JP7095007B2 - Monitoring equipment, monitoring methods and computer programs - Google Patents

Description

The present invention relates to a technique for determining fraud in a transaction using a payment medium.

In recent years, cashless payments have become widespread, and the volume of transactions using cashless payment media is increasing. With such an increase in transaction volume, fraudulent transactions are also increasing. Therefore, a technique for detecting fraud in transactions using cashless media has been proposed. For example, Patent Document 1 proposes a technique for suppressing unauthorized use of a credit card by enabling it when it detects the passage of one or more spots registered in advance.

Japanese Unexamined Patent Publication No. 2018-206280

However, although a technique for detecting fraud in individual transactions has been proposed as in Patent Document 1, there is a possibility that there may be fraudulent transactions that cannot be detected accurately by the conventional techniques.

In view of the above circumstances, an object of the present invention is to provide a technique capable of detecting fraud with higher accuracy in a transaction using a payment medium.

One aspect of the present invention is a determination unit for determining whether or not a value obtained based on a plurality of transaction information relating to payment using a payment medium satisfies one or a plurality of predetermined determination conditions relating to an event that may be fraudulent. A monitoring device including an information providing unit that provides information on a determination result of the determination unit to a predetermined device or a person.

One aspect of the present invention is the above-mentioned monitoring device, further comprising an information management unit for acquiring authority information transmitted from a member store terminal that performs processing related to payment using the payment medium, and the determination unit is a determination unit. The determination is made based on the information obtained by the information management unit.

One aspect of the present invention is the above-mentioned monitoring device, and the determination unit is each member store where payment using the payment medium is made, or the issuer of the payment medium used for payment. For each issuer, it is determined whether or not the above-mentioned determination conditions are satisfied.

One aspect of the present invention is the monitoring device, wherein the determination unit includes a member store in which payment is made using the payment medium and an issuer who is the issuer of the payment medium used for payment. For each combination of, it is determined whether or not the determination condition is satisfied.

One aspect of the present invention is a determination step of determining whether or not a value obtained based on a plurality of transaction information relating to payment using a payment medium satisfies one or a plurality of predetermined determination conditions relating to an event that may be fraudulent. It is a monitoring method including an information providing step of providing information on a determination result in the determination step to a predetermined device or a person.

One aspect of the present invention is a computer program for operating a computer as the above-mentioned monitoring device.

INDUSTRIAL APPLICABILITY According to the present invention, fraud can be detected with higher accuracy in transactions using a payment medium.

It is a schematic block diagram which shows the system configuration of the payment system 100. It is a schematic block diagram which shows the outline of the functional structure of the member store terminal 10. It is a schematic block diagram which shows the outline of the functional structure of FEP apparatus 20. It is a schematic block diagram which shows the outline of the functional structure of a monitoring device 40. It is a figure which shows the specific example of a transaction information table. It is a figure which shows the specific example of the transaction statistical information table. It is a figure which shows the specific example of the specific transaction statistical information table. It is a sequence chart which shows an example of the operation of the payment system 100.

Hereinafter, a specific configuration example of the present invention will be described with reference to the drawings.
FIG. 1 is a schematic block diagram showing a system configuration of the payment system 100. The payment system 100 includes a member store terminal 10, a FEP device 20, a management device 30, and a monitoring device 40. In the payment system 100, payment using one or a plurality of types of payment protocols is realized. In the payment protocol used in the payment system 100, a transaction using a payment medium issued to a user is performed. For example, when a postpaid payment medium is used, payment processing using the payment medium is performed first, and then payment is performed according to the payment medium. At the time of payment, a physical medium carried by the user (hereinafter referred to as "user medium") is used. Further, at the time of payment or payment, information issued in association with the payment medium (hereinafter referred to as "medium information") is used. For example, when the payment medium is a credit card, the medium information is a real card number (for example, Funding Primary Account Number: FPAN), and a card medium such as a plastic card on which the real card number of the credit card is recorded is used as a user medium. Or an information device such as a smartphone on which a token corresponding to the actual card number is recorded may be used. As a specific example of the payment protocol, payment may be performed using, for example, a credit card as a card medium. In this case, the payment medium is a credit card, and the actual card number (specific example of the medium information) recorded on the card medium (specific example of the user medium) of the credit card owned by the user is read by the member store terminal 10. The processing related to payment is executed in cooperation with the FEP device 20 and the management device 30. After that, the management device 30 executes the processing related to the settlement. Further, the monitoring device 40 detects fraud by determining whether or not there is a possibility of fraud in each settlement transaction.

