flag that instructs to switch to data exceeding the required time t1 so that the content can be automatically switched.

[0046] As a further variation, the information processing apparatus 100 may switch the content before crossing the required time t1 when it is likely to cross the required time t1, taking into account the time-series change of the required time for monitoring at multiple time points. When it can be inferred that the required time for monitoring is increasing and becoming busier at three time points, namely the most recent z1 time point, the most recent z2 time point, and the most recent z3 time point, the information processing apparatus 100 may switch the content before crossing the required time t1 so as to be able to provide the content C2. On the other hand, when it can be inferred that the required time for monitoring is decreasing and returning to normal at three time points, namely the most recent z1 time point, the most recent z2 time point, and the most recent z3 time point, the information processing apparatus 100 may switch the content before crossing the required time t1 so as to be able to provide the content C1.

[0047] Next, Variation 2 of the information processing will be described. In step S13, the information processing apparatus 100 may distribute the content in consideration of user attributes, payment store information, payment amount, and the like.

[0048] The information processing apparatus 100 uses the required time associated with the identified unauthorized rule as a reference, but may change the reference required time in consideration of user attributes, payment store information, payment amount, and the like. The information processing apparatus 100 acquires or estimates user attributes, payment store information, payment amount, and the like from the payment information, and changes the reference required time based on the acquired or estimated user attributes, payment store information, payment amount, and the like, and may perform content distribution. The information processing apparatus 100 may change the reference required time and perform content distribution based on the processing described above in information processing variation 1.

[0049] For example, it is assumed that a user with a short-tempered personality or a user in a hurry cannot even wait for time tx, so the information processing apparatus 100 may shorten the reference required time. Thereby, the information processing apparatus 100 can actively provide content C2 to a user with a short-tempered personality or a user in a hurry. The information processing apparatus 100 may estimate user attributes in any way, and may estimate not only from payment information but also from purchase history and the like.

[0050] For example, in the case of payment at a convenience store, it is assumed that the user cannot even wait for time tx, so the information processing apparatus 100 may shorten the reference required time. Thereby, the information processing apparatus 100 can actively provide content C2 in the case of payment at a convenience store. On the other hand, for example, in the case of payment at a restaurant, it is assumed that the user can wait at least for time tx, so the information processing apparatus 100 may lengthen the reference required time. Thereby, the information processing apparatus 100 can actively provide content C1 in the case of payment at a restaurant.

[0051] When the settlement amount is small, for example, the information processing apparatus 100 may be assumed not to be able to wait even for time tx, so the reference required time may be shortened. As a result, when the settlement amount is small, the information processing apparatus 100 can actively provide the content C2. On the other hand, when the settlement amount is large, for example, the information processing apparatus 100 may be assumed to be able to wait at least for time tx, so the reference required time may be lengthened. As a result, when the settlement amount is large, the information processing apparatus 100 can actively provide the content C1.

[0052] When the information processing apparatus 100 acquires or estimates user attributes, settlement store information, settlement amounts, etc., it may change the reference required time based on the weights predetermined for each. Also, the weighting for each may be determined on a per-user basis.

[0053] Hereinafter, other variations of information processing will be described. In the above embodiment, the case where the content C1 notifying that the settlement operation is to be performed again after time tx and the content C2 notifying that the settlement operation is to be performed again after time ty are separated has been described as an example. However, the language notified by the content C1 or the content C2 is not limited to this example. Instead of notifying that the settlement operation is to be performed again, content notifying that it waits in this state may be separated. For example, the content C1 notifying that it waits in this state for time tx because the current transaction is under review and the content C2 notifying that it waits in this state for time ty because the current transaction is under review may be separated. In this way, the content C1 and the content C2 with different review situations to be described may be separated.

[0054] In the above embodiment, the time ty does not have to be a specific fraction, and may be a phrase such as "after waiting for a while" or may be vague information. The content C1 with the waiting time described and the content C2 without the waiting time described may be separated.

