JP6931384B2 - Banking system, and how it is performed by the banking system - Google Patents

Description

The present invention relates to a banking system that utilizes machine learning to improve the detection accuracy of ATM fraud, and methods performed by the banking system.

The damage caused by special fraud due to the fraud of cash cards, in which a third party illegally withdraws money from an ATM, is increasing.

Each financial institution has taken various measures against such fraudulent damage. For example, when operating an ATM withdrawal, a message is sent to the customer's mobile phone and the withdrawal is made only when approved. The measures to be taken were known (Patent Document 1). However, the invention described in Patent Document 1 is an inconvenient method for a person who does not have a mobile phone or a person who does not happen to have one at the time of ATM withdrawal.

When such damage occurred, the police notified each financial institution of the damage occurrence information. A financial institution provided with damage information by the police will generate a list of customers who meet certain conditions in the crime area and surrounding areas, and will use one or more criteria (eg, for example) for the ATM withdrawal data of those customers. , Whether the withdrawal is more than the specified amount, etc.), and if damage is suspected, the transaction of the account is stopped and confirmation is made by calling the account holder.

Japanese Unexamined Patent Publication No. 2008-287515

In conventional monitoring, the standards are uniform and it is difficult to review flexibly, so even cases where the account holder makes a large withdrawal for a valid reason are erroneously detected, and the detection accuracy of fraudulent use is high. It wasn't very expensive. For this reason, increasing the number of customers to be monitored increases the number of cases of fraudulent use, but also increases the number of false positives. In addition, the final confirmation requires a human confirmation work to the account holder (for example, a call), which is laborious.

The present invention has been made to solve such a problem, and provides a banking system that uses machine learning to improve the detection accuracy of ATM fraud, and a method implemented by the banking system. With the goal.

The banking system according to one aspect of the present invention
It is determined whether or not a value indicating a monitoring target is set in the customer master data associated with the transaction data received from the ATM, and the value indicating the monitoring target is the result of a predetermined process associated with the first determination variable. Set as
On the condition that the value indicating the monitoring target is set, it is determined whether or not the received transaction data corresponds to the account suspension condition.
On the condition that the received transaction data corresponds to the account suspension condition.
Stop trading the account associated with the received transaction data and
A plurality of second determination variables are read, and the data associated with the read second determination variable is read from the customer master and / or the transaction data, and the read data and the read second determination variable are used. Based on, identify the corresponding second score,
The corresponding second score identified for each of the read second determination variables is added to calculate the second total score.
It is configured to determine whether the value of the second total score is within a predetermined reference value range.

The method performed by the banking system, which is another aspect of the present invention, is
It is to determine whether or not a value indicating a monitoring target is set in the customer master data associated with the transaction data received from the ATM, and the value indicating the monitoring target is a predetermined value associated with the first determination variable. It is set as a result of the processing of
On the condition that the value indicating the monitoring target is set, it is determined whether or not the received transaction data corresponds to the account suspension condition, and
On the condition that the received transaction data corresponds to the account suspension condition.
To suspend transactions in the account associated with the received transaction data,
A plurality of second determination variables are read, and the data associated with the read second determination variable is read from the customer master and / or the transaction data, and the read data and the read second determination variable are used. Identifying the corresponding second score based on
To calculate the second total score by adding the corresponding second scores identified for each of the read second determination variables.
It includes determining whether or not the value of the second total score is within a predetermined reference value range.

According to the present invention, it becomes easy to identify customer accounts and transactions that are relatively vulnerable to damage, and it is possible to improve the detection accuracy of ATM fraudulent use. Further, according to the present invention, it is possible to reduce the accidental suspension of the account transaction of a legitimate account holder, and it is possible to improve the business efficiency related to the prevention of additional damage and the detection of unauthorized use of ATMs.

