Fraud detection device and program

Abstract

To appropriately estimate a fraudulent act of a purchaser in consideration of reliability for recognition of an action of the purchaser.SOLUTION: A fraudulent act estimation device includes action recognition means, reliability acquisition means, condition detection means, threshold determination means, and fraudulence estimation means. The action recognition means recognizes an action of a purchaser at a settlement terminal. The reliability acquisition means acquires a degree of reliability of a recognition result for the action of the purchaser recognized by the action recognition means. The condition detection means detects a change condition of a threshold for the degree of reliability. The threshold determination means determines the threshold on the basis of the change condition. The fraudulence estimation means estimates a fraudulent act of the purchaser on the basis of the action of the purchaser recognized by the degree of reliability more than the threshold determined by the threshold determination means.SELECTED DRAWING: Figure 1

Description

【Technical Field】 【0001】 Embodiments of the present invention relate to a fraud detection device and a program for causing a computer to function as the fraud detection device. 【Background Art】 【0002】 In recent years, in retail stores such as supermarkets, self-POS (Point Of Sales) terminals have attracted attention from the viewpoints of reducing labor costs and preventing the spread of infectious diseases. A self-POS terminal is a full-self-service payment terminal that allows customers, who are the purchasers, to perform operations from registering purchased items to payment. For this reason, there is already a known technology for monitoring the actions of purchasers operating self-POS terminals with a camera and estimating fraud from the movements of the hands being photographed. 【0003】 However, when a hand enters the blind spot of the camera or the hand is not visible due to the shadow of an object depending on the lighting conditions, the actions of the purchaser are not correctly recognized. Due to such low-reliability recognition results, there is a possibility of erroneously determining a purchaser's normal behavior as fraud. Alternatively, there is a possibility of erroneously determining a purchaser's fraud as normal behavior. 【Prior Art Documents】 【Patent Documents】 【0004】 【Patent Document 1】 Japanese Patent Application Laid-Open No. 2021-015366 【Summary of the Invention】 【Problems to be Solved by the Invention】 【0005】 The problem to be solved by the embodiments of the present invention is to provide a fraud detection device and its program that can appropriately estimate a purchaser's fraud in consideration of the reliability of purchaser behavior recognition. 【Means for Solving the Problems】 【0006】 In one embodiment, the fraud estimation device includes an action recognition means, a confidence level acquisition means, a condition detection means, a threshold determination means, and a fraud estimation means. The action recognition means recognizes the actions of a buyer towards a payment terminal. The confidence level acquisition means acquires the confidence level of the recognition result for the buyer's actions recognized by the action recognition means. The condition detection means detects the conditions for changing the threshold for the confidence level. The threshold determination means determines the threshold based on the change conditions. The fraud estimation means estimates the fraudulent activity of the buyer based on the buyer's actions recognized with a confidence level equal to or greater than the threshold determined by the threshold determination means. The change conditions are the buyer's attributes, which include whether or not information identifying the buyer has been entered. [Brief explanation of the drawing] 【0007】 [Figure 1] Figure 1 is a system configuration diagram of a store where self-service POS terminals have been installed. [Figure 2] Figure 2 is a schematic diagram showing the main data structure of member records. [Figure 3] Figure 3 is a schematic diagram showing an example of how a surveillance image is displayed. [Figure 4] Figure 4 is a diagram illustrating the positional relationship between the self-service POS terminal and the camera. [Figure 5] Figure 5 is a block diagram showing the main circuit configuration of the fraudulent activity estimation device. [Figure 6] Figure 6 is a schematic diagram showing an example of the data structure of the first buffer. [Figure 7] Figure 7 is a schematic diagram showing an example of the data structure of the second buffer. [Figure 8] Figure 8 is a schematic diagram showing an example of the data structure of a threshold table. [Figure 9] Figure 9 is a schematic diagram showing an example of the data structure of a threshold memory. [Figure 10] Figure 10 is a flowchart illustrating the functions of the processor as an action recognition unit and a confidence level acquisition unit. [Figure 11]Figure 11 is a flowchart illustrating the functions of the processor as an action recognition unit and a confidence level acquisition unit. [Figure 12] Figure 12 is a flowchart illustrating the function of the processor as an operation information acquisition unit. [Figure 13] Figure 13 is a flowchart illustrating the functions of the processor as a condition detection unit and a threshold determination unit. [Figure 14] Figure 14 is a flowchart illustrating the function of the processor as a malicious determination unit. [Figure 15] Figure 15 is a flowchart illustrating the function of the processor as an output unit. [Figure 16] Figure 16 is a schematic diagram showing the first modified example of the threshold table. [Figure 17] Figure 17 is a schematic diagram showing a second modified example of the threshold table. [Modes for carrying out the invention] 【0008】 The following describes an embodiment of the fraudulent activity estimation device with reference to the drawings. This embodiment aims to estimate fraudulent activity by customers using self-service POS terminals. First, the system configuration of a store where self-service POS terminals are installed will be described. 【0009】 [Store System Description] Figure 1 is a system configuration diagram of a store where self-service POS terminals 11 have been installed. This system includes a self-service POS system 100 and a fraud detection system 200. The self-service POS system 100 comprises multiple self-service POS terminals 11, a POS server 12, a display control device 13, an attendant terminal 14, and a communication network 15. The multiple self-service POS terminals 11, the POS server 12, and the display control device 13 are connected to the communication network 15. The attendant terminal 14 is connected to the display control device 13. The communication network 15 is typically a LAN (Local Area Network). The LAN may be a wired LAN or a wireless LAN. 【0010】 The self-POS terminal 11 is a full self-service payment terminal that enables the customer, who is the purchaser, to perform operations from registering purchased goods to settlement by themselves. The purchaser operates the input device of the self-POS terminal 11 to register the purchased goods and perform the settlement. Since the registration operation and settlement operation of the purchased goods are the same as before, the description here is omitted. 【0011】 The POS server 12 is a server computer for centrally controlling the operations of each self-POS terminal 11. The POS server 12 manages the membership database 30. The membership database 30 is an aggregate of member records 31 (see FIG. 2) created for each point member. The membership database 30 may be stored in a storage device built into the POS server 12, or may be stored in a storage device connected externally to the POS server 12. 【0012】 FIG. 2 is a schematic diagram showing the main data structure of the member record 31. The member record 31 includes items such as a member ID, the number of points P held, the number of store visits N, and transaction history data. The member ID is purchaser identification information for individually identifying point members. Point members who can be purchasers in the store own a point card that records information associated with their own member ID. Alternatively, a point member installs an electronic money application (application software) capable of displaying a barcode or two-dimensional code associated with their own member ID on a mobile terminal such as a smartphone. 【0013】 The number of points P held is the cumulative value of service points held by the point member. For point members, service points are given by the store according to sales transactions of goods and the like. The point member accumulates and holds the service points and can use them, for example, to pay for the price of goods. 【0014】 The number of visits N is the number of times a points member has visited the store as a purchaser. The number of visits N is an accumulated value over a specified period, such as the past year or the past three years from the current day. The period can be arbitrary. The number of visits N may also be an accumulated value without a specified period. 【0015】 Transaction history data consists of data on sales transactions made by point members as buyers at stores. Transaction history data includes data on the date and time of the transaction, data on the purchased items, and data on the payment method used for settlement. 【0016】 Let's return to the explanation of Figure 1. The display control device 13 is a controller that generates a monitoring image 140 (see Figure 3) for attendants based on the data signals output from each self-service POS terminal 11, and controls the display device of the attendant terminal 14 to display the monitoring image 140. The attendant terminal 14 is equipped with a display such as a liquid crystal display or an organic EL display as its display device. The attendant terminal 14 is a terminal used by store employees, referred to as attendants, to monitor the status of each self-service POS terminal 11 based on the monitoring image 140 displayed on the display device. The attendant terminal 14 is an example of a store employee terminal. The attendant terminal 14 divides the display screen into multiple sections and displays a different monitoring image 140 of the self-service POS terminal 11 in each section. 【0017】 Figure 3 is a schematic diagram showing one example of a display of a monitoring image 140 for a single self-service POS terminal 11. As shown in Figure 3, the monitoring image 140 includes a register number field 141, a terminal status field 142, an attribute information field 143, a points balance field 144, a visit count information field 145, a details field 146, and a total field 147. 【0018】 The register number field 141 is a field for displaying the register number. The register number is a series of numbers assigned to each self-service POS terminal 11 in a non-repeating manner in order to individually identify each self-service POS terminal 11. The register number is identification information for identifying each self-service POS terminal 11. 【0019】 The terminal status field 142 is a field for displaying the operating status of the self-service POS terminal 11. For example, one of the following operating statuses may be displayed in the terminal status field 142: "Standby", "Starting Use", "Registering", "Starting Payment", or "Paying". 【0020】 The "Waiting" state is the state between the completion of payment by the previous customer and the declaration that the next customer is ready to use the service. When the self-service POS terminal 11 is in the "Waiting" state, an initial image is displayed on the touch panel 41 (see Figure 4). The initial image includes, for example, touch buttons to allow the customer to select whether to use a store-provided shopping bag or to use their own reusable bag. 【0021】 "Start of Use" is the state in which a customer standing in front of the self-service POS terminal 11 declares that they want to start using the service for payment. The customer makes a selection operation on the initial image to determine whether to use a plastic shopping bag or a reusable bag. This selection operation constitutes the declaration of starting use. Upon receiving this selection operation, the operating state of the self-service POS terminal 11 becomes "Start of Use". 