As a specific example of the payment protocol, credit card payment using tokens may be performed. In this case, the token recorded in the user terminal owned by the user is read by the member store terminal 10. The token read by the member store terminal 10 is converted into medium information (for example, a real card number) registered according to the token in a token management server (not shown). The medium information (actual card number) is transmitted to the management device 30, and the processing related to payment is executed. After that, the management device 30 executes the processing related to the settlement. In this case as well, the monitoring device 40 detects fraud by determining whether or not there is a possibility of fraud in each settlement transaction.

Although two specific examples have been given above, the payment protocol implemented in the payment system 100 does not have to be limited to the above. For example, a payment protocol using electronic value may be used, or a debit card payment protocol may be used. In the following description, as a specific example of the payment system 100, a payment system 100 in which a payment protocol for payment using a credit card medium is implemented will be described.

The member store terminal 10 and the FEP device 20 can communicate with each other via the network 50. The network 50 is a wide area communication network such as the Internet. The network 50 may be a network using wireless communication or a network using wired communication. The network 50 may be configured by combining a plurality of networks.

FIG. 2 is a schematic block diagram showing an outline of the functional configuration of the member store terminal 10. The member store terminal 10 is configured by using an information processing device such as a smartphone, a tablet terminal, or a dedicated terminal. The member store terminal 10 is a terminal device installed in a store (hereinafter referred to as “member store”) that is a member of a specific agreement regarding the use of the payment medium used in the payment protocol. In a payment system in which a payment protocol for payment using a credit card medium is implemented as in the present embodiment, the member store terminal 10 is installed in a store that has a contract with a specific acquirer related to the payment system 100. It is a terminal to be used.

When the member store terminal 10 acquires information related to the payment medium from the user medium, the member store terminal 10 performs payment processing using the acquired information related to the payment medium. For example, when the user medium is a plastic card of a credit card, the member store terminal 10 may read the actual card number recorded on the plastic card and perform payment processing.

The communication unit 11 is a communication device such as a network interface. The communication unit 11 is communicably connected to the network 50 by a predetermined protocol. The communication unit 11 may be configured by using a device that communicates with the base station device by, for example, a mobile communication protocol. The communication unit 11 may be configured by using a device that communicates with a wireless LAN (Local Area Network) technology such as WiFi (registered trademark). The communication unit 11 may be configured by using a device that communicates with a communication device such as a home gateway by a wired LAN. The communication unit 11 communicates data with another device via the network 50 under the control of the control unit 15.

The reading unit 12 is a device that reads media information from the user medium. The reading unit 12 may be configured by using, for example, a reading device capable of reading medium information recorded on a magnetic recording medium. The reading unit 12 may be configured by using, for example, a communication device that performs short-range wireless communication. The reading unit 12 may read the media information by communicating with the user medium using a technique such as Near Field Communication (NFC) or RFID. The reading unit 12 may communicate using, for example, an infrared communication technique.

The input unit 13 is configured by using an existing input device such as a keyboard, a pointing device (mouse, tablet, etc.), a button, and a touch panel. The input unit 13 is operated when the instruction of the operator of the member store terminal 10 is input to the member store terminal 10. The input unit 13 may be an interface for connecting the input device to the member store terminal 10. In this case, the input unit 13 inputs the input signal generated in response to the input of the operator in the input device to the member store terminal 10. The operator of the member store terminal 10 may be, for example, an employee at the member store, a consumer who intends to make a payment at the member store, or another person, a living thing, or a machine. May be.

