Determination system, determination method, and program

Abstract

To accurately determine whether the use of a credit card is not intended by the owner.SOLUTION: A determination system comprises: an acquisition unit that acquires operation information in which the type of operations for an electronic settlement application performed by a user when the user uses a credit card from a terminal device in an electronic transaction and information indicating the timing when the operations are performed are associated with each other, and first procedure information indicating the number of the credit card that is manually input and the intention to use the credit card or second procedure information indicating the number of the credit card obtained through image recognition and the intention to use the credit card; and a determination unit that, in making a determination on the first procedure information, determines that the use of the credit card is not intended by the owner of the credit card based on a target time from a first operation to a second operation in the operation information and a first determination condition corresponding to the first procedure information, the condition different from a second determination condition used for a determination on the second procedure information as to whether the use of the credit card is a use not intended by the owner.SELECTED DRAWING: Figure 11

Description

[Technical Field]

[0001] The present invention relates to a determination system, a determination method, and a program. [Background technology]

[0002] Conventionally, a system has been disclosed that predicts the likelihood of a user based on the user's behavior history, and determines the level of authorization for financial transactions based on the prediction result (see Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Publication No. 2021-105817 Summary of the Invention [Problem to be solved by the invention]

[0004] In Patent Document 1, facial recognition is used for transaction activities (such as paying at a store, using internet banking or an automated teller machine), and behavioral history such as the time of day the activity occurred, the address where the activity occurred, and balance inquiries is used, but the behavior when registering a credit card is not taken into consideration. As a result, it is sometimes impossible to determine whether the credit card is being used in an unintended manner by the owner.

[0005] The present invention has been made in consideration of these circumstances, and one of its objectives is to provide a determination system, determination method, and program that can accurately determine whether a credit card is being used in an unintended manner by the owner. [Means for solving the problem]

[0006] One aspect of the present invention is a judgment system that includes: operation information that corresponds the type of operation performed on an electronic payment app by a user when using a credit card in an electronic commerce transaction from a terminal device with information indicating the timing of the operation; an acquisition unit that acquires first procedural information that indicates a manually entered credit card number and an intention to use the credit card, or second procedural information that indicates a credit card number obtained by image recognition and an intention to use the credit card; and a judgment unit that, when making a judgment on the first procedural information, determines that the use of the credit card is unintended by the owner of the credit card based on a target time from a first timing indicating that a first operation, which is an operation in the operation information, was performed to a second timing indicating that a second operation, which is an operation in the operation information, was performed, and a first judgment condition that corresponds to the first procedural information and is a condition different from a second judgment condition used to determine whether the use of the credit card is unintended by the owner of the credit card for the second procedural information. [Effects of the Invention]

[0007] According to one aspect of the present invention, it is possible to provide a determination system, a determination method, and a program that can accurately determine whether a credit card is being used in a manner unintended by the owner. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram illustrating an example of a configuration for realizing an electronic payment service. [Figure 2] FIG. 1 is a diagram illustrating an example of the general flow of electronic payment. [Figure 3] FIG. 2 is a configuration diagram of a payment server 100. [Figure 4] FIG. 2 is a diagram showing an example of the contents of user information 210. [Figure 5] FIG. 10 is a diagram showing an example of the contents of store information 220. [Figure 6] FIG. 2 is a diagram showing an example of an interface screen IM1. [Figure 7]FIG. 10 is a diagram showing an example of an interface screen IM2. [Figure 8] FIG. 10 is a diagram showing an example of an interface screen IM3. [Figure 9] FIG. 10 is a diagram showing an example of an interface screen IM4. [Figure 10] FIG. 2 is a diagram illustrating an example of the functional configuration of a fraud detection server 300. [Figure 11] FIG. 10 is a diagram for explaining details of fraud detection processing. [Figure 12] 10 is a diagram showing an example of the contents of first behavior information 242 and second behavior information 244. FIG. [Figure 13] FIG. 10 is a diagram showing an example of condition information 312. [Figure 14] FIG. 2 is a diagram illustrating an example of a functional configuration included in a user terminal device 10. [Figure 15] 10 is a diagram showing an example of information acquired and generated by the payment server 100. FIG. [Figure 16] FIG. 10 is a diagram showing an example of the contents of condition information 312A. [Figure 17] FIG. 10 is a diagram showing an example of condition information 312B of Modification 2. [Figure 18] FIG. 10 is a diagram showing an example of condition information 312C. [Figure 19] A diagram showing an example of processing of the trained model 214. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, embodiments of a determination system, a determination method, and a program according to the present invention will be described with reference to the drawings.

[0010] The determination system of this embodiment includes an acquisition unit that acquires behavior information indicating user behavior related to an interface screen provided when a user uses a credit card in an electronic commerce transaction from a terminal device, and a determination unit that uses the behavior information acquired by the acquisition unit to determine whether the use of the credit card is unintended by the owner of the credit card.

[0011] "When a user uses a credit card in an electronic commerce transaction from a terminal device" means, for example, when a user uses a credit card in a commerce transaction via a network, such as when using a credit card as a payment means (settlement means) or when registering a credit card as a payment means. Registering a credit card as a payment means also includes registering it as a means for charging electronic money.