【0022】 The "Registering" status indicates that the system is accepting registration of purchased items by the buyer. Once the first purchased item is registered, the self-service POS terminal 11 will switch to the "Registering" status. The self-service POS terminal 11 will remain in the "Registering" status until the payment process is declared. 【0023】 "Payment initiated" is the state in which a buyer who has finished registering their purchased items declares that they wish to proceed to payment. The touch panel 41 of the self-service POS terminal 11, which is in the "Registering" state, displays the [Checkout] soft key. The buyer who has finished registering their purchased items touches the [Checkout] soft key. This action constitutes a declaration to proceed to payment. Upon receiving this action, the operating state of the self-service POS terminal 11 changes to "Payment initiated". 【0024】 "Payment in progress" indicates a state in which payment processing is being performed, such as cash payment, electronic money payment, or credit card payment. For example, when banknotes or coins are inserted into the banknote slot 47 or coin slot 45, the operating status of the self-POS terminal 11 becomes "Payment in progress." After the payment processing is complete, the operating status of the self-POS terminal 11 returns to "Standby." 【0025】 The attribute information field 143 is a field for displaying information that identifies whether or not the purchaser is a points member. Purchasers who are points members enter their member ID into the self-service POS terminal 11 before making a selection operation to use a plastic bag or a reusable bag for the initial image. For example, a purchaser who has a points card that records information linked to their member ID will have the information on that point card read by the card reader of the self-service POS terminal 11. For example, a purchaser who has an information terminal with an electronic money app installed that can display a barcode or QR code linked to their member ID will have the barcode or QR code displayed on that information terminal scanned by the scanner of the self-service POS terminal 11. Once the member ID is entered into the self-service POS terminal 11, the purchaser's attribute, i.e., "Member," will be displayed in the attribute information field 143 in response to the declaration operation to start using the service. If the declaration operation to start using the service is made without entering a member ID, the purchaser's attribute, i.e., "Non-Member," will be displayed in the attribute information field 143. 【0026】 The points information field 144 and the number of visits information field 145 are fields for displaying the points P and number of visits N of a point member, if the purchaser is a point member. If the purchaser is not a point member, the points information field 144 and the number of visits information field 145 will be blank. Alternatively, the points information field 144 and the number of visits information field 145 will not be displayed. 【0027】 The details column 146 is for displaying detailed information about purchased items registered at the self-service POS terminal 11. This detailed information includes, for example, the product name, quantity, and price of the purchased items. The total column 147 is for displaying total information about purchased items registered at the self-service POS terminal 11. This total information includes the total number of items, total amount, amount paid, and change. Note that the configuration of the monitoring image 140 is not limited to the configuration shown in Figure 3. Other columns displaying different items may also be included. 【0028】 Let's return to the explanation of Figure 1. The fraud detection system 200 includes multiple cameras 21 and a fraud detection device 22. Each of the multiple cameras 21 corresponds one-to-one with one of the multiple self-service POS terminals 11. The cameras 21 are for photographing customers, or purchasers, operating the corresponding self-service POS terminals 11. 【0029】 The fraudulent activity estimation device 22 is capable of handling multiple self-service POS terminals 11 with a single unit. The fraudulent activity estimation device 22 has the functions of an action recognition unit 221, a confidence level acquisition unit 222, an operation information acquisition unit 223, a condition detection unit 224, a threshold determination unit 225, a fraud estimation unit 226, and an output unit 227. 【0030】 The behavior recognition unit 221 is a function that recognizes the actions of a customer towards a fully self-service payment terminal, i.e., a self-POS terminal 11, based on the captured data output from each camera 21. The behavior recognition unit 221 can also be referred to as a behavior recognition means. In this embodiment, the behavior recognition unit 221 uses AI-based behavior recognition technology such as deep learning to estimate the skeletal structure of the joints of a person in the image, and recognizes the customer's retrieval and bagging actions from the estimated skeletal movements. 【0031】 Before explaining the retrieval and bagging actions, let's first describe the positional relationship between the self-service POS terminal 11 and the camera 21. Figure 4 is a diagram illustrating the positional relationship between the self-service POS terminal 11 and the camera 21. First, the external configuration of the self-service POS terminal 11 will be described. 【0032】 The self-service POS terminal 11 comprises a main unit 40 installed on the floor and a bagging table 50 installed next to the main unit 40. The main unit 40 has a touch panel 41 attached to its top. The touch panel 41 consists of a display and a touch sensor. The touch panel 41 is an example of an input device. The display is a device for showing various screens to the operator operating the self-service POS terminal 11. The touch sensor is a device for detecting touch input on the screen by the operator. In the self-service POS terminal 11, the operator is usually the customer. 【0033】 The main unit 40 has a basket stand 60 in the center of its side opposite to the side where the bagging table 50 is installed. The basket stand 60 is for customers coming from the sales floor to place baskets containing their purchased items. Customers stand in front of the main unit 40 in Figure 2 so that they can see the screen of the touch panel 41. Therefore, from the customer's perspective, the basket stand 60 is on the right side of the main unit 40, and the bagging table 50 is on the left side. In this embodiment, the side where the customer stands is considered the front of the main unit 40, the side where the bagging table 50 is installed is considered the left side of the main unit 40, and the side where the basket stand 60 is installed is considered the right side of the main unit 40. Alternatively, from the customer's perspective, the basket stand 60 may be on the left side of the main unit 40, and the bagging table 50 may be on the right side. 【0034】 The main unit 40, although not shown in the diagram, incorporates a scanner, card reader, printer, change dispenser unit, etc. On its front surface, the main unit 40 has a scanner reading window 42, a card slot 43, a receipt printing slot 44, a coin slot 45, a coin dispensing slot 46, a banknote slot 47, and a banknote dispensing slot 48. The scanner is a device for scanning and reading barcodes or two-dimensional codes held up to the reading window 42. The card reader is a device for reading information recorded on card media such as point cards and credit cards inserted through the card slot 43. The change dispenser unit is a device that has the function of identifying the denomination of coins or banknotes inserted through the coin slot 45 or banknote slot 47 and calculating the amount inserted, and the function of dispensing coins or banknotes as change through the coin dispensing slot 46 or banknote dispensing slot 48. 【0035】 A communication cable 61 extends from the right side of the main unit 40 to the outside, and a reader / writer 62 for electronic money media is connected to the end of this communication cable 61. The reader / writer 62 is placed on a stand 63 located on the upper right side of the main unit 40. 【0036】 The main unit 40 has a display pole 64 attached to its upper surface. The display pole 64 is equipped with a light-emitting unit 65 at its tip. The light-emitting unit 65 selectively emits light in, for example, blue and red. The display pole 64 displays the status of the self-service POS terminal 11, such as standby, operating, calling, error, fraudulent activity occurring, etc., by the color of the light-emitting unit 65. The display pole 64 may also display the status of the self-service POS terminal 11 by the blinking of the light-emitting unit 65. 【0037】 The bagging platform 50 has a structure in which a bag holder 52 is attached to the top of the housing 51. The bag holder 52 is equipped with a pair of holding arms 53, which hold the shopping bags provided by the store or the shopping bags brought by the customer, so-called reusable bags, etc. 【0038】 Next, we will explain the positional relationship between the self-service POS terminal 11 and the camera 21. As shown in Figure 4, the camera 21 is positioned to photograph from above the customer standing in front of the self-service POS terminal 11 and facing the main unit 40, bagging table 50, basket table 60, and other components. 【0039】 A customer standing in front of the self-service POS terminal 11 first places a basket containing their purchased items on the basket tray 60 on the right and holds a shopping bag or reusable bag on the holding arm 53 on the left. Next, the customer follows the guidance displayed on the touch panel 41 and operates the touch panel 41 to declare that they are starting to use the self-service POS terminal 11. If the customer is a points member, after declaring the start of use, they insert their points card, which contains information linked to their member ID, into the card slot 43 and have the information on the points card read by the card reader. Alternatively, the customer holds a barcode or QR code linked to their member ID displayed on an information terminal such as a smartphone over the reading window 42 and has the barcode or QR code read by the scanner. 【0040】 Afterward, the buyer picks up the purchased items one by one from the baskets placed on the basket stand 60. If the purchased item has a barcode, the buyer registers the item by holding the barcode up to the reading window 42 and having it scanned. If the purchased item does not have a barcode, the buyer registers the item by operating the touch panel 41 and selecting the purchased item from the list of items without barcodes. The buyer then places the registered purchased items into a shopping bag or reusable bag. 【0041】 After registering all purchased items, the customer uses the touch panel 41 to select a payment method. For example, if cash payment is selected, the customer inserts banknotes or coins into the banknote slot 47 or coin slot 45 and takes the change dispensed from the banknote dispenser 48 or coin dispenser 46. For example, if electronic money payment is selected, the customer holds the electronic money medium over the reader / writer 62. For example, if credit card payment is selected, the customer inserts the credit card into the card slot 43. After completing the payment, the customer receives the receipt issued from the receipt dispenser 44 and leaves the store with the shopping bag or reusable bag removed from the holding arm 53. 【0042】 Camera 21 is positioned in front of the self-service POS terminal 11 to capture the hand movements of the customer as described above. 【0043】 Let's return to the explanation in Figure 1. The retrieval action is the action of taking purchased items from a basket placed on the basket stand 60 and registering those purchased items with the self-service POS terminal 11. For example, if the skeleton of one or both hands moves to the right side of the main unit 40, and the purchased items are lifted and held up to the reading window 42, or if the touch panel 41 is operated, the action recognition unit 221 recognizes that a retrieval action has occurred. 