The output unit 14 may be an image display device such as a liquid crystal display, an organic EL (Electro Luminescence) display, an electrophoretic display, a speaker, or an output device of another aspect. good. The output unit 14 outputs information according to the control of the control unit 15. The output unit 14 may be, for example, an interface for connecting the image display device to the member store terminal 10. In this case, the output unit 14 generates a video signal for displaying an image under the control of the control unit 15, and outputs the video signal to the image display device connected to the output unit 14. The output unit 14 may be, for example, an interface for connecting the speaker to the member store terminal 10. In this case, the output unit 14 generates an audio signal for outputting the audio according to the control of the control unit 15, and outputs the audio signal to the audio output device connected to the output unit 14.

The control unit 15 is configured by using a processor such as a CPU (Central Processing Unit) and a memory. The control unit 15 functions as a payment control unit 151 when the processor executes a specific program.

The payment control unit 151 operates according to a predetermined payment protocol to perform payment processing using a user medium. For example, the payment control unit 151 generates authorization information for the medium information read by the reading unit 12. The authorization information is information for inquiring whether or not payment processing may be performed based on the read medium information. For example, by sending authorization information, the judgment result is whether the amount to be paid is within the payable amount, whether the user medium may not be used by a legitimate owner, and so on. can get. The payment control unit 151 outputs the obtained determination result to the output unit 14. When the payment control unit 151 obtains a determination result that payment is permitted, the payment control unit 151 performs payment processing based on the read medium information.

FIG. 3 is a schematic block diagram showing an outline of the functional configuration of the FEP device 20. The FEP device 20 is a device configured as, for example, a Front End Processing device. The FEP device 20 is configured by using an information processing device such as a server device or a personal computer. The FEP device 20 includes a communication unit 21 and a control unit 22.

The communication unit 21 is a communication device such as a network interface. The communication unit 21 is communicably connected to the network 50 by a predetermined protocol. The communication unit 21 may be configured by using a device that communicates with a communication device such as a gateway by wire. The communication unit 21 may be configured by using a device that communicates with the base station device by, for example, a mobile communication protocol. The communication unit 21 may be configured by using a device that communicates with a wireless LAN technique such as WiFi (registered trademark). The communication unit 21 communicates data with another device via the network 50 under the control of the control unit 22.

The control unit 22 is configured by using a processor such as a CPU and a memory. The control unit 22 functions as a communication control unit 221 when the processor executes a specific program.

When the communication control unit 221 receives the authorization information from the member store terminal 10, the communication control unit 221 transmits the authorization information to the management device 30 according to the received authorization information. When the communication control unit 221 receives the authorization information from the member store terminal 10, the communication control unit 221 also transmits the received authorization information to the monitoring device 40. The communication control unit 221 may be configured to transmit all the received authorization information to the monitoring device 40.

The management device 30 is configured by using an information processing device such as a server device or a personal computer. The management device 30 includes a processor such as a CPU and a memory, and functions by the processor executing a specific program. The management device 30 acquires the authorization information transmitted from the member store terminal 10 and records the history. The management device 30 performs a determination process regarding the received authorization information, and transmits the result of the determination process to the member store terminal 10. The management device 30 may generate predetermined statistical information based on the received authorization information and transmit it to the monitoring device 40.

FIG. 4 is a schematic block diagram showing an outline of the functional configuration of the monitoring device 40. The monitoring device 40 acquires authorization information transmitted from the member store terminal 10 and detects fraud based on one or a plurality of conditions. The monitoring device 40 is configured by using an information processing device such as a server device or a personal computer. The monitoring device 40 includes a communication unit 41, an input unit 42, an output unit 43, a transaction information storage unit 44, a registration information storage unit 45, a determination condition storage unit 46, a statistical information storage unit 47, a determination result storage unit 48, and a control unit 49. To prepare for.

The communication unit 41 is a communication device such as a network interface. The communication unit 41 is communicably connected to the network 50 by a predetermined protocol. The communication unit 41 may be configured by using a device that communicates with a communication device such as a gateway by wire. The communication unit 41 may be configured by using a device that communicates with the base station device by, for example, a mobile communication protocol. The communication unit 41 may be configured by using a device that communicates with a wireless LAN (Local Area Network) technology such as WiFi (registered trademark). The communication unit 41 communicates data with other devices via the network 50 under the control of the control unit 49. The communication unit 41 receives, for example, the authorization information transmitted from the FEP device 20.