[0012] "Behavior information indicating user behavior related to an interface screen" includes operation information such as information on an operation for displaying an interface screen and information on an operation on the interface screen. The operation information includes, for example, information in which information indicating the type of operation is associated with information indicating the timing at which the operation was performed. The behavior information may also be information indicating a target time from a first timing indicating that a first operation, which is an operation in the operation information, has been performed, to a second timing indicating that a second operation, which is an operation in the operation information, has been performed. Hereinafter, an embodiment will be described.

[0013] <Embodiment> [Electronic payment service] FIG. 1 is a diagram showing an example of a configuration for realizing an electronic payment service. The electronic payment service is realized mainly by a user terminal device 10 (payment application 20), a store terminal device 50, a payment server 100, and a fraud detection server 300. The payment server 100 communicates with, for example, one or more user terminal devices 10 and one or more store terminal devices 50 via a network NW. The network NW includes, for example, the Internet, a LAN (Local Area Network), a wireless base station, a provider device, etc. The payment server 100 and the fraud detection server 300 communicate with each other via the network NW. The fraud detection server 300 is an example of a "determination system." All or part of the functional configuration of the fraud detection server 300 may be included in the payment server 100.

[0014] The user terminal device 10 is, for example, a portable terminal device such as a smartphone or tablet terminal. The user terminal device 10 is a computer device having at least an optical reading function (e.g., a camera), a communication function, a display function, an input acceptance function, a program execution function, a position measuring device (GPS), etc. In the following description, the components for realizing these functions will be referred to as the camera, communication device, touch panel, CPU (Central Processing Unit), etc. In the user terminal device 10, a processor such as the CPU executes the payment application 20, which operates in cooperation with the payment server 100 to provide electronic payment services to users. The payment application 20 controls the camera, communication device, touch panel, etc.

[0015] The store terminal device 50 is installed, for example, in a store. The store terminal device 50 is a computer device having at least a product price acquisition function, an optical reading function, a program execution function, and a communication function. The store terminal device 50 may include a so-called POS (Point of Sale) device, and the product price acquisition function and the optical reading function may be realized by the POS device. The store code image 60 is placed in the store and is a code image such as a QR code (registered trademark) printed on a paper or plastic medium. The store code image 60 may also be displayed on a display placed in the store.

[0016] The payment server 100 performs electronic payment based on payment information received from the user terminal device 10 or the store terminal device 50. The payment server 100 performs electronic payment, for example, by increasing or decreasing balance information managed in association with an account number (user identification information) (in other words, by depositing or withdrawing electronic money). Electronic payment may include methods such as revolving payment or credit payment that allow for purchases of a larger amount than the balance information at the time of purchase. Details of the method for registering a credit card used for credit payment or charging electronic money using a credit card and the process by which the fraud detection server 300 determines whether the credit card is appropriate at the time of registration will be described later.

[0017] FIG. 2 is a diagram illustrating the general flow of electronic payment. There may be two patterns for electronic payment: Pattern 1 and Pattern 2. In Pattern 1, first, the payment app 20 is launched on the user terminal device 10, which displays a code image (code information) such as a QR code or barcode. The user holds (presents) the display surface of the user terminal device 10 over the store terminal device 50. The store terminal device 50 decodes the code image using its optical reading function and acquires information such as the account number. The store terminal device 50 then generates payment information (payment request) including a request for electronic payment, the account number, the payment amount, the store ID, etc., and transmits it to the payment server 100. The payment amount information has been acquired in advance by reading a barcode or manually entering it. The payment server 100 performs payment processing based on the received information.

[0018] In pattern 2, the user terminal device 10, with the payment app 20 running, decodes the store code image 60 using its optical reading function. The store code image 60 contains information such as the store name. The user enters the payment amount into the user terminal device 10 on the screen displaying the store name, etc. Then, the user terminal device 10 generates payment information (payment request) including a request for electronic payment, an account number, a payment amount, a store ID, etc., and sends it to the payment server 100. The payment server 100 performs payment processing based on the received information. Note that electronic payment may be performed only in one of the above patterns.

[0019] When the electronic payment is completed, a completion notice is sent from the payment server 100 to the user terminal device 10. In response to the received completion notice, the user terminal device 10 displays a payment completion screen. The completion notice may be in the form of a web page, for example. The payment completion screen may include information such as information about the store where the electronic payment was made, the payment amount, and points (an example of a benefit) awarded to the user as a result of the electronic payment.

[0020] [Payment server] FIG. 3 is a configuration diagram of the payment server 100. The payment server 100 includes, for example, a communication unit 110, a content providing unit 120, a payment processing unit 130, an information processing unit 140, and a storage unit 200. The content providing unit 120, the payment processing unit 130, and the information processing unit 140 are each implemented by a hardware processor, such as a CPU, executing a program (software). Some or all of these components may be implemented by hardware (including circuitry), such as a large-scale integration (LSI), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a graphics processing unit (GPU), or may be implemented by a combination of software and hardware. The program may be stored in advance in a storage device (a storage device with a non-transitory storage medium), such as a hard disk drive (HDD) or flash memory, or may be stored in a removable storage medium (a non-transitory storage medium), such as a DVD or CD-ROM, and installed in the storage device by inserting the storage medium into a drive device.

[0021] The storage unit 200 is a HDD, a flash memory, a RAM (Random Access Memory), etc. The storage unit 200 may be a NAS (Network Attached Storage) device that the payment server 100 can access via a network. The storage unit 200 stores information such as user information 210, store information 220, content information 230, and behavior information 240.

[0022] The communication unit 110 is a communication interface for connecting to the network NW, and is, for example, a network card.