【0044】 The bagging action is the action of placing the registered purchased items into a shopping bag or reusable bag on the bagging platform 50. For example, if the skeleton of the hand that performed the retrieval action moves to the left side of the main unit and the movement of placing the purchased items into a shopping bag or reusable bag is detected, the action recognition unit 221 recognizes that a bagging action has occurred. 【0045】 The reliability acquisition unit 222 is a function that acquires the reliability of the buyer's actions recognized by the action recognition unit 221. The reliability acquisition unit 222 can also be called a reliability acquisition means. When the action recognition unit 221 detects the movement of the buyer's hand skeleton towards the self-POS terminal 11 without interruption, the recognition rate of the retrieval action or bagging action is high. However, if the movement of the hand skeleton is temporarily interrupted, for example, because the buyer's hand enters a blind spot of the camera 21 or because the hand is obscured by the shadow of an object due to lighting conditions, the recognition rate of the retrieval action or bagging action decreases. The reliability acquisition unit 222 acquires the reliability of the recognition result for the retrieval action or bagging action based on the recognition rate of the retrieval action or bagging action recognized by the action recognition unit 221. 【0046】 The operation information acquisition unit 223 is a function that acquires operation information of the customer to the self-service POS terminal 11. The operation information acquisition unit 223 can also be called an operation information acquisition means. The operation information acquisition unit 223 acquires a monitoring image 140 controlled by the display control device 13, and acquires operation information of the customer's operation to start using the self-service POS terminal 11, such as product registration or payment initiation, from the information displayed on the monitoring image 140. 【0047】 Specifically, when "Start Using" is displayed in the terminal status column 142 of the monitoring image 140, the operation information acquisition unit 223 recognizes that a start-up operation has been performed at the self-POS terminal 11 identified by the register number displayed in the register number column 141 of the monitoring image 140, and acquires the operation information for the start-up operation. When "Registering" is displayed in the terminal status column 142 of the monitoring image 140, and detail information such as the product name, quantity, and amount of purchased items is added to the detail column 146, the operation information acquisition unit 223 recognizes that a product registration operation has been performed at the self-POS terminal 11 identified by the register number displayed in the register number column 141 of the monitoring image 140, and acquires the operation information for the product registration operation. When the display for the terminal status column 142 of the monitoring image 140 switches to "Start Payment", the operation information acquisition unit 223 recognizes that a payment start operation has been performed at the self-POS terminal 11 identified by the register number displayed in the register number column 141 of the monitoring image 140, and acquires the operation information for the payment start operation. 【0048】 The condition detection unit 224 has the function of detecting conditions for changing the threshold for the reliability of the retrieval or bagging behavior obtained by the reliability acquisition unit 222. The condition detection unit 224 can also be called a condition detection means. In this embodiment, the change conditions are the attributes of the purchaser. Specifically, the attributes of whether the purchaser is a points member or not, and if they are a points member, whether the number of visits N is above a predetermined number, are used as conditions for changing the threshold. In other words, being a points member or not and the number of visits N are examples of cases where the change conditions are attributes of the purchaser. 【0049】 The threshold determination unit 225 has the function of determining a threshold for the reliability of the retrieval or bagging action based on the change conditions detected by the condition detection unit 224. The threshold determination unit 225 can also be called a threshold determination means. Depending on the change conditions, the threshold determination unit 225 sets the threshold to a value higher or lower than the standard. Specifically, if the attributes of the buyer, which are the threshold change conditions, suggest that the buyer is a highly reliable person, the threshold is set to a value higher than the standard. Conversely, if the attributes of the buyer suggest that the buyer is an unreliable person, the threshold is set to a value lower than the standard. 【0050】 The fraud estimation unit 226 is a function that estimates fraudulent activity by a purchaser based on the purchaser's retrieval or bagging actions recognized with a confidence level above the threshold determined by the threshold determination unit 225. The fraud estimation unit 226 estimates fraudulent activity by the purchaser by taking into account the purchaser's operation information to the self-service POS terminal 11. The fraud estimation unit 226 can also be referred to as the fraud estimation means. As mentioned above, if a purchaser is estimated to be a highly reliable person, the threshold will be higher than the standard. That is, the fraud estimation unit 226 estimates fraudulent activity by the purchaser based on the purchaser's retrieval or bagging actions recognized with a confidence level higher than the standard. As a result, the standard for estimating fraudulent activity becomes higher. On the other hand, if a purchaser is estimated to be an unreliable person, the threshold will be lower than the standard. That is, the fraud estimation unit 226 estimates fraudulent activity by the purchaser based on the purchaser's retrieval or bagging actions recognized with a confidence level lower than the standard. As a result, the standard for estimating fraudulent activity becomes lower. 【0051】 The output unit 227 has the function of outputting the estimated results of fraudulent activity by the fraud estimation unit 226. The output unit 227 can also be called an output means. The output unit 227 outputs the estimated results of fraudulent activity to both or either the self-POS terminal 11 and the attendant terminal 14 where fraudulent activity is suspected to have occurred. The output unit 227 may also output the estimated results of fraudulent activity to the POS server 12 or other devices. Other devices include, for example, information and communication terminals such as smartphones and tablet terminals carried by store employees. 【0052】 [Description of the configuration of the fraud detection device] Figure 5 is a block diagram showing the main circuit configuration of the fraudulent activity estimation device 22. The fraudulent activity estimation device 22 comprises a processor 81, main memory 82, auxiliary storage device 83, clock 84, camera interface 85, communication interface 86, and system bus 87. The system bus 87 includes an address bus, a data bus, etc. The fraudulent activity estimation device 22 constitutes a computer by connecting the processor 81, the main memory 82, the auxiliary storage device 83, the clock 84, the camera interface 85, and the communication interface 86 via the system bus 87. 【0053】 The processor 81 corresponds to the central part of the computer described above. The processor 81 controls various parts in order to realize various functions as a fraudulent activity estimation device 22 according to the operating system or application program. The processor 81 is, for example, a CPU (Central Processing Unit). 【0054】 Main memory 82 corresponds to the main memory portion of the computer described above. Main memory 82 includes non-volatile memory areas and volatile memory areas. In the non-volatile memory area of ​​main memory 82, the operating system or application programs are stored. In the volatile memory area of ​​main memory 82, data necessary for the processor 81 to perform processing to control each part is stored. This type of data may also be stored in the non-volatile memory area. Main memory 82 uses the volatile memory area as a work area where data is rewritten as needed by the processor 81. The non-volatile memory area is, for example, ROM (Read Only Memory). The volatile memory area is, for example, RAM (Random Access Memory). 【0055】 The auxiliary storage device 83 corresponds to the auxiliary storage portion of the computer described above. The auxiliary storage device 83 may be a well-known storage device such as an SSD (Solid State Drive), HDD (Hard Disk Drive), or EEPROM (Registered Trademark) (Electric Erasable Programmable Read-Only Memory), used alone or in combination with others. The auxiliary storage device 83 stores data used by the processor 81 for various processing tasks, data generated by the processing performed by the processor 81, and so on. The auxiliary storage device 83 may also store application programs. 【0056】 The clock 84 functions as a time information source for the fraudulent activity estimation device 22. The processor 81 obtains the current date and time based on the time information measured by the clock 84. 【0057】 The camera interface 85 is an interface for communicating with each camera 21. The captured data output from each camera 21 is received by the fraud detection device 22 via the camera interface 85. The captured data includes captured video and images of customers operating the self-service POS terminal 11 corresponding to the camera 21. 【0058】 The communication interface 86 is an interface for data communication with the self-service POS terminal 11, POS server 12, display control device 13, etc., according to a communication protocol. For example, image data output from the display control device 13 is received by the fraud detection device 22 via the communication interface 86. The image data is the data of the monitoring image 140 generated for each self-service POS terminal 11. 【0059】 In the fraudulent activity estimation device 22 with this configuration, a portion of the volatile memory area in the main memory 82 is used as the area for the first buffer 821, the second buffer 822, the threshold table 823, and the threshold memory 824. The fraudulent activity estimation device 22 then forms the first buffer 821, the second buffer 822, the threshold table 823, and the threshold memory 824, respectively, in these areas, each for each self-POS terminal 11. 【0060】 Figure 6 is a schematic diagram showing an example of the data structure of the first buffer 821. As shown in Figure 6, the first buffer 821 is a data buffer that temporarily records the register number that identifies the self-POS terminal 11, the time TM, the action status AST, and the recognition rate RP in association with each other. 【0061】 Time TM is the time at which the action status AST was acquired. Action status AST represents the actions of the buyer that can be recognized by the action recognition unit 221. In this embodiment, the action status AST for retrieval action is set to "11", and the action status AST for bagging action is set to "12". Recognition rate RP is the degree to which the action recognition unit 221 recognized the buyer's actions from the captured image as retrieval action or as bagging action. Recognition rate RP is expressed, for example, as a percentage. Note that the data items of the first buffer 821 are not limited to the register number, time TM, action status AST, and recognition rate RP. Other items may be included. Also, the content of the text data shown in Figure 6 is an example. 【0062】 Figure 7 is a schematic diagram showing an example of the data structure of the second buffer 822. As shown in Figure 7, the second buffer 822 is a data buffer that temporarily records the register number that identifies the self-POS terminal 11, the start time STM, the end time FTM, the status ST, and the confidence level CD in association with each other. 