The input unit 42 is configured by using an existing input device such as a keyboard, a pointing device (mouse, tablet, etc.), a button, and a touch panel. The input unit 42 is operated when the instruction of the operator of the monitoring device 40 is input to the monitoring device 40. The input unit 42 may be an interface for connecting the input device to the monitoring device 40. In this case, the input unit 42 inputs the input signal generated in response to the input of the operator in the input device to the monitoring device 40.

The output unit 43 may be an image display device such as a liquid crystal display, an organic EL display, or an electrophoretic display, may be a speaker, or may be an output device of another embodiment. The output unit 43 outputs information according to the control of the control unit 49. The output unit 43 may be, for example, an interface for connecting the image display device to the monitoring device 40. In this case, the output unit 43 generates a video signal for displaying an image under the control of the control unit 49, and outputs the video signal to the image display device connected to the output unit 43. The output unit 43 may be, for example, an interface for connecting a speaker to the monitoring device 40. In this case, the output unit 43 generates an audio signal for outputting the audio according to the control of the control unit 49, and outputs the audio signal to the audio output device connected to the output unit 43.

The transaction information storage unit 44 is configured by using a storage device such as a magnetic hard disk or a semiconductor storage device. The transaction information storage unit 44 stores a history of information regarding payment transactions made using a payment medium in the payment system 100. For example, the transaction information storage unit 44 stores a transaction information table. FIG. 5 is a diagram showing a specific example of the transaction information table. The transaction information table has a plurality of transaction information records. A transaction information record has information about a single payment transaction made using a payment medium. For example, the transaction information record has each value of transaction ID, customer ID, member store ID, medium information, transaction date and time, and transaction amount. The transaction ID is identification information indicating an individual transaction. The customer ID is identification information indicating a customer who uses a payment medium. The member store ID is identification information indicating a member store capable of making payment using a payment medium. The media information indicates the media information used in the transaction. The transaction date and time indicates the date and time when the payment in the transaction was made. The transaction amount indicates the amount of money paid in the transaction. The transaction information record may be generated based on, for example, the received authorization information.

The registration information storage unit 45 is configured by using a storage device such as a magnetic hard disk device or a semiconductor storage device. The registration information storage unit 45 stores information registered in advance in relation to medium information (for example, a real card number of a credit card). For example, the registration information storage unit 45 may store information indicating a correspondence relationship between the actual card number of the credit card and the issuer (card issuing company) that is the issuer of the credit card. More specifically, information indicating the correspondence between a part of the actual card number (for example, the first 6 digits of the 16-digit number) and the issuer may be stored. As the information indicating the issuer, the issuer ID, which is the identification number of the issuer, may be used.

The determination condition storage unit 46 is configured by using a storage device such as a magnetic hard disk device or a semiconductor storage device. The determination condition storage unit 46 stores one or a plurality of determination conditions used in the determination process in the determination unit 492 of the control unit 49. The determination condition storage unit 46 stores determination conditions indicating fraud to be detected by the monitoring device 40. When the determination unit 492 makes a determination based on the determination condition stored in the determination condition storage unit 46, fraud related to the transaction using the payment medium is detected. The judgment condition stored in the judgment condition storage unit 46 is not a judgment condition made based on information related to individual transactions (for example, individual authorization information), but a judgment condition made based on information related to a plurality of transactions. be. For example, it may be a condition for determination based on the total transaction amount (total amount or total number) for a predetermined period (for example, 1 hour, 1 day, etc.), or for a predetermined number (for example, 10, 100, 1000, etc.). It may be a condition of judgment made based on the total transaction amount in the transaction. More specifically, the condition may be determined based on a comparison between the latest total transaction amount for a predetermined period and the past total transaction amount for a predetermined period. The total transaction volume in the past predetermined period is a statistical value (for example, average value or maximum value) of the total transaction volume in each predetermined period obtained in a period longer than the predetermined period (for example, 1 hour) (for example, 1 day). You may. Hereinafter, a plurality of specific examples of the determination conditions will be described.