A detailed understanding of the embodiments disclosed herein can be obtained from the following description illustrated in connection with the accompanying drawings.
It is a block diagram of the whole system including the banking system and ATM which concerns on embodiment of this invention. It is a system block diagram of the banking system which concerns on embodiment of this invention. It is a figure which shows an example of the data structure of a customer master. It is a figure which shows an example of the data structure of transaction data. It is a figure which shows an example of the data structure of the 1st determination variable. It is a figure which shows an example of the data structure of the 2nd determination variable. It is a flow chart explaining the calculation of the account score and the setting process of the target customer flag which concerns on this invention. It is a figure explaining the fraudulent use determination processing flow which concerns on this invention.

(overall structure)
FIG. 1 is a configuration diagram of an entire system including a banking system 10 and an ATM 11 according to an embodiment of the present invention. The banking system 10 and the ATM 11 are communicably connected via a known network.

The bank system 10 can receive transaction data (for example, deposit data, withdrawal data, transfer data, balance inquiry data, etc.) from ATM 11 and determine whether or not unauthorized use has been performed. Further, the bank system 10 receives an operation command from a terminal (not shown) of a business operator in the bank or a terminal (not shown) used by a customer (for example, a PC, a mobile terminal, etc.) and is based on the operation command. Processing can be performed (for example, cancellation of a suspended account).

The ATM 11 includes an automated teller machine (ATM) or a cash dispenser (CD), and transmits transaction data to the bank system 10 via a network. Although only one ATM 11 is shown in FIG. 1, there may be a plurality of ATMs 11.

Although the banking system 10 is described as one device in the present specification, various processes executed by the banking system 10 may be configured to be distributed and executed by a plurality of devices.

(System configuration)
FIG. 2 is a system configuration diagram of the banking system 10 according to the embodiment of the present invention. As shown in FIG. 2, the banking system 10 has a control unit 101, a main storage unit 102, an auxiliary storage unit 103, an interface (IF) unit 104, which are connected to each other by a bus 120 or the like, like a general computer. And an output unit 105. The banking system 10 also includes a customer master 106, transaction data 107, a first determination variable 108, and a second determination variable 109 in the form of a file / database or the like.

The control unit 101, also called a central processing unit (CPU), controls each component of the banking system 10 and calculates data, and also transfers various programs stored in the auxiliary storage unit 103 to the main storage unit 102. Read and execute. The main storage unit 102, also called a main memory, stores various received data, computer-executable instructions, and data after arithmetic processing by the instructions. The auxiliary storage unit 103 is a storage device typified by a hard disk (HDD) or the like, and is used when storing data or programs for a long period of time.

The embodiment of FIG. 2 describes an embodiment in which the control unit 101, the main storage unit 102, and the auxiliary storage unit 103 are provided inside the same computer, but as another embodiment, the bank system 10 has the control unit 101, By using a plurality of main storage units 102 and auxiliary storage units 103, it is possible to configure parallel distributed processing by a plurality of computers. Further, as another embodiment, it is also possible to install a plurality of servers for the bank system 10 so that the plurality of servers share one auxiliary storage unit 103.

The IF unit 104 serves as an interface for transmitting and receiving data to and from other systems and devices, and also provides an interface for receiving various commands and input data (various masters, tables, etc.) from a system operator. The output unit 105 provides a display screen for displaying the processed data, a printing means for printing the data, and the like.

The customer master 106 is a master file that stores customer information. FIG. 3 is a diagram showing an example of a data structure of the customer master 106 according to the embodiment of the present invention. The customer master 106 can include a customer ID 301, an account identification information 302, a place of residence / work place 303, an account score 304, and a target customer flag 305, but is not limited to these data items and other data. Items can also be included.

The customer ID 301 is an identifier that identifies the customer. The account identification information 302 is information for identifying an account opened by a customer in a bank, such as a bank code, a business office code, a deposit type, an account number, and an account name. The place of residence / work place 303 indicates the place of residence and / or the place of work of the customer. The account score 304 indicates the vulnerabilities score calculated by the banking system 10. The target customer flag 305 is a flag indicating that the account is vulnerable to damage and is subject to monitoring against fraudulent use.