[0023] The content providing unit 120 has, for example, a web server function, and provides information (content) for displaying various screens for electronic payment services, including the payment completion screen described above, to the user terminal device 10. The content providing unit 120 reads out necessary content from the content information 230 as appropriate and provides it to the user terminal device 10. The user terminal device 10 accepts various inputs from the user while content is being played by the payment application 20, and transmits the payment information described above and the like to the payment server 100.

[0024] The payment processing unit 130 performs payment processing based on the payment information transmitted by the user terminal device 10 or the store terminal device 50. The payment processing unit 130 performs payment processing while referring to the user information 210.

[0025] 4 is a diagram showing an example of the contents of user information 210. User information 210 associates, for example, an account number with information such as contact information, charge balance information, payment method information, and payment history information. The contact information is information entered by the user when subscribing to the electronic payment service.

[0026] The charge balance information indicates the balance of electronic money that the user has set by transferring funds from a bank account or the like to the electronic payment service in advance, or by transferring funds using a credit card. The balance information may also be automatically added by an auto-charge associated with the payment process. A deferred payment balance that allows the user to purchase goods or services without making an advance deposit to the electronic payment service, or an amount that can be paid by credit card, may be associated with the user information 210 instead of (or in addition to) the charge balance.

[0027] The multiple payment methods available to users include, for example, payment with a charge balance, payment on delivery, payment by credit card, and other payment methods, such as revolving payments and installment payments offered by electronic payment service providers and stores.

[0028] The payment history information is information that indicates the details of payments made by the user (date and time, store ID of the store where the purchase was made, payment amount, etc.) for each electronic payment.

[0029] Information about stores is managed as store information 220. FIG. 5 is a diagram showing an example of the contents of store information 220. Store information 220 associates information such as store category, location, and payment pattern with a store ID, for example. Store category may be one-level information, or may be information with a hierarchical structure of two or more levels. For example, information such as "Japanese cuisine," "restaurant," or "eatery" may be assigned as a higher-level concept than "sushi" shown in the figure. Location may be represented as hierarchical information. Payment pattern is information indicating whether payment is possible using the above-mentioned pattern 1 or pattern 2 (whether payment is possible using both).

[0030] Information processing unit 140 acquires behavior information provided when a user uses a credit card from payment application 20. Information processing unit 140 processes the behavior information and transmits the processed information to fraud detection server 300 (for details, see FIGS. 11 and 12, etc., described later).

[0031] [Explanation of the interface screen that will be displayed] Here, we will explain the interface screen that the above-mentioned payment application 20 displays on the display unit of the user terminal device 10. FIG. 6 is a diagram showing an example of interface screen IM1. Interface screen IM1 displays, for example, a barcode C1, a QR code, information indicating the payment method (payment from the charge balance), and buttons related to various services on the display unit. The barcode and QR code are information that the store terminal device 50 reads during payment processing. The information indicating the payment method is the payment method used in the payment processing. The various services include, for example, a coupon issuing service, a shopping service, a flea market service, a taxi dispatch service, and various other services.

[0032] The interface screen IM1 includes a display button B1A for enlarging and displaying the code image on a screen separate from the interface screen IM1. When this button B1A is operated, the code image is enlarged and displayed on the separate screen.

[0033] When the user performs a predetermined operation (for example, when the user taps the area corresponding to the balance displayed after performing an operation on button B1A), interface screen IM2 shown in Fig. 7 is displayed on the display unit. Fig. 7 is a diagram showing an example of interface screen IM2. On interface screen IM2, setting buttons for setting the charge balance, payment method, and charge method, for example, are displayed.

[0034] The setting buttons include, for example, a button B2A for setting up deferred payment, a button B2B (an example of a "first operation button") for adding (registering) a credit card to be used when charging, a button B2C for adding (registering) a bank account to be used when charging, and a button B2D for setting up auto-charge.

[0035] For example, when button B2B is operated, payment application 20 activates the camera of user terminal device 10 and displays interface screen IM3 of Fig. 8 on the display unit. Fig. 8 is a diagram showing an example of interface screen IM3.

[0036] Area AR1 on interface screen IM3 is an area where the image captured by the activated camera is displayed. When the user moves the user terminal device 10 or the credit card they want to register so that it fits within the frame set in area AR and operates the capture button, payment application 20 reads the information written on the credit card from the image captured by the camera. In this way, payment application 20 obtains the credit card number, expiration date, etc.

[0037] When a user wishes to manually input a credit card number, button B3 (an example of a "second operation button") is operated, and interface screen IM4 (an example of a "screen for inputting a credit card number") is displayed on the display unit. FIG. 9 is a diagram showing an example of interface screen IM4. Interface screen IM4 includes an area AR2A for inputting a credit card number, an area AR2B for inputting the credit card expiration date, an area AR2C for inputting the credit card security code, and a button B4 for adding a credit card.

[0038] The user operates the keyboard displayed on interface screen IM4 to input information into each field, and then operates button B4, causing payment application 20 to send the input information to payment server 100. Note that, when payment application 20 reads information written on a credit card from an image captured by a camera, it automatically inputs the read information into the field corresponding to the information.

[0039] As described above, the user can request to register a credit card by using the interface screen provided by payment application 20 and payment server 100. In response to this request, fraud detection server 300 determines whether or not to accept the registration of the credit card.