<First judgment condition>
For each combination of member store and issuer, a condition indicating that the transaction volume has increased sharply is set as the first judgment condition. As for the content of the specific first judgment condition corresponding to the combination of the member store and the issuer, the same content may be set for all combinations, and the content different from others in some combinations or all combinations. May be set. As a condition indicating that the transaction volume has increased sharply, a condition indicating that the transaction amount has increased sharply or a condition indicating that the number of transactions (number of transactions) has increased sharply may be set. More specifically, statistical information of the past predetermined number of days (for example, only the previous day, the past 3 days, the past 1 month, etc.) (for example, the average value of the total amount in one hour, the maximum value of the total amount in one hour, the total amount in one day, etc.) The total amount and statistical information for the most recent (latest) specific period exceeded a predetermined threshold (for example, 3 times the standard, 10 times the standard, etc.) based on the average value of, the maximum value of the total amount per day, etc.). May be set as a condition. For example, the first determination condition may be that the number of transactions in the most recent hour exceeds 10 times the average value of the number of transactions per hour on the previous day. For example, based on past statistics, a fixed threshold value that is assumed to be exceeded unless the probability is fairly low (for example, a threshold value indicating that the transaction amount per hour exceeds 1 million yen) is a condition. It may be set. An and condition (and condition, product condition) or an or condition (or condition, sum condition) of a plurality of combinations of the above-mentioned conditions may be set as the first determination condition.

<Second judgment condition>
For each issuer, a condition indicating that the transaction volume has increased sharply is set as a second judgment condition. As for the content of the specific second determination condition corresponding to the issuer, the same content may be set for all issuers, or different content may be set for some issuers. The condition indicating that the transaction volume has increased sharply may be the same as the first determination condition described above.

<Third judgment condition>
For each issuer, a condition indicating that fraud at the time of proxy is being performed is set as a third judgment condition. For example, the content of the condition described as an example of the first determination condition described above and different from the content of the second determination condition may be set as the third determination condition. For example, a condition indicating that the cumulative amount of money in the agency time zone has exceeded a predetermined threshold value may be set as the third determination condition. The agency time zone is a time zone in which another company undertakes processing related to the authority information of one company and executes it on behalf of another company due to circumstances such as equipment maintenance. Processing related to authorization information during the proxy time may limit the customer information used for the inquiry, in which case the security may be lower than usual. If the transaction volume increases sharply during such an agency time zone, there is a possibility that the transaction is fraudulent at the timing when the security becomes lower than usual. Therefore, such a third determination condition may be used. In addition, instead of the cumulative amount of the agency time zone, the relative value of the transaction amount between the agency time zone and the normal time, the relative value of the transaction volume, and the relative value of the high-value transaction ratio may be used, or the agency time zone and It may be determined by comparing the amount of increase or the rate of increase with the normal time with a certain threshold value. In addition, the percentage of response codes answered at the time of authorization, their absolute values (such as the detection of frequent occurrence of certain limited error codes), and the authorization interval (execution of authorization too early by mechanical work such as Bot). It may be determined whether or not the third determination condition is satisfied by comparing the frequency of occurrence and the like with the threshold value.

<Fourth judgment condition>
For each combination of member stores and issuers, a condition indicating that ECI (Electronic Commerce Indicator) fraudulent transactions have increased rapidly in a short period of time is set as the fourth determination condition. For example, the content of the specific fourth determination condition corresponding to the combination of the member store and the issuer may be set to the same content for all combinations, and some combinations or all combinations may be different from others. Different contents may be set. Conditions indicating that ECI fraudulent transactions have increased sharply in a short period of time include conditions indicating that the transaction amount without ECI has increased sharply and conditions indicating that the number of transactions without ECI (number of transactions) has increased sharply. May be set. In this case, the transaction amount and the number of transactions without ECI may include both the approval and non-approval authorization determination results. More specifically, statistical information on transactions without ECI for the past predetermined number of days (for example, only the previous day, the past 3 days, the past 1 month, etc.) (for example, the average value of the total amount per hour, the maximum value of the total amount per hour). , The latest (latest) statistical information exceeds a predetermined threshold (for example, 3 times the standard, 10 times the standard, etc.) based on the average value of the total daily amount, the maximum value of the total daily amount, etc.) May be set as a condition. For example, the fourth determination condition may be that the number of transactions in the most recent hour exceeds 10 times the average value of the number of transactions per hour on the previous day. For example, based on past statistics, a fixed threshold value that is assumed to be exceeded unless the probability is fairly low (for example, a threshold value indicating that the transaction amount without ECI per hour exceeds 1 million yen). May be set as a condition. An and condition (and condition, product condition) or an or condition (or condition, sum condition) of a plurality of combinations of the above-mentioned conditions may be set as the fourth determination condition.