【0063】 Status ST includes, in addition to the aforementioned behavioral status AST, operation status HST and fraud status IST. Operation status HST represents operation information that can be obtained by the operation information acquisition unit 223. In this embodiment, operation status HST when operation information for the start operation is obtained is "21", operation status HST when operation information for the product registration operation is obtained is "22", and operation status HST when operation information for the start payment operation is obtained is "23". Fraud status IST represents the fraud state estimated by the fraud estimation unit 226. In this embodiment, fraud status IST when a highly reliable fraud is estimated is the first fraud status IST ("31"), and fraud status IST when a less reliable fraud is estimated is the second fraud status IST ("32"). 【0064】 The start time STM is the time TM at which the behavior status AST was first written to the first buffer 821. The start time STM is also the time at which the operation status HST or the invalid status IST was obtained. The end time FTM is the time TM at which the behavior status AST was last written to the first buffer 821. The confidence level CD is the confidence level obtained by the confidence level acquisition unit 222, that is, the level of confidence in the behavior recognition result of the behavior recognition unit 221. The confidence level CD is a numerical value calculated based on the recognition rate RP. The confidence level CD is, for example, a percentage. The confidence level CD is an example of the confidence level in the recognition result of the buyer's behavior. 【0065】 The second buffer 822 contains the status ST and confidence level CD in order of earliest start time STM. In this embodiment, when the action status AST is described as status ST, the start time STM, end time FTM, and confidence level CD are also described. When the operation status HST or invalid status IST is described as status ST, the start time STM is also described, but the end time FTM and confidence level CD are not described. Alternatively, NULL values ​​are described for the end time FTM and confidence level CD. Note that the data items in the second buffer 822 are not limited to the register number, start time STM, end time FTM, status ST, and confidence level CD. Other items may also be included. 【0066】 Figure 8 is a schematic diagram showing an example of the data structure of threshold table 823. As shown in Figure 8, threshold table 823 is a data table that sets a threshold L for confidence level CD in association with the attributes of the buyer, namely information identifying whether they are a points member or not, and the number of visits N. Specifically, a threshold Lx is set for buyers whose attribute is not a points member. Note that if the buyer's attribute is not a points member, the number of visits N is not considered. On the other hand, a threshold Ly is set for buyers whose attribute is a points member and whose number of visits N is less than 100. Furthermore, a threshold Lz is described for buyers whose attribute is a points member and whose number of visits N is 100 or more. 【0067】 In this embodiment, the thresholds Lx, Ly, and Lz have the following relationship: [threshold Lx < threshold Ly < threshold Lz]. That is, for non-point members, the confidence threshold is set lower than that for point members whose reference number of visits N is less than 100. For point members whose reference number of visits N is 100 or more, the confidence threshold is set higher than that for point members whose reference number of visits is less than 100. 【0068】 Note that the value of the number of visits N described in threshold table 823 is arbitrary. Alternatively, the number of visits N may be divided into two or more stages, and four or more thresholds may be set for threshold table 823. Furthermore, the number of visits N may be omitted, and a threshold Lx for non-point members and a threshold Ly or Lz for point members may be set for threshold table 823. 【0069】 Figure 9 is a schematic diagram showing an example of the data structure of the threshold memory 824. As shown in Figure 9, the threshold memory 824 has an area for storing threshold Lm associated with the register number of each self-service POS terminal 11. The threshold Lm area stores one of the thresholds Lx, Ly, or Lz set in the threshold table 823. 【0070】 The processor 81 implements the functions of the action recognition unit 221, confidence acquisition unit 222, operation information acquisition unit 223, condition detection unit 224, threshold determination unit 225, fraud estimation unit 226, and output unit 227, as described using Figure 1, through information processing executed according to the control program. The control program is a type of application program stored in the main memory 82 or auxiliary storage device 83. The method of installing the control program in the main memory 82 or auxiliary storage device 83 is not particularly limited. The control program can be recorded on a removable recording medium or distributed via network communication and installed in the main memory 82 or auxiliary storage device 83. The recording medium can be of any form as long as it can store a program and is readable by the device, such as a CD-ROM or memory card. 【0071】 [Description of the function of the fraud detection device] Figures 10 to 15 are flowcharts showing the main information processing steps performed by the processor 81 of the fraudulent activity estimation device 22 according to the control program. The main functions of the fraudulent activity estimation device will be explained below using each flowchart. Note that the procedures and contents of the functions described below are examples. The procedures and contents can be modified as appropriate if similar results can be obtained. 【0072】 Figures 10 and 11 are flowcharts illustrating the functions of the processor 81 as the action recognition unit 221 and the confidence level acquisition unit 222. The processor 81 is waiting to recognize a customer as ACT1. The camera 21 is positioned to capture a customer standing in front of the self-service POS terminal 11 from above. When the processor 81 detects from the image captured by the camera 21 that a person is standing in front of the self-service POS terminal 11, it determines that it has recognized a customer. 【0073】 When a customer is recognized in ACT1, the processor 81 proceeds to ACT2. In ACT2, the processor 81 obtains the register number of the self-service POS terminal 11 where the customer was recognized. Each camera 21 corresponds one-to-one with each self-service POS terminal 11. The processor 81 then identifies the self-service POS terminal 11 from the identification information of the camera 21 that is photographing the customer standing in front of the self-service POS terminal 11, and obtains the register number of that self-service POS terminal 11. The processor 81 processes the first buffer 821 and the second buffer 822, which contain the obtained register numbers. 【0074】 Processor 81 acquires images captured by the camera 21 corresponding to the self-service POS terminal 11 that has recognized the customer as ACT3. Then, as ACT4, Processor 81 checks whether a person, i.e., the customer, is visible in the image. If the customer is visible, Processor 81 proceeds to ACT5. As ACT5, Processor 81 recognizes the customer's actions. For example, Processor 81 uses AI-based action recognition technology such as deep learning to estimate the skeletal structure of the joints of the person in the image from camera 21, and recognizes the customer's retrieval and bagging actions from the movement of the estimated skeleton. 【0075】 Processor 81 checks whether it has recognized the buyer's retrieval action as ACT6. If it has not recognized the retrieval action, Processor 81 proceeds to ACT7. Processor 81 checks whether it has recognized the buyer's bagging action as ACT7. If it has not recognized the bagging action, Processor 81 proceeds to ACT8. Processor 81 checks whether the action status AST("11") of the retrieval action, along with the latest time, is written in the first buffer 821 to be processed as ACT8. If the action status AST("11") of the retrieval action is not written in the first buffer 821, Processor 81 proceeds to ACT9. Processor 81 checks whether the action status AST("12") of the bagging action, along with the latest time, is written in the first buffer 821 to be processed as ACT9. If the action status AST("12") of the bagging action is not written in the first buffer 821, Processor 81 returns to ACT3. 【0076】 Thus, in ACT3 to ACT9, if the first buffer 821 to be processed does not contain "11" or "12" as the action status AST, the processor 81 waits for the camera 21 to recognize the buyer's retrieval action or bagging action as captured in the image. 【0077】 If a retrieval action is recognized during the waiting state of ACT3 through ACT9, the processor 81 proceeds from ACT6 to ACT10. The processor 81 checks whether the action status AST("12") of the bagging action, along with the latest time, is written to the first buffer 821 to be processed as ACT10. At this point, the action status AST("12") of the bagging action is not written to the first buffer 821. The processor 81 skips the processing of ACT11 and ACT12 and proceeds to ACT13. 【0078】 Processor 81 checks, as ACT13, whether the action status AST("11") of the retrieval action, along with the latest time, is written to the first buffer 821 to be processed. At this point, the action status AST("11") of the retrieval action is not written to the first buffer 821. Processor 81 proceeds to ACT14. Processor 81 stores the action status AST("11") of the retrieval action as ACT14. The location where the action status AST is stored is, for example, a register built into the processor 81. 【0079】 After completing the processing of ACT14, the processor 81 obtains the current time from the clock 84 as ACT15. The processor 81 also obtains the recognition rate RP for the retrieval action as ACT16. Hereafter, the recognition rate RP for the retrieval action will be referred to as the recognition rate RPa. The processor 81 writes the current time obtained in the processing of ACT15, the action status AST ("11") stored in the processing of ACT14, and the recognition rate RPa obtained in the processing of ACT16 to the first buffer 821 to be processed as ACT17, associating them. 【0080】 After that, processor 81 returns to ACT3. Therefore, if the next camera image recognizes the buyer's retrieval action again, processor 81 proceeds from ACT6 to ACT10. At this time, since the action status AST("12") for the bagging action is not written in the first buffer 821 to be processed for the latest time, processor 81 skips the processing of ACT11 and ACT12 and proceeds to ACT13. 【0081】 At this point, the first buffer 821 to be processed contains the action status AST("11") of the retrieval action for the most recent time, as processed in ACT17 as described above. The processor 81 skips the processing of ACT14 and proceeds to ACT15. The processor 81 then executes the processing of ACT15, ACT16, and ACT17 in the same manner as described above. Thus, the first buffer 821 to be processed contains the action status AST("11") of the retrieval action and its recognition rate RPa in chronological order, associated with the time when the buyer's retrieval action was recognized. 【0082】 If, for example, part of the buyer's hand is not visible in the camera image and therefore the retrieval action is not recognized, and the bagging action is also not recognized, the processor 81 proceeds from ACT7 to ACT8. At this time, the first buffer 821 to be processed contains the action status AST("11") for the retrieval action for the most recent time, so the processor 81 proceeds to ACT15. The processor 81 then executes the processing of ACT15, ACT16, and ACT17 in the same manner as described above. Thus, the first buffer 821 to be processed contains the current time, the action status AST("11") indicating the retrieval action, and its recognition rate RPa in chronological order. In this case, the recognition rate RP for the retrieval action will be a smaller value compared to when the retrieval action was recognized. 