[0040] [Fraud detection server] FIG. 10 is a diagram illustrating an example of the functional configuration of fraud detection server 300. Fraud detection server 300 includes, for example, an acquisition unit 302, a determination unit 304, and a storage unit 310. Acquisition unit 302 and determination unit 304 are each implemented by a hardware processor such as a CPU executing a program (software). Some or all of these components may be implemented by hardware (including circuitry) such as an LSI, ASIC, FPGA, or GPU, or may be implemented by a combination of software and hardware. The program may be stored in advance in a storage device such as an HDD or flash memory (a storage device with a non-transitory storage medium), or may be stored in a removable storage medium (a non-transitory storage medium) such as a DVD or CD-ROM, and installed in the storage device by inserting the storage medium into a drive.

[0041] The storage unit 310 is a HDD, a flash memory, a RAM (Random Access Memory), etc. The storage unit 310 may be a NAS (Network Attached Storage) device that can be accessed by the payment server 100 via a network. The storage unit 310 stores, for example, condition information 312 (described later).

[0042] The acquisition unit 302 acquires from the user terminal device 10 (payment application 20) behavior information indicating user behavior related to an interface screen that is presented when the user uses a credit card in an electronic commerce transaction.

[0043] The determination unit 304 uses the behavior information to determine (detect) whether or not the use of the credit card is unintended by the credit card owner.

[0044] [Fraud detection process details] 11 is a diagram for explaining the details of the fraud detection process. First, payment application 20 transmits an account number, a credit card number, and behavior information (type of operation, time of operation) to payment server 100 (S1). In S1, first behavior information 242 (details will be described later) is transmitted.

[0045] Next, the payment server 100 acquires the information transmitted in S1 above, and generates the second behavior information 244 based on the first behavior information 242 included in the acquired information (S2). Next, the payment server 100 transmits the account number, the credit card number, and the second behavior information 244 to the fraud detection server 300 (S3).

[0046] Next, based on the information transmitted in S3, fraud detection server 300 determines whether the credit card is appropriate for use (S4). Fraud detection server 300, for example, references condition information 312 to determine whether the credit card is being used in a manner that does not match the credit card owner's intentions (details will be described later). Fraud detection server 300, for example, determines whether the credit card has been used fraudulently.

[0047] Next, the fraud detection server 300 transmits the determination result and the corresponding measures to the payment server 100 (S5). For example, the fraud detection server 300 transmits information indicating that the credit card that the user is attempting to use is fraudulent (the account number of the fraudulent user) and the corresponding measures to be taken against the user to the fraud detection server 300 (S5). Next, the payment server 100 transmits the corresponding measures to the payment application 20 (step S6).

[0048] Countermeasures include suspending the use of a user's account, or blocking a user attempting fraudulent use from using the payment app (a device that suspends the provision of services). Countermeasures also include forcibly logging out a user who is logged in to use a service. Different countermeasures may be taken depending on the issuer or type of credit card. Countermeasures may also be determined by the payment server 100.

[0049] As described above, the fraud detection server 300 can prevent unintended use of a credit card by using the behavior information 240. Below, the behavior information 240 and a specific example of fraud detection using the behavior information 240 will be described.

[0050] 12 is a diagram showing an example of the contents of first behavior information 242 and second behavior information 244. First behavior information 242 is, for example, information in which the time of an operation and the content of an operation performed on payment application 20 are associated with each other. First behavior information 242 is, for example, information indicating that a button (B2B in FIG. 7) for registering (adding) a credit card was operated at time T, information indicating that a button (B3 in FIG. 8) for manually inputting a credit card number was operated at time T+2, information indicating that the digit "1" was input at time T+3, etc.

[0051] The information processing unit 140 of the payment server 100 generates the second behavior information 244 from the first behavior information 242. For example, when a button for manually inputting a credit card number is operated and the number is input in the first behavior information 242, the information processing unit 140 generates information indicating manual input (manual input flag). The information processing unit 140 calculates the time from time T (operation of the button for registering the credit card) to time T+2 (operation of the button for manual input). Hereinafter, the calculated time may be referred to as the "switching time."

[0052] Furthermore, information processing unit 140 calculates the number input time and the time between predetermined operations. The number input time is, for example, the time required to input a credit card number. Information processing unit 140 transmits the second behavior information 244 to fraud detection server 300, and acquisition unit 302 of fraud detection server 300 acquires the second behavior information 244. Note that fraud detection server 300 may generate second behavior information 244 based on first behavior information 242, or payment application 20 may generate second behavior information 244 and transmit it to fraud detection server 300 via payment server 100.

[0053] [Examples of fraud detection] The determination unit 304 determines whether the credit card has been used unintentionally by the owner based on the second behavior information 244 and the condition information 312. FIG. 13 is a diagram showing an example of the condition information 312. The condition information 312 is, for example, a condition for determining whether the credit card has been used unintentionally by the owner. If the condition included in the condition information 312 is met, the credit card is determined to have been used as intended by the owner, and if not met, the credit card is determined to have been used unintentionally (fraudulent).