<Other judgment conditions>
The following conditions may be set as other conditions different from the above-mentioned first determination condition to fourth determination condition.
-A condition indicating that the number of authorization inquiries for which the transaction amount is lower than the predetermined threshold (for example, less than 10 yen) exceeds the threshold within the predetermined time.
-A condition indicating that the number of SCS2 errors has exceeded the threshold value within a predetermined time.
-A condition that indicates that the ratio of the number of approvals to the total number of authorization inquiries has fallen below a predetermined threshold.
-Conditions that are the same as the first judgment condition and are judged for each member store. That is, a condition regarding the total amount of transactions and the total number of transactions related to all issuers handled by a member store.
-Conditions that are the same as the fourth judgment condition and are judged for each member store. That is, a condition regarding the total amount of transactions and the total number of transactions related to all issuers handled by a member store.

-When multiple authorization inquiries occur for the same person, the relationship between the time interval of the time when those inquiries occur and the physical distance between the member store addresses where the authorization inquiries occurred is a predetermined fraud. If you meet the criteria. The prescribed fraudulent standard is a standard that indicates that the physical distance cannot be moved within the time interval between authorizations, even when using transportation such as an airplane that can move at high speed. be. For example, if an authorization inquiry is made at a member store in Hokkaido and then an authorization inquiry is made at a member store in Okinawa 30 minutes later, it may be determined that this fraudulent standard is satisfied. However, if the payment is made within the same member store group, it may be a mistake such as a registration error of the member store master, so it may be determined that it is not fraudulent, or it may be a mistake. May be presented.

-If the relationship between the value registered as the scheme category and the amount of money that is generally used for the attribute indicated by the value of the scheme category meets the specified fraud criteria, fraud is performed. May be determined. For example, in general, a credit card often sets a limit of around 1 million yen, but a debit card has a lower limit. Therefore, if the debit card is registered as a scheme category and the amount exceeds a predetermined threshold value, there is a high possibility that the debit card is fraudulent.

-When multiple terminal devices are installed in a member store, the number of authorization inquiries from the member store and the number of terminals registered in the member store meet the prescribed fraudulent criteria. Indicates that it cannot be moved. More specifically, more authorizations than the result of multiplying the number of general authorization inquiries that can be issued from one terminal per unit time and the number of terminals installed in member stores. If the inquiry occurs in a unit time, it may be determined to be fraudulent.

The statistical information storage unit 47 is configured by using a storage device such as a magnetic hard disk or a semiconductor storage device. The statistical information storage unit 47 stores statistical information (for example, statistical information used in the first determination condition to the fourth determination condition) used in the determination process in the determination unit 492. For example, the statistical information storage unit 47 stores a transaction statistical information table and a specific transaction statistical information table. FIG. 6 is a diagram showing a specific example of the transaction statistical information table. FIG. 7 is a diagram showing a specific example of the specific transaction statistical information table.

The transaction statistics table has a plurality of transaction statistics records. The transaction statistics information record has transaction statistics information for each combination of the member store ID and the issuer ID. The transaction statistical information has, for example, statistical information (for example, the average value of the total amount in one hour) for the past predetermined number of days (for example, the previous day). The value of the transaction statistics information record registered in the transaction statistics information table may be updated, for example, by transmitting the latest statistics information from the management device 30 to the monitoring device 40. The value of the transaction statistics information record registered in the transaction statistics information table may be updated at a predetermined timing (for example, at a specific time every day) based on the information registered in the transaction information storage unit 44, for example.