[0055] In the above embodiment, the content switching may be automatically performed by the information processing apparatus 100 or the like, or may be manually performed by an operator. In the latter case, the information processing apparatus 100 notifies the operator of a warning at a timing when the comparison result is reversed at a certain point in time among a plurality of time points. For example, the information processing apparatus 100 notifies at a timing when the business situation changes from normal to busy or from busy to normal. When the operator makes a determination based on the warning and switches the content, the content after the switch is provided. For example, when changing from normal to busy and the operator makes a switch based on the warning, content C2 is provided from the switched timing. Similarly, when changing from busy to normal and the operator makes a switch based on the warning, content C1 is provided from the switched timing.

[0056] [4. Configuration of Terminal Device] Next, with reference to FIG. 6, the configuration of the terminal device 10 according to the embodiment will be described. FIG. 6 is a diagram showing a configuration example of the terminal device 10 according to the embodiment. As shown in FIG. 6, the terminal device 10 includes a communication unit 11, an input unit 12, an output unit 13, and a control unit 14.

[0057] (Communication Unit 11) The communication unit 11 is realized by, for example, a NIC (Network Interface Card) or the like. Then, the communication unit 11 is connected to a predetermined network N by wire or wirelessly, and information is transmitted and received between the communication unit 11 and the information processing apparatus 100 or the like via the predetermined network N.

[0058] (Input Unit 12) The input unit 12 receives various operations from the user. In FIG. 4 and the like, the input unit 12 receives various operations from the user U1. For example, the input unit 12 may receive various operations from the user via the display surface by a touch panel function. Further, the input unit 12 may receive various operations from buttons provided on the terminal device 10 or from a keyboard or mouse connected to the terminal device 10.

[0059] (Output Unit 13) The output unit 13 is a display screen such as a tablet terminal realized by, for example, a liquid crystal display or an organic EL (Electro-Luminescence) display, and is a display device for displaying various information. For example, the output unit 13 displays information (contents according to the illegal review status: contents C1, contents C2, etc.) transmitted from the information processing device 100.

[0060] (Control unit 14) The control unit 14 is, for example, a controller, and is realized by various programs stored in the storage device inside the terminal device 10 being executed with the RAM (Random Access Memory) as a work area by a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or the like. For example, these various programs include the programs of applications installed in the terminal device 10. For example, these various programs include the programs of applications for displaying information transmitted from the information processing device 100. Further, the control unit 14 is realized by an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0061] As shown in FIG. 6, the control unit 14 has a receiving unit 141 and a transmitting unit 142, and realizes or executes the operations of information processing described below.

[0062] (Receiving unit 141) The receiving unit 141 receives, for example, information transmitted from the information processing device 100. For example, the receiving unit 141 receives information for displaying contents (contents C1, contents C2, etc.) according to the illegal review status transmitted from the information processing device 100.

[0063] (Transmitting unit 142) The transmitting unit 142 transmits, for example, the user's payment information. For example, the transmitting unit 142 transmits the payment information for product purchase during a payment operation for product purchase.

[0064] [5. Configuration of Information Processing Apparatus] Next, the configuration of the information processing apparatus 100 according to the embodiment will be described with reference to FIG. 7. FIG. 7 is a diagram showing a configuration example of the information processing apparatus 100 according to the embodiment. As shown in FIG. 7, the information processing apparatus 100 includes a communication unit 110, a storage unit 120, and a control unit 130. Note that the information processing apparatus 100 may include an input unit (for example, a keyboard or a mouse) that receives various operations from the administrator of the information processing apparatus 100, and a display unit (for example, a liquid crystal display) that displays various information.

[0065] (Communication Unit 110) The communication unit 110 is realized by, for example, a NIC or the like. Then, the communication unit 110 is connected to the network N by wire or wirelessly, and performs information transmission and reception with the terminal device 10 or the like via the network N.

[0066] (Storage Unit 120) The storage unit 120 is realized by, for example, a semiconductor memory element such as a RAM or a flash memory, or a storage device such as a hard disk or an optical disk. As shown in FIG. 7, the storage unit 120 includes a review result storage unit 121 and an illegal rule storage unit 122.

[0067] The review result storage unit 121 stores the review results for each settlement transaction (case) in which fraud is detected. Here, FIG. 8 shows an example of the review result storage unit 121 according to the embodiment. The information stored in the review result storage unit 121 is used, for example, to calculate the required time for monitoring. As shown in FIG. 8, the review result storage unit 121 has items such as "settlement transaction ID", "operator ID", "judgment result", and "required time".