[0054] The condition information 312 includes, for example, conditions 1 to 5 and other conditions. Condition 1 is that the switching time is equal to or greater than a threshold value Th1, for example, that the switching time is not too short. Condition 2 is that the switching time is equal to or less than a threshold value Th2, for example, that the switching time is not too long. Condition 3 is that the number input time is equal to or greater than a threshold value Th3, for example, that the number input time is not too short. Condition 4 is that the number input time is equal to or less than a threshold value Th4, for example, that the number input time is not too long. Condition 5 is that the credit card number is not one that cannot be registered. Credit card numbers that cannot be registered are stored, for example, in storage unit 310. Credit card numbers that cannot be registered include credit card numbers provided by credit card issuers or specified institutions, and credit card numbers that determination unit 304 has previously determined to be fraudulent.

[0055] If the above conditions are met, the determination unit 304 determines that the credit card is being used as intended by the owner (not fraudulent). For example, the threshold value is a value set based on past trends in fraudulent use. For example, the switching time and number input time of a fraudulent user have characteristics that differ from those of a normal user. For example, the switching time and number input time may be extremely short or long. These characteristics are used to detect fraud.

[0056] In the above example, it is determined whether each condition is satisfied, but instead (or in addition), predetermined parameters (such as switching time or number input time) may be applied to a preset algorithm or function to generate a score, and a determination may be made based on the score. Also, a determination may be made based on the branching results of a branching structure in which the above conditions 1-5 or other conditions are used as branching conditions.

[0057] In the above example, the description has been given of an example in which the determination is made using the switching time and the number input time, but determination unit 304 may also determine whether or not the use is unintended by the credit card owner by using a first timing at which a first operation is performed and a second timing at which a second operation is performed among operations in payment application 20. Determination unit 304 may determine that the use is unintended by the credit card owner, for example, if the target time from the first timing to the second timing is outside a reference range.

[0058] The first timing is any one of (1)-(6), and the second timing is any one of (1)-(6) that is different from the first timing. (1) is the timing when the button for displaying the interface screen (for example, IM3 in FIG. 8) is operated. (2) is the timing when an operation for manually inputting credit card information on the interface screen is performed (for example, when button B3 in FIG. 8 is operated). (3) is the timing of the operation to manually input the credit card information followed by the operation to input the credit card number. (4) is the timing of the operation to input the credit card expiration date after the operation to manually input the credit card information. (5) is the timing of the operation to enter the credit card security code after the operation to manually enter the credit card information. (6) is the timing when an operation to manually input credit card information is performed followed by an operation to register the credit card (for example, the timing when button B4 in FIG. 9 is operated).

[0059] As described above, the determination unit 304 determines that the use is unintended by the credit card owner by using the time between predetermined operations that represents the characteristics of the behavior of a fraudulent user.

[0060] The time during which no operation has been performed may also be taken into consideration in the determination. The state in which no operation has been performed (the state in which the interface screen is simply displayed) is also an example of behavior information.

[0061] In the above example, the condition information 312 used when a credit card number is manually entered has been described. This condition information 312 (first determination condition) is different from the determination condition (second determination condition) applied when processing a credit card number obtained by recognition processing of an image captured by a camera, for example.

[0062] The acquisition unit 302 acquires first procedural information indicating a manually entered credit card number and an intention to use the credit card (for example, information corresponding to these operations when the keyboard in FIG. 9 is operated to enter a credit card number in area AR2A and when button B4 for adding a credit card is operated), and second procedural information indicating a credit card number obtained by image recognition and an intention to use the credit card (for example, information corresponding to these processes and operations when a credit card number is automatically entered in area AR2A in FIG. 9 based on an image captured on interface screen IM3 in FIG. 8 and button B4 for adding a credit card in FIG. 9 is operated). The first procedural information is, for example, a credit card number, information indicating that the credit card number was manually entered, and information indicating an intention to use the credit card, and the second procedural information is, for example, a credit card number, information indicating that the credit card number was obtained by image recognition, and information indicating an intention to use the credit card. When making a judgment on the first procedure information, the judgment unit 304 judges whether the use is unintended by the credit card owner based on the condition information 312 (first judgment condition) and behavior information, and when making a judgment on the second procedure information, it judges whether the use is unintended by the credit card owner based on a judgment condition (second judgment condition) different from the condition information 312 and behavior information.

[0063] The judgment condition (second judgment condition) is set so as to be more likely to be determined as intended by the owner than the condition information 312 (first judgment condition). For example, if a judgment is made using a score and a score equal to or greater than a threshold is determined to be fraudulent, the threshold for the score of processing using image recognition is set higher than the threshold for the score of manual input. The score is, for example, a score obtained by applying predetermined parameters (such as switching time or number input time) to a preset algorithm or function. Furthermore, in the judgment information (second judgment condition), some or all of the judgment condition based on the time between operations may be omitted.

[0064] Furthermore, in the above example, the user's behavior related to the interface screen is the subject of the judgment. However, instead of (or in addition to) this, the timing of operations on the payment app 20 may also be the subject of the judgment. Operations on the payment app 20 include, for example, an operation to launch the payment app 20 or an operation to operate a predetermined button on the payment app 20 (for example, an operation performed when registering a credit card). The time from these operations to a predetermined operation (for example, various operations performed when registering a credit card) may indicate characteristics of the operation of a fraudulent user. For example, the judgment unit 304 may judge whether the use is unintended by the credit card owner based on the time from the operation to launch the payment app 20 to the operation to manually input the credit card number or the operation to complete input of the credit card number, and based on set conditions.

[0065] As described above, the determination unit 304 can accurately determine whether or not the use of the credit card is unintended by the owner of the credit card. Furthermore, the determination unit 304 can easily make the above determination.

