JP4046574B2 - Payment terminal fraud prevention system - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a system for preventing unauthorized use of a credit number or the like read by a payment terminal, and in particular, the check at the time of resuming payment of a payment terminal that has been opened and the payment operation is stopped is made strict to eliminate fraud. Is.
[0002]
[Prior art]
Conventionally, in settlement using a credit card, there are often accidents in which a credit number magnetically recorded on the credit card is illegally read and misused. As shown in FIG. 4, the credit card payment terminal 10 has a card insertion slit 12. When a credit card is inserted here and pulled out along the slit 12, the magnetic recording part of the credit card moves in contact with the magnetic head installed in the payment terminal 10, and the credit number recorded in the magnetic recording part is Read with a magnetic head.
The read credit number is sent to the settlement server 20 via the network 30 together with the payment amount data input from the settlement terminal 10, and a settlement process is performed.
In FIG. 4, a device for both credit / debit payment is shown as the payment terminal 10, and an input device 11 for PIN input is attached to the payment terminal main body 10.
[0003]
The unauthorized reading of the credit number is performed by opening the payment terminal 10 and secretly installing a recording device for storing the data read by the magnetic head in this device. The recording device is taken out from the payment terminal 10 at a later date. Thus, the credit number recorded in the recording device is read out.
[0004]
In order to prevent such fraud, a conventional payment terminal is provided with a sensor that detects opening, and is configured so that a payment operation cannot be performed when the sensor detects opening. For this reason, the payment terminal once opened cannot be used for payment unless the operator performs initial setting again.
[0005]
The payment terminal restricts acceptance of the initial setting with a password embedded at the time of manufacture. At the time of initial setting operation, the operator inputs this password to the payment terminal, and then inputs initial information to perform initial setting. Since this password is not disclosed, it is impossible for ordinary people who do not know it to repair the payment terminal once opened so that it can be settled.
[0006]
[Problems to be solved by the invention]
However, the password of the conventional payment terminal is set for each model, and the password is common for the same model. For this reason, once the password information is leaked, the unauthorized person who obtained this information can open the payment terminal of the same model and then repair it. The number can be read illegally, and the credit number can be used to make a payment from the repaired payment terminal.
[0007]
An object of the present invention is to solve such a conventional problem and to provide an unauthorized use prevention system for a payment terminal which prevents resumption of payment at an illegally operated payment terminal.
[0008]
[Means for Solving the Problems]
Therefore, in the fraud prevention system for a payment terminal of the present invention, the payment terminal that reads the identification information magnetically recorded on the card and outputs an online payment request based on this identification information, and the payment terminal receives an online payment request from the payment terminal. A payment means for receiving and performing online payment processing; a terminal management means for receiving a payment start request for requesting the start of online payment with the payment means from the payment terminal via the network, and granting the payment terminal permission to start payment with the payment means; The terminal management means holds the registration information about the payment terminal and the history information of the payment start request received from the payment terminal, and starts payment for the payment start request of the payment terminal based on these information The payment terminal determines whether to give permission, and after the payment terminal obtains the payment start permission from the terminal management means, It is configured so as to start the down payment.
[0009]
With such a configuration, in order to resume online payment with the opened payment terminal, it is necessary to obtain payment start permission from the terminal management means. Therefore, in the terminal management means, the payment start request history of the payment terminal, etc. Therefore, fraud at the payment terminal can be checked, and resumption of online payment by the payment terminal where fraud has been performed can be prevented.
[0010]
DETAILED DESCRIPTION OF THE INVENTION
As shown in FIG. 1, the system for preventing unauthorized use of a payment terminal according to an embodiment of the present invention includes a payment terminal 1 for both credit / debit, a payment server 20 for performing online payment processing, and a payment server for the payment terminal 1. 20, a terminal management server 40 that grants permission for settlement with the payment terminal 20, and a public line 30 that connects the payment terminal 1, the payment server 20, and the terminal management server 40. The terminal management server 40 has a terminal management database 41 that stores management information of the payment terminal 1.
[0011]
The user of the payment terminal 1 makes an application for use of the payment terminal 1 with a clear indication of the user name, the store name, the applicable payment type (credit payment or debit payment or both), and the like to the payment organization. The clearing house examines the application and assigns a user ID to the authorized user, and the terminal management database 41 of the terminal management server 40 stores the user ID, the user name, the store name, the applicable payment type, and the like. Register information.
When the payment terminal 1 is installed, the user inputs the user ID from the payment terminal 1 and instructs the payment terminal 1 to connect to the terminal management server 40. FIG. 2 shows a communication procedure at this time.
[0012]
The settlement terminal 1 accesses the terminal management server 40 to establish a connection with the terminal management server 40 ((1)), the settlement terminal 1 authenticates the partner with the terminal management server 40, and the terminal management server 40 Is authenticated with the payment terminal 1 ((2)), the payment terminal 1 issues a payment start request including the user ID and the serial number of the payment terminal 1 as shown in FIG. To (3).
[0013]
The terminal management server 40 searches the registration information in the terminal management database 41 (4), and when the information of the corresponding user ID is registered, the terminal management database 41 shows the information shown in FIG. As described above, the reception date and time of the settlement start request, the user ID, and the terminal serial number are recorded ((5)). Then, as shown in FIG. 3 (b), the terminal management server 40, for the payment terminal 10, the connection destination address of the payment server 20, the connection password to the payment server 20, the user name and store name, and application A payment start permission notification including the operation restriction information of the payment terminal such as the payment type is transmitted ((6)).
The payment terminal 1 that has received the payment start permission releases the connection with the terminal management server 40 ((7)).
[0014]
The settlement terminal 1 accesses the connection destination address of the settlement server 20 at the time of settlement with a credit card, and connects the settlement server 20 with a connection password, user name and store name, information on applicable settlement type, credit number read from the credit card, and payment. Send online data and request online payment. The payment server 20 authenticates the payment terminal 1 with the connection password and executes online payment.
Moreover, the payment terminal 1 is provided with the sensor which detects opening, and when this sensor detects opening, payment operation will be stopped. The payment terminal 1 that has stopped the payment operation requests payment start from the terminal management server 40 and receives payment from the terminal management server 40 to allow online payment with the payment server 20 in the same manner as at the time of installation. .
[0015]
The communication procedure at this time is the same as in FIG. That is, when the user inputs the user ID from the payment terminal 1 and instructs the payment terminal 1 to connect to the terminal management server 40, the payment terminal 1 accesses the terminal management server 40 and connects to the terminal management server 40. (1) and mutual authentication with the terminal management server 40 (2), a payment start request including the user ID and the serial number of the payment terminal 1 is sent to the terminal management server 40. To (3).
[0016]
The terminal management server 40 refers to the registration information related to the user ID and the history information of the settlement start request from the terminal management database 41 ((4)), and information on the corresponding user ID is registered. When a suspicious point cannot be found from the settlement start request history information, the reception date and time, the user ID, and the terminal serial number of this settlement start request are recorded in the terminal management database 41 ((5)), A payment start permission notification including a connection destination address of the payment server 20, a connection password to the payment server 20, a user name and a store name, and operation restriction information is transmitted to the payment terminal 10 ((6)).
The payment terminal 1 that has received the payment start permission releases the connection with the terminal management server 40 ((7)).
[0017]
Further, the terminal management server 40 refers to the registration information stored in the terminal management database 41 and the history information of the payment start request in the above (4), the terminal serial number is unregistered, the user ID and the terminal If the relationship with the serial number is different from the previous time, the number of payment start requests is abnormally high, or the payment start request is repeated in a short period, the payment start request is rejected as suspicious, Separately, measures such as dispatching a service person to the store where the payment terminal 1 is installed are taken.
[0018]
As described above, in this system, the online payment cannot be resumed unless the payment terminal 1 receives the payment start permission from the terminal management server 40, and the payment start request history of the payment terminal 1 is stored in the terminal management server. 40, the fraud in the payment terminal 1 can be checked by the terminal management server 40, and resumption of online payment by the payment terminal 1 in which fraud has been performed can be prevented.
[0019]
Even if the fraud of the payment terminal 1 cannot be found and the online payment is allowed to resume, if a fraud is detected at a later date, the user, the payment terminal, the store, etc. are identified from the record of the terminal management server 40. These facts can be effective in deterring fraud.
[0020]
Although the case where the terminal management server 40 is provided separately from the payment server 20 has been described here, the payment server 20 may also serve as the terminal management server 40.
Further, here, the case where the user ID is input from the payment terminal 1 and the terminal management server 40 grants the payment start permission based on the user ID has been described. However, the user inserts an IC card into the payment terminal 1. The terminal management server 40 may attach the payment and allow the settlement start based on the data recorded on the IC card.
In addition, the payment start permission information may include information such as an encryption key used for mutual authentication with the payment server 20.
[0021]
【The invention's effect】
As is apparent from the above description, in the payment terminal fraud prevention system of the present invention, it is possible to prevent opening of the payment terminal due to fraudulent operation and to suppress fraud using the payment terminal.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of a payment terminal fraud prevention system in an embodiment of the present invention. FIG. 2 is a sequence showing a communication procedure between a payment terminal and a terminal management server in an embodiment of the present invention. (a) Diagram showing data included in the settlement start request in the embodiment of the present invention (b) Diagram showing data included in settlement start permission in the embodiment of the present invention (c) In the terminal management server in the embodiment of the present invention Fig. 4 shows the data to be recorded. Fig. 4 is a block diagram showing a conventional online payment system.
DESCRIPTION OF SYMBOLS 1 Payment terminal 10 Payment terminal 11 PIN input device 12 Slit 20 Payment server 30 Network 40 Terminal management server 41 Terminal management database