【0083】 On the other hand, if a bagging action is recognized during the waiting state of ACT3 to ACT9, the processor 81 proceeds from ACT7 to ACT21 in Figure 11. As ACT21, the processor 81 checks whether the action status AST("11") for the retrieval action has been written to the first buffer 821 to be processed. 【0084】 When a buyer takes items out of their basket and begins the process of bagging them, the bagging action is recognized with the action status AST("11") of the retrieval action recorded for the most recent time. When a new bagging action is recognized in this way, the processor 81 proceeds from ACT21 to ACT22. 【0085】 Processor 81 obtains the confidence level for the recognition result of the most recent retrieval action as ACT22. For example, processor 81 searches the first buffer 821 to be processed, working backward from the most recent time until a time when the action status AST("11") of the retrieval action is not recorded. Hereinafter, the most recent time is defined as the end time FTM of the retrieval action, and the time when the action status AST("11") of the retrieval action is not recorded is defined as the time before the start of the retrieval action. The time following this time before the start is defined as the start time STM of the retrieval action. Processor 81 obtains the average value of the retrieval action recognition rate from the start time STM to the end time FTM as the confidence level CD for the recognition result of the retrieval action.Hereinafter, the confidence level CD for the recognition result of the retrieval action is represented as confidence level CDa. The processor 81 writes the start time STM of the retrieval action, the end time FTM, the action status AST("11") of the retrieval action, and the confidence level CDa for the recognition result of the retrieval action to the second buffer 822 to be processed as ACT23. 【0086】 After completing the processing of ACT23, the processor 81 checks, as ACT24, whether the action status AST("12") for the bagging action has been recorded in the first buffer 821 to be processed for the most recent time. At this point, the action status AST("12") for the bagging action has not been recorded for the most recent time, so the processor 81 proceeds to ACT25. The processor 81 stores the action status AST("12") for the bagging action as ACT25. 【0087】 After completing the processing of ACT25, the processor 81 obtains the current time from the clock 84 as ACT26. The processor 81 also obtains the recognition rate RP when the bagging action is recognized by the function of the action recognition unit 221 as ACT27. Hereafter, the recognition rate RP when the bagging action is recognized will be referred to as the recognition rate RPb. The processor 81 writes the current time obtained in the processing of ACT26, the action status AST ("12") of the bagging action stored in the processing of ACT25, and the recognition rate RPb obtained in the processing of ACT27 to the first buffer 821 to be processed as ACT28, associating them. 【0088】 Subsequently, processor 81 returns to ACT3 in Figure 10. Therefore, if the buyer's bagging behavior is recognized again by the next camera image, processor 81 proceeds from ACT7 in Figure 10 to ACT21 in Figure 11. At this point, the first buffer 821 to be processed contains the action status AST("12") of the bagging behavior for the most recent time, so processor 81 skips the processing of ACT22 and ACT23 and proceeds to ACT24. Furthermore, processor 81 skips the processing of ACT25 and proceeds to ACT26. Then processor 81 executes the processing of ACT26, ACT27 and ACT28 in the same manner as described above. Thus, the first buffer 821 to be processed contains the action status AST("12") of the bagging behavior and its recognition rate RPb in chronological order, associated with the time when the buyer's bagging behavior was recognized. 【0089】 For example, if the recognition rate for the bagging action is low because part of the buyer's hand is not visible in the camera image, and the retrieval action is also not recognized, the processor 81 proceeds from ACT7 to ACT8 in Figure 10. At this time, the action status AST("12") for the bagging action is written in the first buffer 821 to be processed for the latest time, so the processor 81 proceeds from ACT8 to ACT9, and then to ACT26 in Figure 11. The processor 81 then executes the processing of ACT26, ACT27, and ACT28 in the same way as described above. Thus, the current time, the action status AST("12") indicating the bagging action, and its recognition rate RPb are written in chronological order in the first buffer 821 to be processed. In this case, the recognition rate RPb for the bagging action will be a smaller value compared to when the bagging action was recognized. 【0090】 When a customer finishes bagging their purchased items and then takes out the next item from the basket, the retrieval action is recognized with the action status AST("12") of the bagging action recorded for the most recent time. In this way, when a new retrieval action by the customer is recognized during the waiting state of ACT3 to ACT9, the processor 81 proceeds from ACT6 to ACT10, and then to ACT11. As ACT11, the processor 81 obtains the confidence level for the recognition result of the previous bagging action. For example, the processor 81 searches the first buffer 821 to be processed, working backward from the most recent time until a time when the action status AST("12") of the bagging action is not recorded. In the following, the most recent time is defined as the end time FTM of the bagging action, and the time when the action status AST("12") of the bagging action is not recorded is defined as the time before the start of the bagging action. The time following this time before the start is defined as the start time STM of the bagging action. The processor 81 obtains the average of the bagging action recognition rates from the start time STM to the end time FTM as the confidence score CD for the bagging action recognition result. Hereafter, the confidence score CD for the bagging action recognition result will be referred to as confidence score CDb. The processor 81 writes the start time STM of the bagging action, the end time FTM, the action status AST ("12") of the bagging action, and the confidence score CDb for the bagging action recognition result to the second buffer 822 to be processed as ACT12. 【0091】 Subsequently, the processor 81 executes the processing of ACT13 to ACT17 in the same manner as described above. That is, the processor 81 stores the action status AST("11") of the retrieval action. The processor 81 also writes the current time, the action status AST("11") indicating the retrieval action, and the recognition rate RPa for the recognition result of the retrieval action to the first buffer 821 to be processed. 【0092】 In this way, when a buyer's retrieval action is recognized by the image captured by camera 21, the recognition time, the action status AST("11") of the retrieval action, and the recognition rate RPa of the retrieval action are written to the first buffer 821. This process of writing the recognition time, action status AST("11"), and recognition rate RPa to the first buffer 821 is repeated until the buyer's bagging action is recognized. When a buyer's bagging action is recognized by the image captured by camera 21, the recognition time, the action status AST("12") of the bagging action, and the recognition rate RPb of the bagging action are written to the first buffer 821. This process of writing the recognition time, action status AST("12"), and recognition rate RPb to the first buffer 821 is repeated until the next retrieval action is recognized. 【0093】 Furthermore, when a new bagging action by a buyer is recognized, a confidence level CDa is obtained for the recognition result of the previous retrieval action. Then, as a record related to the retrieval action, the start time STM and end time FTM of the retrieval action, the action status AST ("11") of the retrieval action, and the confidence level CDa are written to the second buffer 822. Similarly, when a new bagging action by a buyer is recognized, a confidence level CDb is obtained for the recognition result of the previous bagging action. Then, as a record related to the bagging action, the start time STM and end time FTM of the bagging action, the action status AST ("12") of the bagging action, and the confidence level CDb are written to the second buffer 822. 【0094】 Typically, a buyer alternates between retrieving items and bagging them. Therefore, records related to retrieving items and records related to bagging are alternately written in the second buffer 822. After the buyer bags the last purchased items, the process moves to payment. At this point, the processor 81, functioning as an operation information acquisition unit 223, acquires operation information for the payment initiation operation and executes the processes of ACT22 and ACT23 in Figure 11. As a result, a record related to the final bagging action is written to the second buffer 822. 【0095】 For example, when a customer completes payment and moves away from the self-service POS terminal 11, the customer is no longer captured in the image taken by the camera 21 corresponding to the self-service POS terminal 11. In the waiting state of ACT3 to ACT9, when the customer is no longer captured in the image taken by the camera 21, the processor 81 proceeds from ACT4 to ACT18. As ACT18, the processor 81 clears the first buffer 821 and the second buffer 822 that are to be processed. With this, the processor 81 completes the information processing of the procedure shown in the flowcharts of Figures 10 and 11. 【0096】 Here, the processor 81 realizes its function as an action recognition unit 221 by executing the processing of ACT5. The processor 81 also realizes its function as a confidence level acquisition unit 222 by processing ACT11 and ACT22. 【0097】 Figure 12 is a flowchart illustrating the function of the processor 81 as an operation information acquisition unit 223. The processor 81 waits for the self-service POS terminal 11 to declare that it is ready to use as ACT31. When it declares that it is ready to use, "Ready to Use" is displayed in the terminal status column 142 of the monitoring image 140 corresponding to the self-service POS terminal 11. The processor 81 checks whether it can recognize the words "Ready to Use" from the terminal status column 142 of the monitoring image 140 acquired via the display control device 13. If it can recognize the words "Ready to Use", the processor 81 recognizes that it has declared that it is ready to use. 【0098】 Upon recognizing that the start of use has been declared, the processor 81 proceeds to ACT32. As ACT32, the processor 81 obtains the register number of the self-POS terminal 11. The register number is displayed in the register number field 141 of the monitoring image 140. The processor 81 recognizes the characters of the register number from the register number field 141 of the monitoring image 140 obtained via the display control device 13 and obtains those characters as the register number. The processor 81 then processes the second buffer 822, which contains the obtained register number. 【0099】 After completing the processing of ACT32, the processor 81 stores the operation status HST("21") as ACT33, indicating that the operation information for the start operation has been acquired. The operation status HST is stored, for example, in a register built into the processor 81. The processor 81 also acquires the current time TM, which is being measured by the clock 84, as ACT34. Then, as ACT35, the processor 81 writes the time TM acquired in the processing of ACT34 and the operation status HST("21") stored in the processing of ACT33 to the second buffer 822 to be processed. At this time, the time TM is written as the start time STM. 【0100】 Therefore, when a customer standing in front of the self-service POS terminal 11 performs a declaration operation to start using the service, the operation status HST("21"), indicating that the operation information for the start of use operation has been acquired, is first written to the second buffer 822 corresponding to the self-service POS terminal 11, along with its time TM. 