[0068] The "Settlement Transaction ID" indicates identification information for identifying the settlement transaction in which fraud has been detected. The "Operator ID" indicates identification information for identifying the operator (person in charge) responsible for monitoring the corresponding settlement transaction. One or more operators are in charge of each settlement transaction in which fraud has been detected. The "Judgment Result" indicates the judgment result (such as whether it was a malicious transaction or just a false detection). The "Required Time" indicates the required time taken for monitoring. In FIG. 8, it shows that the required time taken for monitoring settlement transaction D1 is "Required ta" minutes, and the required time taken for monitoring settlement transaction D2 is "Required tb" minutes.

[0069] For the "Required Time", for example, the time from the timing when fraud is detected and review is raised to the timing when the operator writes the review result is stored. The required time may be automatically calculated when the operator leaves a log in the entry column for the judgment result. For example, the required time may be calculated at the timing when the operator writes the review result in the entry column for the judgment result and the input is completed. This is not limited to this example, and the required time may be calculated at the timing when the operator writes the review result in the entry column for the judgment result and operates (such as clicks or taps) the review completion button indicating that the review is completed.

[0070] The information stored in the "Required Time" is, for example, aggregated and averaged in units of one hour. This averaged information corresponds to the required time taken for monitoring at a plurality of recent time points (such as the most recent z1 time point and the most recent z2 time point) according to the above embodiment.

[0071] The fraud rule storage unit 122 stores information regarding fraud rules for detecting fraud. Here, FIG. 9 shows an example of the fraud rule storage unit 122 according to the embodiment. The information stored in the fraud rule storage unit 122 is used, for example, for detecting fraud, identifying the type of fraud, and obtaining the reference required time for each type of fraud. As shown in FIG. 9, the fraud rule storage unit 122 has items such as "Fraud Rule ID", "Matching Conditions", "Type of Fraud", and "Average Review Required Time".

[0072] "Illegitimate rule ID" indicates the identification information for identifying an illegitimate rule. "Matching condition" indicates the condition for determining whether it matches the corresponding illegitimate rule. In the example shown in FIG. 9, an example is shown where conceptual information such as "matching condition #1" and "matching condition #2" is stored in the "matching condition", but actually, information indicating the condition is stored. "Type of illegitimacy" indicates the type of illegitimacy. "Average review time required" indicates the average time required for the monitoring to determine whether it corresponds to the illegitimacy of the corresponding type. In FIG. 9, it shows that the average review time required associated with the illegitimate rule R1 is "required t1" minutes, and the average review time required associated with the illegitimate rule R2 is "required t2" minutes.

[0073] (Control unit 130) The control unit 130 is a controller, and is realized, for example, by various programs stored in the storage device inside the information processing device 100 being executed with the RAM as the working area by a CPU, MPU, etc. Also, the control unit 130 is realized by an integrated circuit such as an ASIC or FPGA.

[0074] As shown in FIG. 7, the control unit 130 has an acquisition unit 131, a classification unit 132, a calculation unit 133, a determination unit 134, a decision unit 135, and a provision unit 136, and realizes or executes the information processing operations described below. Note that the internal configuration of the control unit 130 is not limited to the configuration shown in FIG. 7, and other configurations may be used as long as they perform the information processing described later.

[0075] (Acquisition unit 131) The acquisition unit 131 acquires various information from the storage unit 120. The acquisition unit 131 stores the acquired various information in the storage unit 120.

[0076] The acquisition unit 131 acquires various information from an external information processing device. The acquisition unit 131 acquires various information from other information processing devices such as the terminal device 10.

[0077] The acquisition unit 131 acquires, for example, transaction information. For example, the acquisition unit 131 acquires transaction information of transactions made by the user. For example, the acquisition unit 131 acquires settlement information of settlement transactions made by the user. For example, the acquisition unit 131 acquires information obtained or estimated based on the settlement information of the settlement transactions made by the user.