Claims (6)

A payment terminal that reads the identification information magnetically recorded on the card and outputs an online payment request based on the identification information;
Payment means for receiving the online payment request from the payment terminal via a network and performing online payment processing;
A terminal management means for receiving a payment start request for requesting start of online payment with the payment means from the payment terminal via a network, and granting a payment start permission with the payment means to the payment terminal;
The terminal management means holds registration information related to the payment terminal and history information of the payment start request received from the payment terminal, and based on these information, the terminal management means responds to the payment start request of the payment terminal. It is determined whether or not to grant the settlement start permission, and the settlement terminal starts online settlement with the settlement means after obtaining the settlement start permission from the terminal management means. Fraud prevention system. 2. The fraudulent payment terminal according to claim 1, wherein once the payment terminal is opened, online payment with the payment means cannot be performed without obtaining the payment start permission again from the terminal management means. Prevention system. The payment terminal, when outputting the payment start request to the terminal management means, transmits the unique number of the payment terminal and the input identification information of the user to the terminal management means. 3. A fraud prevention system for a payment terminal according to 1 or 2. When the payment terminal outputs the payment start request to the terminal management means, the payment terminal transmits the unique number of the payment terminal and identification information read from the attached IC card to the terminal management means. The fraud prevention system for a payment terminal according to claim 1 or 2. 5. The terminal management unit, when giving the settlement terminal permission to start the settlement with the settlement unit, informs the settlement terminal of confidential information necessary for connection with the settlement unit. A fraud prevention system for a payment terminal according to any of the above. 6. The settlement terminal fraud prevention system according to claim 1, wherein the settlement unit and the terminal management unit exist in the same server.

Images