【0101】 After completing the processing of ACT35, the processor 81 starts the operation recognition process for the self-POS terminal 11, which is identified by the register number obtained in the processing of ACT32, as ACT36. Specifically, the processor 81 recognizes the product registration operation and the payment start operation from the information transition obtained by character recognition of the monitoring image 140 acquired via the display control device 13. 【0102】 Processor 81 checks whether it has recognized the product registration operation as ACT37. If it has not recognized the product registration operation, processor 81 proceeds to ACT38. Processor 81 checks whether it has recognized the payment initiation operation as ACT38. If it has not recognized the payment initiation operation, processor 81 returns to ACT37. In this way, processor 81 waits in ACT37 and ACT38 for recognition of either the product registration operation or the payment initiation operation. 【0103】 When the processor 81 recognizes a product registration operation while in the waiting state of ACT37 and ACT38, it proceeds from ACT37 to ACT39. The processor 81 stores the operation status HST("22") as ACT39, indicating that it has acquired the operation information for the product registration operation. The processor 81 also acquires the current time TM, which is measured by the clock 84, as ACT40. Then, as ACT41, the processor 81 writes the time TM acquired in the processing of ACT40 and the operation status HST("22") stored in the processing of ACT39 to the second buffer 822 to be processed. At this time, the time TM is written as the start time STM. After completing the processing of ACT41, the processor 81 returns to ACT37. 【0104】 Thus, when a customer who has taken out purchased items performs an operation to register those items with the self-service POS terminal 11, the operation status HST("22"), indicating that the operation information for the product registration operation has been acquired, is written to the second buffer 822 corresponding to the self-service POS terminal 11, along with the time TM. After the customer has finished registering the purchased items, they perform a bagging operation for those items. Therefore, the operation status AST("11") for the retrieval operation is written to the second buffer 822, followed by the operation status HST("22") for the product registration operation, and then the operation status AST("12") for the bagging operation. 【0105】 When the processor 81 recognizes a settlement initiation operation while in the waiting state of ACT37 and ACT38, it proceeds from ACT38 to ACT42. The processor 81 stores the operation status HST("23") as ACT42, indicating that it has acquired the operation information for the settlement initiation operation. The processor 81 also acquires the current time TM, which is measured by the clock 84, as ACT43. Then, the processor 81 writes the time TM acquired in the processing of ACT43 and the operation status HST("23") stored in the processing of ACT42 to the second buffer 822 to be processed, as ACT44. At this time, the time TM is written as the start time STM. 【0106】 Therefore, the second buffer 822 contains the action status AST("12") for the bagging action for the last registered purchased item, followed by the operation status HST("23") for the payment initiation operation. 【0107】 After completing the processing of ACT44, the processor 81 completes the recognition process for the operation of the self-POS terminal 11, which is identified by the register number obtained in the processing of ACT32, as ACT45. With this, the processor 81 completes the information processing of the procedure shown in Figure 12. 【0108】 Here, the processor 81 performs the processing of ACT36 to ACT45, thereby realizing its function as an operation information acquisition unit 223. 【0109】 Figure 13 is a flowchart illustrating the functions of the processor 81 as a condition detection unit 224 and a threshold determination unit 225. The processor 81 waits for the self-service POS terminal 11 to declare that it is ready to use as ACT51. When it declares that it is ready to use, "Ready to Use" is displayed in the terminal status column 142 of the monitoring image 140 corresponding to the self-service POS terminal 11. The processor 81 checks whether it can recognize the words "Ready to Use" from the terminal status column 142 of the monitoring image 140 acquired via the display control device 13. If it can recognize the words "Ready to Use", the processor 81 recognizes that it has declared that it is ready to use, based on the function of the operation information acquisition unit 223. 【0110】 Upon recognizing that the start of use has been declared, the processor 81 proceeds to ACT52. As ACT52, the processor 81 obtains the register number of the self-POS terminal 11. The register number is displayed in the register number field 141 of the monitoring image 140. The processor 81 recognizes the characters of the register number from the register number field 141 of the monitoring image 140 obtained via the display control device 13 and obtains those characters as the register number. The processor 81 then processes the second buffer 822, which contains the obtained register number. 【0111】 After completing the processing of ACT52, the processor 81 stores the threshold Lx as the default threshold L in ACT53. The threshold Lx is the threshold when the buyer's attribute is that they are not a points member, as explained using Figure 8. The threshold L is stored in a register. 【0112】 After completing the processing of ACT53, the processor 81 checks, as ACT54, whether or not member registration has been performed for the self-service POS terminal 11. If member registration is performed, "Member" is displayed in the attribute information field 143 of the monitoring image 140. If member registration is not performed, the attribute information field 143 of the monitoring image 140 remains displayed as "Non-member". 【0113】 If member registration has not been performed, processor 81 proceeds from ACT54 to ACT55. Processor 81 checks in ACT55 whether product registration has started at the self-service POS terminal 11. When the first purchased item is registered at the self-service POS terminal 11, the operating status of the self-service POS terminal 11 becomes "Registering". The display in the terminal status column 142 of the monitoring image 140 for the self-service POS terminal 11 then changes from "Started Use" to "Registering". If the text recognized in the terminal status column 142 of the monitoring image 140 remains "Started Use", product registration has not started. Processor 81 returns to ACT54. In this way, processor 81 waits in ACT54 and ACT55 for member registration to be performed or for product registration to start. 【0114】 If a points member is registered while ACT54 and ACT55 are in standby mode, processor 81 proceeds from ACT54 to ACT56. Processor 81 obtains the number of visits N of that points member as ACT56. When a points member is registered, the number of visits N is displayed in the visit count information field 145 of the monitoring image 140. Processor 81 obtains the number of visits N displayed in the visit count information field 145. 【0115】 When the number of visits N of a points member is obtained, processor 81 proceeds to ACT57. Processor 81 checks in ACT57 whether the number of visits N is 100 or more. If the number of visits N is less than 100, processor 81 proceeds from ACT57 to ACT58. Processor 81 updates the default threshold L to threshold Ly in ACT58. Threshold Ly is the threshold when the buyer's attribute is a points member and the number of visits N is less than 100, as explained using Figure 8. 【0116】 In contrast, if the number of visits N is 100 or more, the processor 81 proceeds from ACT57 to ACT59. In ACT59, the processor 81 updates the default threshold L to threshold Lz. Threshold Lz is the threshold when the buyer's attribute is that of a points member and the number of visits N is 100 or more, as explained using Figure 8. 【0117】 After completing the processing of ACT58 or ACT59, the processor 81 proceeds to ACT55. That is, the processor 81 waits for the product registration to begin. 【0118】 If the processor 81 recognizes the word "Registering" from the terminal status column 142 of the monitoring image 140, it determines that product registration has started and proceeds from ACT55 to ACT60. In ACT60, the processor 81 overwrites the threshold Lm in the threshold memory 824 associated with the register number obtained in the processing of ACT52 with the threshold L stored in the register. That is, the threshold Lm becomes threshold Lx if the buyer is not a points member, threshold Ly if the buyer is a points member and the number of visits N is less than 100, and threshold Lz if the buyer is a points member and the number of visits N is 100 or more. 【0119】 After completing the processing of ACT60, processor 81 proceeds to ACT61. Processor 81 waits for payment to be initiated at the self-service POS terminal 11 as ACT61. When the self-service POS terminal 11 declares that it will proceed to payment, the operating status of the self-service POS terminal 11 changes to "Payment Started". The display in the terminal status column 142 of the monitoring image 140 for the self-service POS terminal 11 then changes from "Registering" to "Payment Started". 【0120】 Processor 81 waits for the characters recognized from the terminal status column 142 of the monitoring image 140 to change to "Start using". Upon recognizing the characters "Start using", processor 81 proceeds from ACT61 to ACT62. As ACT62, processor 81 clears the threshold Lm of the threshold memory 824 associated with the registration number obtained in the processing of ACT52. With this, processor 81 completes the information processing of the procedure shown in the flowchart of Figure 13. 【0121】 Here, the processor 81 realizes its function as a condition detection unit 224 by executing the processing of ACT54 to ACT57. Furthermore, the processor 81 realizes its function as a threshold determination unit 225 by executing the processing of ACT60. 【0122】 Figure 14 is a flowchart illustrating the function of the processor 81 as an error estimation unit 226. The processor 81 waits for the threshold Lm to be stored in the threshold memory 824 as ACT71. In ACT60 in Figure 13, when the threshold Lx, Ly, or Lz is stored in the threshold memory 824 as the threshold Lm, the processor 81 retrieves the register number associated with that threshold Lm from the threshold memory 824 as ACT72. Then, the processor 81 searches the second buffer 822 which stores that register number as ACT73. 【0123】 Processor 81 checks whether the action status AST("12") for the bagging action has been written to the second buffer 822 as ACT74. If the action status AST("12") for the bagging action has not been written, Processor 81 proceeds to ACT75. Processor 81 checks whether the threshold Lm has been cleared as ACT75. If the threshold Lm has not been cleared, Processor 81 returns to ACT74. In this way, Processor 81 waits in ACT74 and ACT75 for either the action status AST("12") for the bagging action to be written or for the threshold Lm to be cleared. 【0124】 In the waiting state of ACT74 and ACT75, when the action status AST("12") for the bagging action is written to the second buffer 822, the processor 81 proceeds from ACT74 to ACT76. The processor 81 checks in the second buffer 822 whether the operation status HST("22") for the product registration operation is written immediately before the action status AST("12") for the bagging action. If the operation status HST("22") is written before the action status AST("12"), the buyer has bagged the purchased items after registering them with the self-service POS terminal 11. Therefore, there is no fraudulent activity. In this case, the processor 81 returns to ACT73. The processor 81 searches the second buffer 822 again and waits for the action status AST("12") for the bagging action to be written or for the threshold Lm to be cleared. 