[0066] <Variation 1> In the above example, second behavior information 244 is assumed to be information related to operations on payment application 20. However, in addition to (or instead of) this, second behavior information 244 may also include characteristic information other than operations on payment application 20. Characteristic information other than operations on payment application 20 may be information acquired by user terminal device 10, such as information about the orientation of user terminal device 10 and the hand (right hand or left hand) operating user terminal device 10. This information is acquired by a UA (User Agent), which is an application program of user terminal device 10.

[0067] As shown in FIG. 14, UA14 of user terminal device 10 acquires detection results (information indicating the tilt of user terminal device 10) from various sensors 12. UA14 acquires feature information based on the acquired detection results and provides the acquired feature information to payment application 20. UA14 is, for example, an application program that detects the hand operating user terminal device 10 or an application program that detects the orientation of user terminal device 10. The operating hand is identified based on a known method. Payment application 20 transmits the feature information and information on operations on payment application 20 to payment server 100.

[0068] Fig. 15 is a diagram showing an example of information acquired and generated by the payment server 100. As shown in Fig. 15, the payment server 100 acquires first behavior information 242 and feature information 243. The feature information 243 is information in which the time, the orientation of the user terminal device 10, and information about the hand that is operating the user terminal device 10 are associated with each other.

[0069] The information processing unit 140 generates second behavior information 244A. The second behavior information 244A includes, for example, the orientation (e.g., the main orientation) of the user terminal device 10 and information about the hand operating the user terminal device 10. The information processing unit 140 transmits the generated second behavior information 244A to the fraud detection server 300.

[0070] The determination unit 304 determines whether the credit card has been used unintentionally by the owner, based on the second behavior information 244A and the condition information 312A. In addition to the conditions included in the condition information 312, the condition information 312A also includes, for example, conditions for the feature information (e.g., condition 6 and condition 7). FIG. 16 is a diagram showing an example of the contents of the condition information 312A. For example, condition 6 is that the tilt of the user terminal device 10 in the feature information 243 is within a range of a reference tilt. For example, condition 7 is that the hand operating the user terminal device 10 in the feature information 243 is a reference hand.

[0071] The reference tilt and reference hand (reference information) are the tilt and hand of the credit card owner when operating user terminal device 10. This information is, for example, information provided by another server device and stored in storage unit 310. For example, the reference information is information obtained when using a service (e.g., a service within a group company) different from the service provided by payment application 20. For example, when a legitimate user of the credit card registers the credit card through the interface screen of the other service in order to use the other service, the app or server device of the other service acquires the reference information.

[0072] Furthermore, determination unit 304 may make a determination using personal information (such as name, address, and telephone number) registered in other services. For example, if the personal information corresponding to the credit card number in other services differs from the personal information registered for use of payment application 20, it may be determined to be fraudulent use.

[0073] As described above, the determination unit 304 can use the characteristic information to accurately determine whether or not the use of the credit card is unintended by the owner.

[0074] <Variation 2> In the above example, the type of card company is not taken into consideration, but the type of card company may also be taken into consideration. The determination unit 304 may make a determination regarding the credit card using condition information corresponding to the card company.

[0075] The determination unit 304 identifies the credit card issuer based on the behavior information, and determines whether the credit card usage is unintended by the credit card owner based on the behavior information and the determination criteria corresponding to the identified issuer. For example, the acquisition unit 302 acquires first procedure information indicating a manually entered credit card number and an intention to use the credit card, and second procedure information indicating a manually entered credit card number and an intention to use the credit card obtained by image recognition. The determination criteria corresponding to a credit card issuer in which the number of first procedure information items is greater than the number of second procedure information items by a threshold or more and the credit card number is manually entered are set so that the use is more likely to be determined as intended by the owner than the determination criteria corresponding to a credit card issuer in which the number of first procedure information items is not greater than the number of second procedure information items by a threshold or more and the credit card number is manually entered. For example, the conditions are set so that if credit card numbers tend to be entered manually for credit cards issued by a certain card company, the credit card is more likely to be determined as non-fraudulent than if credit card numbers of credit cards issued by another card company are manually entered.

[0076] 17 is a diagram showing an example of condition information 312B according to Modification 2. In condition information 312B, for example, condition information is associated with each card company (issuer). Determination unit 304 identifies the card company based on, for example, an issuer identification number included in the credit card number (for example, the number indicated by the first six digits).

[0077] For example, the conditions in the condition information of card company A are set so that they are more likely to be determined to be the owner's intended use than the conditions in the condition information of card company B. For example, if a score equal to or greater than a threshold is determined to be fraudulent, the threshold for card company A's score is set higher than the threshold for card company B's score. Furthermore, the threshold for card company A's parameters (such as switching time, which is an element to be determined) is set so that they are more likely to be determined to be the owner's intended use than the threshold for card company B's parameters.

[0078] For example, there may be cases where information tends to be entered manually for credit cards issued by card company A compared to credit cards issued by card company B, or where information tends to be entered manually at a rate greater than a predetermined rate for credit cards issued by card company A. For example, in the above cases, it is difficult to recognize credit card numbers and the like using image recognition processing that uses images captured by a camera, and it is presumed that manual input is being used. If it is presumed that there is a reason for manual input in this way, the conditions may be adjusted to make it less likely that the card will be determined to be fraudulent.