Returning to FIG. 2, the transaction data 107 is transaction data such as deposit / withdrawal data and transfer data received from the ATM 11, and stores deposit / withdrawal detail data for the customer account. FIG. 4 is a diagram showing an example of a data structure of transaction data 107 according to an embodiment of the present invention. Transaction data 107 can include transaction date and time 401, account identification information 402, deposit / withdrawal location 403, deposit / withdrawal classification 404, amount 405, transaction score 406, and fraudulent use determination flag 407, but is limited to these data items. It is possible to include other data items without being done.

The transaction date and time 401 indicates the date and time when the transaction data occurred. The account identification information 402 is information for identifying an account opened by a customer at a bank, and is information indicating which customer the transaction data belongs to. The deposit / withdrawal place 403 indicates a place where the deposit / withdrawal is made, for example, an ATM of the own bank, an ATM of another bank, or an external ATM such as a convenience store. As is well known to those skilled in the art, each ATM is given an identifier, and the identifier of the ATM makes it possible to know where the ATM is installed.

The deposit / withdrawal category 404 indicates whether the transaction indicated by the transaction data is a deposit transaction or a withdrawal transaction. The amount 405 indicates the transaction amount. The amount 405 may include balance information after a deposit or withdrawal transaction. The transaction score 406 is a score indicating the degree of damage risk of the transaction indicated by the transaction data. The fraudulent use determination flag 407 is a flag indicating whether or not the transaction indicated by the transaction data is determined to be fraudulent use.

Returning to FIG. 2, the first determination variable 108 stores a plurality of determination variables for calculating the account score 304 of the customer account. The first determination variable 108 has the contents of the variables (variable name 502, criterion 504, score 505) based on the result of machine learning and analysis of the data stored in the customer master 106 and the transaction data 107 by the banking system 10. Can change dynamically.

FIG. 5 is a diagram showing an example of the data structure of the first determination variable 108 according to the embodiment of the present invention. The first determination variable 108 can include variable ID 501, variable name 502, group 503, criterion 504, and score 505, but is not limited to these data items and may also include other data items. It is possible.

The variable ID 501 is an identifier that identifies each variable. The variable name 502 indicates the variable name of each of the first determination variables. Group 503 is an identifier that identifies each of a plurality of criteria associated with a variable. Criteria 504 indicate the criteria associated with the variable name 502. The score 505 indicates the score corresponding to each of the criteria 504. In the present specification, the score 505 is set to a relatively low value when it is vulnerable to damage, and the score 505 is set to a relatively high value when it is difficult to be damaged. It is possible even if there is.

In the example given in FIG. 5, "area information" and "transaction form" are illustrated in the variable name 502, but the variable name 502 is set with variables associated with the customer attribute and the past behavior. For example, variables related to the customer's age and gender, place of residence / work place, variables related to withdrawal amount, variables related to income (deposit amount), variables related to the distance to the ATM used and the number of times of use, usage time zone Variables (including whether or not fees are incurred), ATM attributes used (own ATMs, ATMs of other banks, or external ATMs such as convenience stores), variables related to account balance, etc. Various events that can occur when making a transaction are set as variables. Numerical information such as the amount of money may use an average value, and when a standard deviation or the like is used, it can be based on a value of a predetermined period in the past (for example, half a year or one year).

Returning to FIG. 2, the second determination variable 109 stores a plurality of determination variables for calculating the degree of damage risk of the transaction indicated by each transaction data. The second determination variable 109 has the contents of the variables (variable name 602, reference 604, score 605) based on the result of machine learning and analysis of the data stored in the customer master 106 and the transaction data 107 by the banking system 10. Can change dynamically.

FIG. 6 is a diagram showing an example of the data structure of the second determination variable 109 according to the embodiment of the present invention. The second determination variable 109 can include the variable ID 601, the variable name 602, the group 603, the criterion 604, and the score 605, but is not limited to these data items and may include other data items. It is possible.

The variable ID 601 is an identifier that identifies each variable. The variable name 602 indicates the variable name of each of the second determination variables. Group 603 is an identifier that identifies each of a plurality of criteria associated with a variable. Criteria 604 indicate the criteria associated with the variable name 602. The score 605 indicates the score corresponding to each of the criteria 604. In the present specification, the score 605 is set to a relatively low value when it is determined to be fraudulent use, and is set to a relatively high value when it is not determined to be fraudulent use. It is possible even in the embodiment.