【0125】 In contrast, if the operation status HST("22") of the product registration operation is not described immediately before the action status AST("12") of the bagging operation, it is presumed that the buyer committed fraud by bagging the purchased items without registering them with the self-service POS terminal 11. In this case, the processor 81 proceeds to ACT77. As ACT77, the processor 81 further searches the second buffer 822 and detects the confidence level CDa associated with the action status AST("11") of the retrieval operation described immediately before the action status AST("12") of the bagging operation. Then, as ACT78, the processor 81 compares the confidence level CDa with the threshold Lm. 【0126】 If the confidence level CDa is greater than or equal to the threshold Lm in ACT78, the processor 81 proceeds to ACT79. In ACT79, the processor 81 further searches the second buffer 822 to detect the confidence level CDb associated with the action status AST("12") of the bagging action. Then, in ACT80, the processor 81 compares the confidence level CDb with the threshold Lm. 【0127】 If the confidence level CDb in ACT80 is greater than or equal to threshold L, the processor 81 proceeds to ACT81. The processor 81 stores the first invalid status IST ("31") as ACT81. The invalid status IST is stored, for example, in a register built into the processor 81. 【0128】 In contrast, if the confidence level CDa in ACT78 is less than the threshold Lm, or if the confidence level CDb in ACT80 is less than the threshold Lm, the processor 81 proceeds to ACT82. The processor 81 stores the second invalid status IST("32") as ACT82. 【0129】 After completing the processing of ACT81 or ACT82, processor 81 obtains the current time TM, which is being measured by clock 84, as ACT83. Then, processor 81 writes the time TM and the invalid status IST stored in the register to the second buffer 822, which is being searched as ACT84. The time TM is written as the start time. 【0130】 Therefore, if the confidence level CDa of the retrieval action and the confidence level CDb of the bagging action are both greater than or equal to the threshold Lm, the processor 81 writes the first invalid status IST("31") along with the start time STM to the second buffer 822 being searched. If the confidence level CDa of the retrieval action or the confidence level CDb of the bagging action is less than the threshold Lm, the processor 81 writes the second invalid status IST("32") along with the start time STM to the second buffer 822 being searched. 【0131】 After completing the processing of ACT84, processor 81 returns to ACT73 and continues searching the second buffer 822. Once it confirms that the action status AST("12") for the bagging action has been written, processor 81 executes the processing from ACT76 through ACT84 onward in the same manner as described above. 【0132】 When ACT74 and ACT75 are in standby mode, and the threshold Lm has been cleared, the processor 81 terminates the information processing procedure shown in the flowchart of Figure 14. 【0133】 Here, the processor 81 implements the processing of ACT71 to ACT84 to realize its function as a fraud estimation unit 226. Specifically, the processor 81 estimates that fraud is occurring when, for a purchased item whose retrieval action has been recognized, the bagging action is recognized without the product registration operation being recognized. In this case, if the confidence level CDa for the recognition result of the retrieval action immediately before the product registration operation, and the confidence level CDb for the recognition result of the bagging action immediately after the product registration operation are both above the threshold Lm, the accuracy of the estimation of fraud is high. The processor 81 writes the first fraud status IST("31") to the second buffer 822. Conversely, if the confidence level CDa for the recognition result of the retrieval action immediately before the product registration operation, or the confidence level CDb for the recognition result of the bagging action immediately after the product registration operation, is below the threshold Lm, the accuracy of the estimation of fraud is low. The processor 81 writes the second fraud status IST("32") to the second buffer 822. 【0134】 Figure 15 is a flowchart illustrating the function of the processor 81 as an output unit 227. Processor 81 monitors the second buffer 822 of each self-service POS terminal 11 as ACT91. Then, as ACT92, processor 81 checks for the presence of a second buffer 822 with an invalid status IST written in it. If a second buffer 822 with an invalid status IST written in it is detected, processor 81 proceeds from ACT92 to ACT93. As ACT93, processor 81 retrieves the register number from that second buffer 822. 【0135】 After completing the processing of ACT93, processor 81 checks whether the invalid status IST written to its second buffer 822 as ACT94 is the first invalid status IST ("31") or the second invalid status IST ("32"). 【0136】 If the first fraud status IST("31") is confirmed in ACT94, the processor 81 proceeds to ACT95. In ACT95, the processor 81 obtains a warning message regarding the fraudulent activity. The warning message is for the buyer and may contain content such as "There are unregistered purchased items." In ACT96, the processor 81 outputs the warning message to the self-service POS terminal 11, which is identified by the register number obtained in the processing of ACT93. As a result, the warning message is displayed on the touch panel 41 of the self-service POS terminal 11. In addition, the light-emitting part 65 of the display pole 64 lights up with a color indicating that fraudulent activity is occurring. At this time, the warning message may also be output as audio from the speaker. After that, the processor 81 proceeds to ACT97. 【0137】 On the other hand, if ACT94 confirms that the second invalid status IST("32") is present, the processor 81 skips the processing of ACT95 and ACT96 and proceeds to ACT97. Therefore, if the second invalid status IST("32") is written to the second buffer 822, no warning message is output to the self-POS terminal 11 identified by the register number stored in the second buffer 822. 【0138】 Processor 81, proceeding to ACT97, acquires a notification message regarding fraudulent activity. The notification message is intended for attendants and may contain content such as, "Fraudulent activity may have occurred at register No. X." Processor 81 outputs this notification message as ACT98 to the attendant terminal 14. As a result, the notification message is displayed on the display device of the attendant terminal 14. Alternatively, the notification message is output as audio from the speaker of the attendant terminal 14. 【0139】 In this manner, if the first invalid status IST("31") or the second invalid status IST("32") is written to the second buffer 822, a notification message is output to the attendant terminal 14. 【0140】 After completing the processing of ACT98, the processor 81 retrieves the data from the first buffer 821 and the second buffer 822, which store the register number obtained in the processing of ACT93, as ACT99. Then, the processor 81 outputs the data from the first buffer 821 and the second buffer 822 to the POS server 12 as ACT100. The POS server 12 saves the data from the first buffer 821 and the second buffer 822 to its storage device. With this, the processor 81 completes the information processing procedure shown in the flowchart of Figure 15. Here, the processor 81 performs the processing of ACT94 to ACT100 in Figure 15, thereby realizing the function of the output unit 227. Through this function of the output unit 227, if the first invalid status IST("31") is written to the second buffer 822, a warning message is output to the self-service POS terminal 11 corresponding to that second buffer 822. A notification message is also output to the attendant terminal 14. On the other hand, if the second invalid status IST("31") is written to the second buffer 822, a notification message is output to the attendant terminal 14. No warning message is output to the self-service POS terminal 11 corresponding to the second buffer 822. 【0141】 [Explanation of the effects of the fraud detection device] As detailed above, the fraudulent activity estimation device 22 can estimate fraudulent activity in which a purchaser bags purchased items without registering them in the self-service POS terminal 11. However, if the confidence level CDa for the recognition result of the retrieval action or the confidence level CDb for the recognition result of the bagging action is lower than the threshold Lm, the estimated fraudulent activity is not necessarily correct. If the confidence level CDa for the recognition result of the retrieval action or the confidence level CDb for the recognition result of the bagging action is lower than the threshold Lm, the fraudulent activity estimation device 22 does not output a warning message for that fraudulent activity to the self-service POS terminal 11. It outputs a notification message only to the attendant terminal 14. Therefore, it is possible to prevent the purchaser from feeling uncomfortable by mistakenly judging a purchaser's normal actions as fraudulent activity and issuing a warning due to unreliable recognition results. 【0142】 Furthermore, the threshold Lm for confidence levels CDa or CDb is variable depending on the attributes of the buyer. Specifically, the threshold Lm is higher for point members than for non-point members. Buyers registered as point members can be considered highly reliable individuals to the store. Therefore, by setting a higher threshold Lm for non-point members, warnings can be avoided unless there is a high probability that fraudulent activity is occurring. Also, even among point members, the threshold Lm is higher for members with 100 or more visits than for members with fewer than 100 visits. A high number of visits indicates that the customer is important to the store. Therefore, by setting a higher threshold Lm for point members with fewer visits than for non-point members, warnings can be avoided unless there is a higher probability that fraudulent activity is occurring. 【0143】 [Variations of the threshold table] Figure 16 is a schematic diagram showing the main data structure of the second threshold table 823-1, which is a modified example of the threshold table with buyer attributes as the change condition. As shown in Figure 16, the threshold table 823-1 is a data table in which a threshold L for confidence CD is set in association with information that identifies whether the buyer is a points member or not, and information that indicates whether or not there is a history of credit card payments. Specifically, a threshold Lx is set for the change condition in which the buyer's attributes are that of a non-member card holder and no history of credit card payments. A threshold Ly is set for the change condition in which the buyer's attributes are that of a non-member card holder and have a history of credit card payments. A threshold Ly is set for the change condition in which the buyer's attributes are that of a member card holder and no history of credit card payments. A threshold Lz is set for the change condition in which the buyer's attributes are that of a member card holder and have a history of credit card payments. 【0144】 The thresholds Lx, Ly, and Lz have the following relationship: [threshold Lx < threshold Ly < threshold Lz]. In other words, the threshold is set lowest for buyers who do not have a membership card and have no credit card payment history, slightly higher for buyers who do not have a membership card but have a credit card payment history, or for buyers who have a membership card but no credit card payment history, and highest for buyers who have a membership card and a credit card payment history. 【0145】 Purchasers with a credit card payment history can be identified through their credit card information. Therefore, they are more reliable than purchasers without a credit card payment history, and setting a higher threshold reduces the likelihood of misjudging fraudulent activity due to incorrect behavioral recognition. Alternatively, the threshold for the change condition of not owning a membership card but having a credit card payment history may be different from the threshold for the change condition of owning a membership card but having no credit card payment history, resulting in four threshold levels. 