[0079] For example, the conditions in the condition information of card company C may be set so that they are more likely to be determined to be unintended use by the owner than the conditions in the condition information of card company D. For example, if the rate at which a credit card from card company C is determined to be unintended use is equal to or greater than a threshold, or if the rate at which a credit card from card company C is determined to be unintended use is higher than that of a credit card from card company D, the conditions of card company C may be adjusted so that they are more likely to be determined to be fraudulent.

[0080] For example, in the above case, it is estimated that a large number of credit card numbers obtained through the phishing site of card company C may be fraudulently used. When the possibility of fraudulent use is estimated in this way, the conditions may be adjusted to be stricter.

[0081] As described above, the determination unit 304 can determine with greater accuracy whether or not the use of the credit card is unintended by the owner by using the conditions for each card company.

[0082] <Variation 3> The determination unit 304 may change the condition information based on whether the credit card is a numberless card. The determination unit 304 determines whether the credit card is a numberless card, for example, based on behavior information. If the credit card is a numberless card, the determination unit 304 determines whether the use is unintended by the credit card owner based on a third determination condition and the behavior information. If the card is not a numberless card, the determination unit 304 determines whether the use is unintended by the credit card owner based on a fourth determination condition different from the third determination condition and the behavior information. The third determination condition is set so as to be more likely to determine that the use is intended by the owner than the fourth determination condition.

[0083] 18 is a diagram showing an example of condition information 312C. Condition information 312C includes condition information E corresponding to a numberless card and condition information F corresponding to a credit card that is not a numberless card (a credit card on which a credit card number is written). For example, the conditions in condition information E corresponding to a numberless card tend to be determined to be a use intended by the owner more than the conditions in condition information F for a credit card on which a credit card number is written. This is because, for example, information on a numberless card is necessarily entered manually.

[0084] Any method may be used to determine whether a card is a numberless card. For example, the determination unit 304 determines whether a card is a numberless card based on predetermined rules and the credit card number. The determination unit 304 identifies a numberless card from a credit card number by referring to a predetermined rule. An example of the predetermined rule is that the 0th digit must be a triangle. This rule may be derived by the fraud detection server 300 or an administrator who manages the fraud detection server 300 by analyzing the credit card numbers of multiple numberless cards. Furthermore, the fraud detection server 300 may obtain information about the rules and the credit card numbers of numberless cards from, for example, an affiliated card company.

[0085] Furthermore, in the case of a numberless card, the determining unit 304 may include in the condition information a condition that a predetermined application program has been used within a predetermined time before the credit card number was input. The predetermined application program is an application program that provides card information of the numberless card (such as the credit card number, expiration date, and security code).

[0086] For example, payment application 20 acquires usage information indicating that a specific application program has been used from a specific application program, and transmits the acquired information via payment server 100 to fraud detection server 300. If fraud detection server 300 does not acquire usage information, it may determine that the credit card was not used as intended by the owner, or may adjust a threshold value such as a score to tend to determine that the use was not intended.

[0087] Furthermore, the contents of Modification 2 and Modification 3 may be integrated. Conditions may be set for each combination of the type of card company and the presence or absence of a numberless card.

[0088] As described above, by using the conditions for each type of card, the determination unit 304 can more accurately determine whether or not the use of the credit card is unintended by the owner.

[0089] <Variation 4> The determination unit 304 may use the output result of the trained model to determine whether or not the use of the credit card is intended. FIG. 19 is a diagram showing an example of the processing of the trained model 214. The trained model 214 is a model that, when information regarding an operation on the payment app 20 is input, outputs an indicator indicating that the owner is the intended user or an indicator indicating that the use is not intended by the owner. The information regarding the operation is, for example, the time between operations, such as switching time or number input time. The trained model 214 may also be input with, for example, information indicating the user's attributes (gender, age, etc.) and the content of the operation on the payment app 20.

[0090] The trained model 214 is a model trained from training data. The training data is the determination result (correct answer data) obtained by the determination unit 304 using the above-mentioned condition information without using the trained model 214 to determine that the credit card is being used unintentionally, and information on the input target (for example, information in which the switching time and the number input time are associated). Note that the correct answer data may be the determination result obtained by determining that the credit card is being used as intended. Furthermore, the training data may be information on the input target when a credit card is actually used fraudulently.

[0091] The trained model 214 is a model that has been trained to output an indicator indicating unintended use when a switching time and a number input time corresponding to a judgment result that determines that use is unintended are input, and to output an indicator indicating intended use when a switching time and a number input time corresponding to a judgment result that determines that use is intended are input.

[0092] As described above, by using the trained model 214, the determination unit 304 can easily and accurately determine whether the use of the credit card is unintended by the owner of the credit card.

[0093] <Summary> For example, suppose a fraudulent user creates a web page that resembles a web page of a credit card company (creates a phishing site) and obtains credit card numbers entered on this web page. In this case, the fraudulent user may create an account for a payment service and attempt to link the fraudulently obtained credit card number to this account.

[0094] In the above case, when registering a credit card, the fraudulent user does not have the credit card itself and so attempts to manually enter the credit card number. In this way, the behavior of a fraudulent user when manually entering a credit card number may differ from the behavior of a legitimate user when manually entering a credit card number. Furthermore, while the fraud detection server 300 holds information on invalid credit card numbers, this information is from a predetermined time ago and differs from real-time information on fraudulently obtained credit card numbers. For this reason, it may be difficult to identify fraudulently obtained credit cards.