In the example given in FIG. 6, the variable name 602 exemplifies "past transaction behavior" and "usage status", but the variable name 602 is set with a variable that can improve the detection accuracy of fraudulent use. .. For example, variables related to the customer's age and gender, place of residence / work place, variables related to ATM withdrawal amount during a predetermined period, variables related to the distance of past used ATMs from home or work place, deposit amount and withdrawal amount. Variables, variables related to the number of times ATMs are used and usage time zones in a given period, variables related to the attributes of ATMs used (own ATMs, ATMs of other banks, or external ATMs such as convenience stores), related to account balances Variables, variables related to ATM use in areas where damage occurs frequently, variables related to deviations from past average withdrawals, etc., and various events that can occur when customers make transactions with financial institutions are variables. Is set as. Numerical information such as the amount of money may use an average value, and when a standard deviation or the like is used, it can be based on a value of a predetermined period in the past (for example, half a year or one year).

(Processing flow: Calculation of account score and setting processing of target customer flag)
FIG. 7 is a flow chart illustrating a process of calculating an account score and setting a target customer flag according to the present invention. In the processing flow of FIG. 7, a process of identifying a customer's account with a high degree of risk by learning customer attributes and past behavior will be described.

In S701, the banking system 10 reads a plurality of first determination variables from the first determination variable 108, and stores the read first determination variable in the main storage unit 102. Alternatively, the first determination variable may be read out from the first determination variable 108 one by one, and the banking system 10 may repeat the process of S702.

In S702, the banking system 10 reads the data associated with one of the read first determination variables from the customer master 106 and / or the transaction data 107. For example, in the example of FIG. 5, when the read first determination variable is "area information", the banking system 10 reads the customer's place of residence information from the customer master 106, and reads the read out place of residence information. Compare with the information of the XX area received from an external organization such as the police, and calculate how far the customer's place of residence is from the XX area. After that, the banking system 10 determines which of the criteria 504 the calculated distance corresponds to, and identifies the corresponding score 505. Depending on the first determination variable, the process of S702 may be repeated for the other first determination variable without identifying the score (for example, because the distance is too far). As another example, when the read first determination variable is related to the information stored in the transaction data 107, the banking system 10 may use the information stored in the transaction data 107 (eg, transaction score 406 or misuse). The score 505 can be identified based on the determination flag 407, etc.).

In the process of S702, the above process is repeated for all the variables of the read first determination variable, and the score identified for each variable is stored in the main storage unit 102.

In S703, the banking system 10 adds the scores of the first determination variables identified in S702 to calculate the total score. The banking system 10 sets the total score to the account score 304 of the customer master 106 and updates the customer master 106.

In S704, the bank system 10 reads customer data having an account score value in a predetermined range from the customer master 106, and sets a value indicating that the target customer flag 305 is a monitoring target for ATM fraud detection. Then update the customer master 106. Further, the bank system 10 can set a value indicating that the data of the customer master 106 other than the above is not applicable.

The values of the score and the flag set in the first determination variable 108 and the customer master 106 can be dynamically changed. As will be described with reference to FIG. 8, the banking system 10 can perform machine learning on the result of determining whether or not it is unauthorized use based on the transaction data received from the ATM 11, and as a result of the machine learning, the first When the content of the determination variable 108 of 1 changes, the banking system 10 can dynamically change the values of the score and the flag set in the customer master 106.

(Processing flow: Unauthorized use judgment processing)
FIG. 8 is a diagram illustrating a fraudulent use determination processing flow according to the present invention. In S801, the bank system 10 receives the transaction data from the ATM 11 and stores the received data in the transaction data 107. The received transaction data may be associated with the withdrawal process performed at ATM 11. The withdrawal process may include a transfer process.

In S802, the bank system 10 identifies the data of the customer master 106 whose account identification information matches based on the information of the account identification information 402 included in the received transaction data, and detects ATM fraudulent use in the target customer flag 305. Judges whether or not a value indicating that the data is to be monitored is set. If it is set, the process proceeds to S803, and if it is not set, this processing flow is terminated and another transaction data is processed.