【0146】 Incidentally, other customer attributes that can influence the threshold change include the buyer's physical characteristics and appearance. For example, taller buyers are more likely to have their hands in the camera's blind spot, making them more prone to misidentification of their actions. For this reason, the threshold is lowered. 【0147】 Furthermore, the conditions for changing the threshold are not limited to customer attributes. For example, the attributes of the payment terminal, i.e., the self-service POS terminal 11, may also be used as conditions for changing the threshold. 【0148】 Figure 17 is a schematic diagram showing the main data structure of the third threshold table 823-3, which is a modified example of a threshold table that uses the attributes of the self-service POS terminal 11 as the condition for change. As shown in Figure 17, threshold table 823-1 is a table in which thresholds are set according to the operating time of the self-service POS terminal 11. Specifically, threshold Lx is set in association with the start time 10:00 and end time 15:00 of the first time period, threshold Ly is set in association with the start time 15:00 and end time 18:00 of the second time period, and threshold Ly is set in association with the start time 18:00 and end time 20:00 of the third time period. 【0149】 The thresholds Lx, Ly, and Lz have the following relationship: [threshold Lx < threshold Ly < threshold Lz]. The first time period is a relatively quiet time during the day, making it an environment where fraudulent activity is less likely. For this reason, a higher threshold Lz is set compared to other time periods. The second time period is a relatively busy time in the evening, making it an environment where fraudulent activity is more likely due to the crowded checkout area. For this reason, a higher threshold Ly is set compared to other time periods. The third time period is nighttime, making it an even more fraudulent environment. For this reason, the lowest threshold Lx is set. Thus, the more fraudulent an environment the self-POS terminal 11 is, the lower the threshold becomes, making it easier to detect fraudulent activity. Needless to say, the frequency of fraudulent activity in relation to time periods is not limited to this; for example, appropriate thresholds can be set for each store. 【0150】 Incidentally, other attributes of the self-service POS terminal 11 that can be used as conditions for changing the threshold can also be considered. For example, in the checkout area, there are self-service POS terminals 11 that are far from the attendant terminal and self-service POS terminals 11 that are close to the attendant terminal. Self-service POS terminals 11 that are far from the attendant terminal are more likely to be close to the attendant terminal. For this reason, the threshold for self-service POS terminals 11 that are far from the attendant terminal is set lower than the threshold for self-service POS terminals 11 that are close to the attendant terminal. 【0151】 [Other variations] In the above embodiment, an example was given in which a camera 21 is provided for each self-service POS terminal 11 to photograph the operator, who is the customer. For example, one camera 21 may be provided for two or more self-service POS terminals 11 to photograph each operator, who is the customer. 【0152】 In the above embodiment, an example was given in which one fraud detection device 22 detects fraudulent activity for multiple self-service POS terminals 11. For example, a fraud detection device 22 may be provided for each self-service POS terminal 11. In that case, the self-service POS terminal 11 may be equipped with the functions of the fraud detection device 22, thereby implementing a payment terminal with fraud detection capabilities. 【0153】 The behavior recognition unit 221 does not necessarily need to utilize AI-based behavior recognition technologies such as deep learning. For example, it is possible to recognize the behavior of shoppers by combining a 3D camera with various sensors such as optical sensors. 【0154】 The operation information acquisition unit 223 does not necessarily need to acquire operation information from the information displayed on the monitoring image 140. For example, when an operation is input to the self-POS terminal 11, the image displayed on the touch panel 41 of the self-POS terminal 11 changes. By recognizing this image change, operation information can be acquired. It is also possible to acquire operation information based on signals output from the self-POS terminal 11 to the POS server 12 or the attendant terminal 14. 【0155】 The fraud estimation unit 226 may estimate fraudulent activity by a purchaser without taking into account the purchaser's operation information on the self-service POS terminal 11. For example, if images captured by the camera 21 show a purchaser exchanging a purchased item for another item, fraudulent activity may be estimated. 【0156】 In the above embodiment, the confidence score CD was defined as the average value of the recognition rate RP from the start time STM to the end time FTM of the retrieval or bagging action. However, the method for calculating the confidence score CD is not limited to this. For example, the confidence score CD may be defined as the root mean square of the recognition rate RP. Alternatively, the confidence score CD may be defined as the maximum value of the recognition rate RP. 【0157】 In the above embodiment, the default threshold was set to Lx. In this regard, it is also possible to set other thresholds, Ly or Lz, as the default threshold. 【0158】 In addition, several embodiments of the present invention have been described, but these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be carried out in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their variations are included within the scope of the invention, as well as within the scope of the invention and its equivalents as described in the claims. The original claims of this application are included below. [C1] A behavioral recognition means for recognizing the actions of a buyer towards a payment terminal, A confidence level acquisition means for acquiring the confidence level of the recognition result for the buyer's behavior recognized by the behavior recognition means, A condition detection means for detecting the conditions for changing the threshold for the aforementioned reliability, A threshold determination means for determining the threshold based on the aforementioned change conditions, Fraud estimation means for estimating fraudulent activity by a purchaser based on the purchaser's actions recognized with a confidence level above the threshold determined by the threshold determination means, A device for estimating fraudulent activity, comprising the following: [C2] Output means for outputting the estimated result of the fraudulent act by the fraud estimation means, The fraud prescribing device described in [C1] further comprises the following: [C3] Operation information acquisition means for acquiring operation information of the purchaser to the payment terminal, Furthermore, it is equipped with, The fraud estimation means estimates fraudulent activity of the purchaser based on the purchaser's actions and operational information of the purchaser, which are recognized with a confidence level above the threshold, as described in [C1] or [C2]. [C4] The aforementioned modification conditions are the fraudulent activity estimation device described in any one of [C1] to [C3], which are attributes of the purchaser. [C5] The aforementioned modification conditions are the fraudulent activity estimation device described in any one of [C1] to [C3], which are attributes of the payment terminal. [C6] The computer of the fraud detection device, A behavioral recognition means for recognizing the actions of a buyer towards a payment terminal. A confidence level acquisition means for acquiring the confidence level of the recognition result for the buyer's behavior recognized by the behavior recognition means. Condition detection means for detecting the conditions for changing the threshold for the aforementioned reliability, A threshold determination means for determining the threshold based on the aforementioned change conditions, and Fraud estimation means for estimating fraudulent activity by a purchaser based on the purchaser's actions recognized with a confidence level equal to or greater than the threshold determined by the threshold determination means, A program designed to function as such. [Explanation of Symbols] 【0159】 11...Self-service POS terminal, 12...POS server, 13...Display control device, 14...Attendant terminal, 21...Camera, 22...Fraudulent activity estimation device, 30...Member database, 81...Processor, 82...Main memory, 83...Auxiliary storage device, 84...Clock, 85...Camera interface, 86...Communication interface, 100...Self-service POS system, 140...Surveillance image, 200...Fraudulent activity estimation system, 221...Behavior recognition unit, 222...Confidence level acquisition unit, 223...Operation information acquisition unit, 224...Condition detection unit, 225...Threshold determination unit, 226...Fraud estimation unit, 227...Output unit, 821...First buffer, 822...Second buffer, 823, 823-1, 823-2...Threshold table, 824...Threshold memory.

Claims

[Claim 1] A behavioral recognition means for recognizing the actions of a buyer towards a payment terminal, The reliability of the recognition result for the buyer's behavior recognized by the behavior recognition means is obtained. Means of obtaining confidence, A condition detection means for detecting conditions for changing the threshold for the confidence level based on data of a monitoring image generated based on data output from the payment terminal, A threshold determination means for determining the threshold based on the aforementioned change conditions, The buyer's actions recognized with a confidence level equal to or greater than the threshold determined by the threshold determination means It comprises a means for presuming fraudulent activity by the purchaser based on the above, The aforementioned change conditions are the attributes of the buyer, The attributes of the purchaser include attributes that are confirmed depending on whether the purchaser has entered information identifying the purchaser into the payment terminal. Fraud estimation device. [Claim 2] Output means for outputting the estimated result of the fraudulent act by the fraud estimation means, The fraudulent activity estimation device according to claim 1, further comprising: [Claim 3] Operation information acquisition means for acquiring operation information of the purchaser to the payment terminal based on the data of the monitoring image, Furthermore, it is equipped with, The fraud estimation device according to claim 1 or 2, wherein the fraud estimation means estimates fraudulent activity by the purchaser based on the purchaser's actions and operational information of the purchaser, which are recognized with a confidence level above the threshold. [Claim 4] The fraudulent activity estimation device according to any one of claims 1 to 3, wherein the attributes of the purchaser further include whether or not the number of visits is greater than or equal to a predetermined number, if information identifying the purchaser is entered. [Claim 5] The computer of the fraud detection device, A behavioral recognition means for recognizing the actions of a buyer towards a payment terminal. A confidence level acquisition means for acquiring the confidence level of the recognition result for the buyer's behavior recognized by the behavior recognition means. A condition detection means for detecting conditions for changing the threshold for the confidence level based on data of a monitoring image generated based on data output from the payment terminal, A threshold determination means for determining the threshold based on the aforementioned change conditions, and Fraud estimation means for estimating fraudulent activity by a purchaser based on the purchaser's actions recognized with a confidence level equal to or greater than the threshold determined by the threshold determination means, To make it function as, The aforementioned change conditions are the attributes of the buyer, A program in which the attributes of the buyer include attributes that are checked depending on whether the buyer has entered information identifying the buyer into the payment terminal.

Images