[0078] The acquisition unit 131 acquires, for example, transaction information of transactions in which fraud has been detected. For example, the acquisition unit 131 acquires settlement information of settlement transactions in which fraud has been detected. For example, the acquisition unit 131 acquires information obtained or estimated based on the settlement information of the settlement transactions in which fraud has been detected.

[0079] The acquisition unit 131 acquires, for example, transaction information of the user subject to review. For example, the acquisition unit 131 acquires the past transaction history of the user subject to review. For example, the acquisition unit 131 acquires the past transaction history of the user at the corresponding store.

[0080] (Classification unit 132) The classification unit 132 classifies (identifies), for example, the type of fraud. For example, the classification unit 132 classifies the type of fraud based on the information stored in the fraud rule storage unit 122. For example, the classification unit 132 classifies the type of fraud based on the information stored in the fraud rule storage unit 122 and the transaction information acquired by the acquisition unit 131. The classification unit 132 detects fraud and classifies the type of fraud, for example. The classification unit 132 classifies the type of fraud of the transaction in which fraud has been detected, for example. The classification unit 132 classifies the type of fraud based on the determination result by the determination unit 134 described later, for example.

[0081] When fraud is detected, the classification unit 132 rejects the transaction and classifies the type of fraud, and when fraud is not detected, the classification unit 132 permits the transaction. The classification unit 132 rejects the transaction for the transaction in which fraud has been detected and classifies the type of fraud, and permits the transaction for the transaction in which fraud has not been detected.

[0082] (Calculation unit 133) The calculation unit 133 calculates, for example, the time required for monitoring. For example, the calculation unit 133 calculates the time required for monitoring based on the information stored in the examination result storage unit 121. For example, the calculation unit 133 calculates the time required for the current monitoring. Also, for example, the calculation unit 133 calculates the time required for monitoring at a plurality of recent time points. The calculation unit 133 calculates, for example, the average time required for monitoring in a predetermined time unit by aggregating and averaging the corresponding data. The calculation unit 133 calculates, for example, the time required for monitoring for each type of fraud classified by the classification unit 132. The calculation unit 133 calculates, for example, the probability that the comparison result between the time required for monitoring and the time required for the matching fraud rule will reverse at a certain future point within a predetermined period, taking into account the time-series change in the time required for monitoring at a plurality of time points.

[0083] (Determination unit 134) The determination unit 134 determines, for example, whether or not it meets the conditions of the fraud rule. For example, the determination unit 134 determines to reject the matching transaction and permit the non-matching transaction. The determination unit 134 individually determines, for example, whether or not it meets the conditions of one or more pre-selected fraud rules for each condition.

[0084] The determination unit 134 determines, for example, the time required for monitoring based on the time required for the matching fraud rule as a reference. For example, the determination unit 134 determines whether or not the time required for monitoring exceeds the time required for the matching fraud rule.

[0085] The determination unit 134 determines, for example, the time required for monitoring at a plurality of recent time points. The determination unit 134 determines, for example, the comparison result between the time required for monitoring at a plurality of recent time points and the time required for the matching fraud rule. The determination unit 134 determines, for example, the combination of the comparison results between the time required for monitoring at a plurality of recent time points and the time required for the matching fraud rule.

[0086] The determination unit 134 determines, for example, whether or not the comparison result between the required time for monitoring at a plurality of recent time points and the required time associated with the matched illegal rule reverses at a certain time point among the plurality of time points. The determination unit 134 determines, for example, whether or not to perform content switching processing based on whether or not the comparison result between the required time for monitoring at a plurality of recent time points and the required time associated with the matched illegal rule reverses at a certain time point among the plurality of time points.

[0087] The determination unit 134 determines, for example, whether or not to perform content switching processing by estimating whether or not it will reverse at a certain time point to be observed in the future in consideration of the time-series change of the required time for monitoring at a plurality of time points.

[0088] The determination unit 134 changes, for example, the required time associated with the matched illegal rule in consideration of the transaction information, and determines the comparison result with the changed required time. The determination unit 134 determines, for example, whether or not to perform content switching processing based on whether or not the comparison result with the changed required time reverses at a certain time point in consideration of the transaction information.