In S803, the banking system 10 determines whether or not the received transaction data meets the account suspension condition. Account suspension conditions are, for example,
(1) Is it a withdrawal at an ATM set in a crime-prone area?
(2) Is the withdrawal at an ATM other than your own ATM (other banks, convenience stores, etc.)?
(3) Is the withdrawal exceeding the predetermined threshold upper limit?
It may be a plurality of conditions set arbitrarily.

If the received transaction data meets the account suspension condition, the transaction of the account is stopped and the process proceeds to S804. If not, the present processing flow is terminated and another transaction data is processed. Suspending transactions in an account indicates that the banking system 10 controls the banking system 10 to prevent transactions (such as deposits and withdrawals) related to the account, as is well known to those skilled in the art.

In S804, the banking system 10 reads a plurality of second determination variables from the second determination variable 109, and stores the read second determination variable in the main storage unit 102. Alternatively, the second determination variable may be read from the second determination variable 109 one by one, and may be configured so that the process of S805 is repeated.

In S805, the banking system 10 reads the data associated with one of the read second determination variables from the customer master 106 and / or the transaction data 107. For example, in the example of FIG. 6, when the second determination variable read out is "past transaction behavior", the banking system 10 of the ATM indicated by the deposit / withdrawal place 403 of the transaction data received in S801. Judge the contents of past transaction behavior such as whether the location is 〇〇. As is well known to those skilled in the art, each ATM is given an identifier, and each financial institution can grasp the location of each ATM.

When the banking system 10 determines that the withdrawal indicated by the transaction data has been made at XX ATM, the banking system 10 identifies which criterion 604 is applicable according to the second determination variable 109 as illustrated in FIG. , Identify the corresponding score 605.

The banking system 10 repeats the above-mentioned processing for all the variables of the second determination variable read out, adds the scores identified for each variable, and calculates the total score. The banking system 10 sets the total score to transaction score 406 and updates transaction data 107.

In S806, the banking system 10 determines whether or not the value of the transaction score 406 of the transaction data 107 is less than a predetermined reference value. If it is determined to be less than the reference value, the process proceeds to S807, and if it is not determined to be less than the reference value, the process proceeds to S808.

In S807, the bank system 10 sets the fraudulent use determination flag 407 of the transaction data 107 to a value indicating that the transaction indicated by the transaction data received in S801 is determined to be fraudulent use, and updates the transaction data 107. do.

In S808, the banking system 10 sets the fraudulent use determination flag 407 of the transaction data 107 to a value indicating that the transaction indicated by the transaction data received in S801 was not determined to be fraudulent use, and sets the transaction data 107. Update.

After the processing of S807 or S808, the bank system 10 notifies the terminal of the business operator of the judgment result, the business operator transmits the result of contacting the customer to the bank system 10, and the bank system 10 sends the result. The corresponding data of the transaction data 107 can be changed based on the above. The banking system 10 may be configured to change the corresponding data in response to receiving a change request for the determination result from the customer's terminal. The banking system 10 can machine-learn the changed contents (for example, with / without change of judgment), and based on the information obtained as a result of the machine learning, the "account suspension condition" of S803 and the "predetermined" of S806. The "reference value of" can be changed dynamically.

Further, the bank system 10 responded to the reception of the suspension release command of the account suspended in S803 from the terminal of the business operator (that is, as a result of contact with the customer, the bank system 10 was a legitimate use by the customer. It turns out that the customer requested the suspension to be lifted), and the account can be lifted. Alternatively, the banking system 10 can unsuspend the account in response to receiving a request to unsubscribe the account from any terminal used by the customer (eg, via any application). .. Since it is determined that the customer's request for cancellation is not unauthorized use, the banking system 10 machine-learns which of the second determination variables for the transaction data is the source of the incorrect determination. can do.

Although the principles of the present invention have been described above with reference to exemplary embodiments, those skilled in the art will appreciate that various embodiments that change in configuration and details can be realized without departing from the gist of the present invention. You will understand. That is, the present invention can be implemented as, for example, a system, an apparatus, a method, a program, a storage medium, or the like.