The specific transaction statistics table has a plurality of specific transaction statistics records. The specific transaction statistical information record has specific transaction statistical information for each combination of the member store ID and the issuer ID. The specific transaction statistical information has, for example, statistical information (for example, the average value of the total amount in one hour) for a specific transaction (for example, a transaction without ECI) for a predetermined number of days in the past (for example, the previous day). The value of the specific transaction statistical information record registered in the specific transaction statistical information table may be updated, for example, by transmitting the latest statistical information from the management device 30 to the monitoring device 40. The value of the specific transaction statistics information record registered in the specific transaction statistics information table may be updated at a predetermined timing (for example, at a specific time every day) based on the information registered in the transaction information storage unit 44, for example. ..

The determination result storage unit 48 is configured by using a storage device such as a magnetic hard disk or a semiconductor storage device. The determination result storage unit 48 stores the history of the results of the determination processing performed by the determination unit 492 of the control unit 49.

The control unit 49 is configured by using a processor such as a CPU and a memory. The control unit 49 functions as an information management unit 491, a determination unit 492, and an information providing unit 493 when the processor executes a specific program.

When the information management unit 491 receives the authorization information transmitted from the FEP device 20 to the monitoring device 40, the information management unit 491 registers the contents of the received authorization information in the transaction information storage unit 44. The information management unit 491 updates the information registered in the statistical information storage unit 47 at a predetermined timing.

The determination unit 492 determines whether or not the determination condition registered in the determination condition storage unit 46 is satisfied by performing the determination process at a predetermined timing. By performing such a determination process by the determination unit 492, fraud related to a transaction using a payment medium is detected. The determination unit 492 outputs the determination result to the information providing unit 493. The determination unit 492 records the determination result in the determination result storage unit 48. The determination unit 492 may record the determination result in the determination result storage unit 48 only when the determination condition indicating fraud is satisfied.

The information providing unit 493 provides information related to the determination result to the user of the monitoring device 40 according to the determination result of the determination unit 492. For example, the information providing unit 493 may display an image including an image or a character indicating that the determination condition is satisfied by the determination unit 492 on the output unit 43. For example, the information providing unit 493 may output a voice indicating that the determination condition is satisfied by the determination unit 492 from the output unit 43. For example, the information providing unit 493 may send an e-mail or a message including an image or a character indicating that the determination condition is satisfied by the determination unit 492 to a specific mobile terminal registered in advance. When the information providing unit 493 is instructed by the user of the monitoring device 40 to display the determination result satisfying a specific condition via the input unit 42, the information providing unit 493 determines the determination result according to the instruction. Search from the storage unit 48. The information providing unit 493 outputs the search result from the output unit 43.

FIG. 8 is a sequence chart showing an example of the operation of the payment system 100. First, a request for conducting a transaction (payment) using a payment medium is input from the member store terminal 10 (step S101). Such input may be performed by, for example, reading the medium information of the payment medium by the reading unit 12, or by performing a specific operation on the input unit 13 by the operator of the member store terminal 10. You may be broken.

In response to the input of the transaction request, the member store terminal 10 generates authorization information and transmits it to the FEP device 20 (step S102). Upon receiving the authorization information, the FEP device 20 transmits the authorization information to the management device 30 (step S103). Upon receiving the authorization information, the management device 30 determines whether or not there is a problem with the authorization information according to a specific condition (step S104). The management device 30 transmits the result of the determination process related to the authorization information to the FEP device 20 (step S105). Upon receiving the determination result of the authorization information, the FEP device 20 transmits the determination result to the member store terminal 10 (step S106). Upon receiving the determination result, the member store terminal 10 outputs to the output unit 14 whether or not payment using the payment medium is possible according to the determination result.

The FEP device 20 transmits the authorization information received from the member store terminal 10 to the monitoring device 40 in addition to the management device 30 (step S107). When the information management unit 491 of the monitoring device 40 receives the authorization information, the information management unit 491 registers the received authorization information in the transaction information storage unit 44 (step S108). When a specific timing arrives, the determination unit 492 of the monitoring device 40 performs a determination process (step S109). For example, the determination unit 492 determines the number of transactions in the most recent hour from the information in the transaction information storage unit 44, and the value exceeds a predetermined time (for example, 30 times) the average value of the number of transactions per hour on the previous day. It may be determined whether or not. The timing at which the determination unit 492 performs such a determination process may be, for example, every hour, every day, or may be set in any way. The determination unit 492 outputs the determination result to the information providing unit 493. The information providing unit 493 outputs a determination result based on the determination result (step S110).