[0089] (Decision-making unit 135) The decision-making unit 135 determines, for example, the content to be provided to the corresponding user. For example, the decision-making unit 135 determines the content to be provided to the corresponding user based on the determination result by the determination unit 134. For example, the decision-making unit 135 determines the content to be provided to the corresponding user based on the determination result of whether or not to perform content switching processing by the determination unit 134. For example, the decision-making unit 135 determines which of content C1 and content C2 to provide.

[0090] The determination unit 135 determines the content to be provided to the corresponding user based on, for example, the comparison result between the required time for monitoring and the required time associated with the matching unauthorized rule. Specifically, the determination unit 135 determines the content to be provided to the corresponding user based on the comparison result between the required time for monitoring for the type of unauthorized activity and a predetermined threshold value set based on the review status of the type of unauthorized activity. For example, the determination unit 135 determines the content to be provided to the corresponding user based on whether the comparison result reverses at a certain point among a plurality of recent time points. Also, for example, the determination unit 135 determines the content to be provided to the corresponding user based on the probability of reversal at a future point in time. For example, when the probability of reversal at a future point in time within a predetermined period is high, the determination unit 135 determines to provide the content after the reversal, and when the probability of reversal at a future point in time within a predetermined period is low, the determination unit 135 determines to provide the currently provided content. Also, for example, the determination unit 135 determines the content to be provided to the corresponding user based on the comparison result with a predetermined threshold value changed based on the transaction information acquired by the acquisition unit 131.

[0091] (Provision unit 136) The provision unit 136 provides (transmits), for example, the content determined by the determination unit 135 to the corresponding user. The provision unit 136 provides, for example, information for causing the corresponding user to display the content determined by the determination unit 135. For example, the provision unit 136 provides the corresponding user with information for causing the content determined by the determination unit 135 to be displayed on the display screen of the terminal device 10 of the corresponding user.

[0092] [6. Information processing flow] Next, with reference to FIG. 10, the information processing procedure by the information processing system 1 according to the embodiment will be described. FIG. 10 is a flowchart showing the information processing procedure according to the embodiment.

[0093] As shown in FIG. 10, when the information processing apparatus 100 acquires transaction information, it determines whether there is any fraud in the transaction based on the acquired transaction information (step S101). If the information processing apparatus 100 determines that there is fraud (step S101; YES), it classifies the type of fraud (step S102). On the other hand, if the information processing apparatus 100 determines that there is no fraud (step S101; NO), it permits the transaction (step S103) and ends the information processing.

[0094] Based on the review status of the classified fraud type, the information processing apparatus 100 determines the time required for monitoring (step S104). Specifically, the information processing apparatus 100 determines whether the time required for monitoring exceeds a predetermined threshold set based on the review status of the classified fraud type. If the information processing apparatus 100 determines that the time required for monitoring exceeds the predetermined threshold (step S104; YES), it decides to provide the second content (corresponding to content C2) (step S105). On the other hand, if the information processing apparatus 100 determines that the time required for monitoring does not exceed the predetermined threshold (step S104; NO), it decides to provide the first content (corresponding to content C1) (step S106). Then, the information processing apparatus 100 provides the content decided to be provided (step S107) and ends the information processing.

[0095] [7. Effects] As described above, the information processing apparatus 100 according to the embodiment includes a classification unit 132 and a determination unit 135. The classification unit 132 classifies the type of fraud in the transaction where fraud is detected. The determination unit 135 determines the content to be provided to the user under review based on the review status of the fraud type classified by the classification unit 132.

[0096] As a result, when fraud is detected, for example, the information processing apparatus 100 according to the embodiment enables the user to appropriately understand how to respond and how long to wait, thereby reducing the user's stress. Therefore, the information processing apparatus 100 according to the embodiment can reduce the opportunity loss in a predetermined transaction means for conducting a financial transaction.

[0097] In addition, the classification unit 132 rejects the transaction for the detected fraud, classifies the type of fraud in the transaction, and permits the transaction for the transaction where no fraud is detected.

[0098] As a result, the information processing apparatus 100 according to the embodiment can appropriately allocate whether a transaction becomes a review target by rejecting the transaction detected as fraud and permitting the transaction where no fraud is detected.