[0095] The determination unit 304 determines whether the credit card is being used as intended by the owner by using the behavior when registering the credit card as in each of the above-mentioned embodiments. This makes it possible to easily and accurately determine whether the credit card is being used as intended by the owner.

[0096] The above describes the form for carrying out the present invention using an embodiment, but the present invention is not limited to such an embodiment, and various modifications and substitutions can be made within the scope that does not deviate from the gist of the present invention. [Explanation of symbols]

[0097] 10 User terminal device 20. Payment App 50 Store terminal equipment 60 Store Code Image 100 Payment Server 120 Contents Provider 130 Payment processing unit 140 Information Processing Department 200 Storage section 210 User information 220 Store Information 230 Content Information 240 Behavioral Information 300 Fraud Detection Server 302 Acquisition Department 304 Judgment section

Claims

1. an acquisition unit that acquires operation information in which the type of operation performed by the user on the electronic payment application when using a credit card in an electronic commerce transaction from a terminal device is associated with information indicating the timing of the operation, and first procedural information indicating a manually input credit card number and an intention to use the credit card or second procedural information indicating a credit card number obtained by image recognition and an intention to use the credit card; a determination unit that, when making a determination on the first procedure information, determines that the use of the credit card is unintended by the owner of the credit card based on a target time from a first timing indicating that a first operation, which is an operation in the operation information, has been performed to a second timing indicating that a second operation, which is an operation in the operation information, has been performed, and a first determination condition that corresponds to the first procedure information and is a condition different from a second determination condition used to determine whether the use of the credit card is unintended by the owner of the credit card for the second procedure information, the first determination condition is a condition regarding a number input time required to input a credit card number, the second determination condition is different from the first determination condition. Judging system.

2. The determination unit Identifying the issuing company of the credit card based on the operation information; determining whether or not the use of the credit card is unintended by the owner of the credit card based on a determination criterion corresponding to the identified issuing company and the operation information; The determination system according to claim 1 .

3. The number of the first procedure information corresponds to a credit card issuer whose number is greater than the number of the second procedure information by a threshold or more, and the judgment condition when the credit card number is manually input is set so as to be more likely to be judged as intended by the owner than the judgment condition when the number of the first procedure information corresponds to a credit card issuer whose number is not greater than the number of the second procedure information by a threshold or more, and the credit card number is manually input. The determination system according to claim 2 .

4. The second determination condition is set so as to be more likely to determine that the use is intended by the owner than the first determination condition. The determination system according to any one of claims 1 to 3.

5. When the determination unit determines that the use is not intended by the owner, it executes one of the following (A) to (D): (A) providing information indicating that the credit card cannot be registered to the terminal device; (B) suspend the account of the user who attempted to register the credit card; (C) restricting the user from using the services provided by the electronic payment app; (D) forcibly logging the user out of the electronic payment app; The determination system according to any one of claims 1 to 4.

6. the acquisition unit acquires the operation information and feature information that is information on one or both of information on a hand with which the user is operating the terminal device and information on an orientation of the terminal device when operating the terminal device; the determination unit makes the determination using the feature information and reference information corresponding to the feature information in addition to the operation information. The determination system according to any one of claims 1 to 5.

7. The determination unit Identifying whether the credit card is a numberless card based on the operation information; If the card is a numberless card, determine whether the use is unintended by the owner of the credit card based on a third determination condition and the operation information; If the card is not a numberless card, it is determined whether the use is unintended by the owner of the credit card based on a fourth determination condition different from the third determination condition and the operation information. The determination system according to any one of claims 1 to 6.

8. The third determination condition is set so as to be more likely to determine that the use is intended by the owner than the fourth determination condition. The determination system according to claim 7 .

9. The computer and acquiring from the terminal device operation information that associates the type of operation performed by the user on the electronic payment application when the user uses a credit card in an electronic commerce transaction with information indicating the timing of the operation, and first procedure information that indicates a manually input credit card number and an intention to use the credit card, or second procedure information that indicates a credit card number obtained by image recognition and an intention to use the credit card; When making a judgment on the first procedure information, the judgment is made that the use of the credit card is unintended by the owner of the credit card based on a target time from a first timing indicating that a first operation, which is an operation in the operation information, has been performed to a second timing indicating that a second operation, which is an operation in the operation information, has been performed, and a first judgment condition corresponding to the first procedure information and different from a second judgment condition used to judge whether the use of the credit card is unintended by the owner of the credit card for the second procedure information; the first determination condition is a condition regarding a number input time required to input a credit card number, the second determination condition is different from the first determination condition. Judgment method.

10. On the computer, The terminal device acquires operation information that associates the type of operation performed by the user on the electronic payment application when the user uses a credit card in an electronic commerce transaction with information indicating the timing of the operation, and first procedural information that indicates a manually input credit card number and an intention to use the credit card or second procedural information that indicates a credit card number obtained by image recognition and an intention to use the credit card, When making a judgment on the first procedure information, the method judges that the use of the credit card is unintended by the owner of the credit card based on a target time from a first timing indicating that a first operation, which is an operation in the operation information, has been performed to a second timing indicating that a second operation, which is an operation in the operation information, has been performed, and a first judgment condition corresponding to the first procedure information and different from a second judgment condition used to judge whether the use of the credit card is unintended by the owner of the credit card for the second procedure information, the first determination condition is a condition regarding a number input time required to input a credit card number, the second determination condition is different from the first determination condition. program.

Images