10 Banking system 11 ATM
101 Control unit 102 Main storage unit 103 Auxiliary storage unit 104 Interface (IF) unit 105 Output unit 106 Customer master 107 Transaction data 108 First judgment variable 109 Second judgment variable

Claims (7)

It is a banking system, and the banking system is
It is determined whether or not a value indicating a monitoring target is set in the customer master data associated with the transaction data received from the ATM, and the value indicating the monitoring target is the result of a predetermined process associated with the first determination variable. Set as
On the condition that the value indicating the monitoring target is set, it is determined whether or not the received transaction data corresponds to the account suspension condition.
On the condition that the received transaction data corresponds to the account suspension condition.
Stop trading the account associated with the received transaction data and
A plurality of second determination variables are read, and the data associated with the read second determination variable is read from the customer master and / or the transaction data, and the read data and the read second determination variable are used. Based on, identify the corresponding second score,
The corresponding second score identified for each of the read second determination variables is added to calculate the second total score.
In order to determine whether or not the transaction indicated by the received transaction data is fraudulent use, it is determined whether or not the value of the second total score is within a predetermined reference value range.
The transaction data is a first value indicating that the transaction indicated by the transaction data is determined to be fraudulent, provided that the value of the second total score is determined to be within a predetermined reference value range. Set to
The transaction data is a second value indicating that the transaction indicated by the transaction data was not determined to be fraudulent, provided that the value of the second total score is determined not to be within the predetermined reference value range. Set to
After the first value has been set, or after the second value has been set, the first value of the transaction data has been changed based on the response from the customer associated with the account. , Or a banking system configured to machine learn that the second value of the transaction data has changed. The banking system of claim 1 , wherein the account suspension condition and the predetermined reference value are dynamically updated based on the information obtained as a result of the machine learning. In response to receiving the account stop release request associated with the customer, the account stop release request to the transaction data and the second determination variables further to machine learning configured to be associated, according to claim 1 or The banking system of claim 2. Setting a value indicating the monitoring target in the data of the customer master is
Read a plurality of the first determination variables,
The data associated with each of the read first determination variables is read from the customer master and / or a plurality of the transaction data, and the first determination variable corresponding to the data associated with each of the read first determination variables. Identify the corresponding first score based on the decision variable and
The first total score is calculated by adding the first scores identified for each of the read first determination variables.
The banking system of claim 1, which is executed by updating the customer data associated with the first total score in a predetermined range with a value indicating the monitoring target. The banking system of claim 4 , wherein the first determination variable, the first score associated with the customer data, and the value indicating the monitoring target are dynamically changed as a result of machine learning. A method performed by a banking system, said method.
It is to determine whether or not a value indicating a monitoring target is set in the customer master data associated with the transaction data received from the ATM, and the value indicating the monitoring target is a predetermined value associated with the first determination variable. It is set as a result of the processing of
On the condition that the value indicating the monitoring target is set, it is determined whether or not the received transaction data corresponds to the account suspension condition, and
On the condition that the received transaction data corresponds to the account suspension condition.
To suspend transactions in the account associated with the received transaction data,
A plurality of second determination variables are read, and the data associated with the read second determination variable is read from the customer master and / or the transaction data, and the read data and the read second determination variable are used. Identifying the corresponding second score based on
To calculate the second total score by adding the corresponding second scores identified for each of the read second determination variables.
In order to determine whether or not the transaction indicated by the received transaction data is fraudulent use, it is determined whether or not the value of the second total score is within a predetermined reference value range .
The transaction data is a first value indicating that the transaction indicated by the transaction data is determined to be fraudulent, provided that the value of the second total score is determined to be within a predetermined reference value range. To set to
The transaction data is a second value indicating that the transaction indicated by the transaction data was not determined to be fraudulent, provided that the value of the second total score is determined not to be within the predetermined reference value range. To set to
After the first value has been set, or after the second value has been set, the first value of the transaction data has been changed based on the response from the customer associated with the account. , Or a method comprising machine learning that the second value of the transaction data has been changed . A program that, when executed by a processor, causes a banking system to perform the method of claim 6.

Images