[0099] In addition, the determination unit 135 determines the content based on the comparison result between the time required for monitoring the type of fraud and a predetermined threshold value set based on the review status of the type of fraud.

[0100] As a result, the information processing apparatus 100 according to the embodiment can distribute the content according to the review status and notify the user of appropriate information, thereby reducing the user's stress.

[0101] In addition, the determination unit 135 determines the content based on whether the comparison result between the time required and the predetermined threshold value reverses at a certain point among a plurality of recent time points.

[0102] As a result, the information processing apparatus 100 according to the embodiment can switch the content according to the time-series change of the review status, so that the distribution of the content can be performed more efficiently.

[0103] In addition, the determination unit 135 determines the content based on the probability that the comparison result between the time required and the predetermined threshold value will reverse at a certain future point.

[0104] As a result, the information processing apparatus 100 according to the embodiment can, for example, more efficiently perform content sorting by estimating the future examination status according to the chronological change of the examination status.

[0105] In addition, the determination unit 135 determines the content based on a predetermined threshold value changed based on the transaction information of the transaction.

[0106] As a result, the information processing apparatus 100 according to the embodiment can effectively prevent the user's opportunity loss by sorting the content in consideration of various information such as user attributes.

[0107] 〔8. Hardware Configuration〕 In addition, the information processing apparatus 100 according to the above-described embodiment is realized by, for example, a computer 1000 having a configuration as shown in FIG. 11. FIG. 11 is a hardware configuration diagram showing an example of a computer that realizes the functions of the information processing apparatus 100. The computer 1000 includes a CPU 1100, a RAM 1200, a ROM 1300, an HDD 1400, a communication interface (I / F) 1500, an input / output interface (I / F) 1600, and a media interface (I / F) 1700.

[0108] The CPU 1100 operates based on a program stored in the ROM 1300 or the HDD 1400 and controls each part. The ROM 1300 stores a boot program executed by the CPU 1100 when the computer 1000 is started up, a program depending on the hardware of the computer 1000, and the like.

[0109] The HDD 1400 stores a program executed by the CPU 1100 and data used by such a program. The communication interface 1500 acquires data from other devices via a predetermined communication network and sends it to the CPU 1100, and sends data generated by the CPU 1100 to other devices via a predetermined communication network.

[0110] The CPU 1100 controls output devices such as displays and printers, and input devices such as keyboards and mice via the input / output interface 1600. The CPU 1100 acquires data from the input devices via the input / output interface 1600. Further, the CPU 1100 outputs the generated data to the output devices via the input / output interface 1600.

[0111] The media interface 1700 reads a program or data stored in the recording medium 1800 and provides it to the CPU 1100 via the RAM 1200. The CPU 1100 loads such a program from the recording medium 1800 onto the RAM 1200 via the media interface 1700 and executes the loaded program. The recording medium 1800 is, for example, an optical recording medium such as a DVD (Digital Versatile Disc), a PD (Phase change rewritable Disk), a magneto-optical recording medium such as an MO (Magneto-Optical disk), a tape medium, a magnetic recording medium, or a semiconductor memory.

[0112] For example, when the computer 1000 functions as the information processing apparatus 100 according to the embodiment, the CPU 1100 of the computer 1000 realizes the functions of the control unit 130 by executing the program loaded onto the RAM 1200. The CPU 1100 of the computer 1000 reads and executes these programs from the recording medium 1800. As another example, these programs may be acquired from another device via a predetermined communication network.

[0113] 〔9. Others〕 Also, among the processes described in the above embodiments, all or part of the processes described as being automatically performed can be manually performed, or all or part of the processes described as being manually performed can be automatically performed by a known method. In addition, the processing procedures, specific names, and information including various data and parameters shown in the above documents and drawings can be arbitrarily changed unless otherwise specified. For example, the various information shown in each figure is not limited to the illustrated information.

[0114] In addition, each component of each device shown in the drawings is conceptually functional and does not necessarily have to be physically configured as shown in the drawings. That is, the specific form of the distribution and integration of each device is not limited to that shown in the drawings, and all or part of it can be functionally or physically distributed and integrated in any unit according to various loads, usage situations, etc.

[0115] Also, the above-described embodiments can be appropriately combined as long as the processing contents do not conflict.