The payment system 100 configured in this way can detect fraud with higher accuracy in transactions using a payment medium. Specifically, it is as follows. In the payment system 100, one or a plurality of determination conditions relating to an event that may be fraudulent regarding a transaction using a payment medium are registered in the monitoring device 40. The FEP device 20 transmits the authorization information generated in each member store terminal 10 to the monitoring device 40. The monitoring device 40 determines whether or not the determination condition is satisfied at a predetermined timing based on the authorization information generated in each member store. As the determination condition, not a condition based on individual authorization information, but a condition regarding the total amount of money for a predetermined period (for example, 1 hour, 1 day, etc.) and the total number of transactions is set. More specifically, it is determined whether or not the total amount or the total number of transactions in a predetermined period exceeds the threshold value obtained based on the statistical information of the total amount or the total number of transactions in the same predetermined period in the past. Therefore, even for fraud that is difficult to appear in individual transactions, it is possible to accurately detect fraud that can be determined only by referring to the total amount of the predetermined period or the total number of transactions.

As the determination condition for detecting such fraud, the determination condition that can be realized only when the main body operating the management device 30 and the monitoring device 40 is a single acquirer may be set.

(Modification example)
The information providing unit 493 of the monitoring device 40 may provide the management device 30 with information regarding the determination result. For example, when a predetermined determination condition is satisfied, the information providing unit 493 may notify the management device 30 of the determination result. In this case, the management device 30 may be configured to temporarily suspend subsequent transactions relating to the member store or issuer pertaining to the notified determination condition. With this configuration, it is possible to deal with fraud more quickly (at a timing close to real time).
Some or all of the functions of the monitoring device 40 may be implemented in the management device 30.

Although the embodiments of the present invention have been described in detail with reference to the drawings, the specific configuration is not limited to this embodiment, and includes designs and the like within a range that does not deviate from the gist of the present invention.

100 ... Payment system, 10 ... Merchant terminal, 11 ... Communication unit, 12 ... Reading unit, 13 ... Input unit, 14 ... Output unit, 15 ... Control unit, 151 ... Payment control unit, 20 ... FEP device, 21 ... Communication Unit, 22 ... Control unit, 221 ... Communication control unit, 30 ... Management device, 40 ... Monitoring device, 41 ... Communication unit, 42 ... Input unit, 43 ... Output unit, 44 ... Transaction information storage unit, 45 ... Registration information storage Unit, 46 ... Judgment condition storage unit, 47 ... Statistical information storage unit, 48 ... Judgment result storage unit, 49 ... Control unit, 491 ... Information management unit, 492 ... Judgment unit, 493 ... Information provision unit, 50 ... Network

Claims (6)

Whether the value obtained based on a predetermined period or a plurality of transaction information corresponding to a predetermined number of payments made by a plurality of customers using a payment medium satisfies one or more predetermined judgment conditions regarding an event that may be fraudulent. Judgment unit to judge whether or not,
A monitoring device including an information providing unit that provides information on a determination result of the determination unit to a predetermined device or a person. Further equipped with an information management unit for acquiring authorization information transmitted from a member store terminal that processes payment using the payment medium.
The monitoring device according to claim 1, wherein the determination unit makes a determination based on the information obtained by the information management unit. The determination unit determines whether or not the determination condition is satisfied for each member store where payment using the payment medium is made, or for each issuer who is the issuer of the payment medium used for payment. , The monitoring device according to claim 1 or 2. The determination unit determines whether or not the determination condition is satisfied for each combination of the member store where the payment was made using the payment medium and the issuer who is the issuer of the payment medium used for the payment. The monitoring device according to claim 1 or 2, wherein the determination is made. One or more predetermined judgment conditions regarding an event in which the value obtained by the computer based on a plurality of transaction information corresponding to a predetermined period or a predetermined number of payments made by a plurality of customers using a payment medium may be fraudulent. Judgment step to determine whether or not the condition is satisfied, and
A monitoring method in which a computer has an information providing step of providing information regarding a determination result in the determination step to a predetermined device or a person. A computer program for operating a computer as the monitoring device according to any one of claims 1 to 4.

Images