[0116] As described above, some of the embodiments of the present application have been described in detail with reference to the drawings. However, these are merely examples, and the present invention can be implemented in other forms with various modifications and improvements based on the knowledge of those skilled in the art, including the aspects described in the column of the disclosure of the invention.

[0117] Also, the above-described "section, module, unit" can be read as "means", "circuit", etc. For example, the acquisition unit can be read as an acquisition means or an acquisition circuit.

Explanation of Reference Numerals

[0118] 1 Information processing system 10 Terminal device 11 Communication unit 12 Input unit 13 Output unit 14 Control unit 100 Information processing device 110 Communication unit 120 Memory Unit 121 Examination Result Memory Unit 122 Illegal Rule Memory Unit 130 Control Unit 131 Acquisition Unit 132 Classification Unit 133 Calculation Unit 134 Judgment Unit 135 Decision Unit 136 Provision Unit 141 Reception Unit 142 Transmission Unit N Network

Claims

An information processing apparatus having a function of determining fraud in a settlement transaction, comprising: a determination unit that determines whether or not the settlement information of a settlement transaction determined to be fraudulent by the function matches the conditions of a fraud rule; a classification unit that, based on the fraud rule determined to match the settlement transaction and the type of fraud corresponding to the fraud rule determined to match the settlement transaction by the determination unit, identifies the type of fraud of the settlement transaction and classifies the type of fraud of the settlement transaction; a determination unit that determines content to be provided to a user subject to review based on a comparison result between the time required for monitoring the settlement transaction and a predetermined threshold corresponding to the fraud rule identified by the classification unit, the content being for notifying that the settlement transaction is under review due to the failure of the settlement transaction and that a settlement operation is to be performed again after a predetermined time; An information processing apparatus characterized by comprising the above.

2. The classification unit: rejects the settlement transaction for which fraud has been detected and classifies the type of fraud of the settlement transaction, and permits the settlement transaction for which fraud has not been detected. The information processing apparatus according to claim 1, characterized by the above.

3. The determination unit: determines the content based on whether or not the comparison result between the required time and the predetermined threshold reverses at a certain point among a plurality of recent time points. The information processing apparatus according to claim 1, characterized by the above.

4. The determination unit: determines the content based on the probability that the comparison result between the required time and the predetermined threshold will reverse at a certain point in the future. The information processing apparatus according to claim 1, characterized by the above.

5. The determination unit: determines the content based on the predetermined threshold changed based on the transaction information of the settlement transaction. The information processing apparatus according to claim 1, characterized by the above.

6. An information processing method executed by a computer, including a step of determining fraud in a settlement transaction, comprising: a determination step of determining whether or not the settlement information of a settlement transaction determined to be fraudulent by the step matches the conditions of a fraud rule; a classification step of, based on the fraud rule determined to match the settlement transaction and the type of fraud corresponding to the fraud rule determined to match the settlement transaction by the determination step, identifying the type of fraud of the settlement transaction and classifying the type of fraud of the settlement transaction; Based on the comparison result between the time required for monitoring the settlement transaction and a predetermined threshold corresponding to the fraud rule identified by the classification step, it is content provided to the user under review, and a determination step of determining content for notifying that the settlement transaction is under review due to the failure of the settlement transaction and that a settlement operation is to be performed again after a predetermined time; An information processing method characterized by including the above.

7. An information processing program having a procedure for determining fraud in a settlement transaction, A determination procedure for determining whether the settlement information of the settlement transaction determined to be fraudulent by the above procedure matches the conditions of the fraud rule; By the above determination procedure, identify the fraud rule determined to match the settlement transaction and the type of fraud corresponding to the fraud rule determined to match the settlement transaction, and classify the type of fraud in the settlement transaction; a classification procedure; Based on the comparison result between the time required for monitoring the settlement transaction and a predetermined threshold corresponding to the fraud rule identified by the classification procedure, it is content provided to the user under review, and a determination procedure for determining content for notifying that the settlement transaction is under review due to the failure of the settlement transaction and that a settlement operation is to be performed again after a predetermined time; An information processing program characterized by causing a computer to execute the above.

Images